terminalhire 0.42.19 → 0.42.21

package/dist/bin/jpi-dispatch.js

@@ -1466,6 +1466,7 @@ __export(github_auth_exports, {
   decrypt: () => decrypt,
   deleteGitHubToken: () => deleteGitHubToken,
   encrypt: () => encrypt,
+  githubTokenDisplayPath: () => githubTokenDisplayPath,
   hasGitHubToken: () => hasGitHubToken,
   loadKey: () => loadKey,
   readGitHubToken: () => readGitHubToken,
@@ -1476,8 +1477,12 @@ __export(github_auth_exports, {
 });
 import { createCipheriv, createDecipheriv, randomBytes as randomBytes2 } from "crypto";
 import { readFileSync as readFileSync7, writeFileSync as writeFileSync6, existsSync as existsSync8, rmSync as rmSync3, renameSync as renameSync2 } from "fs";
-import { join as join10 } from "path";
+import { join as join10, sep } from "path";
 import { homedir as homedir8 } from "os";
+function githubTokenDisplayPath() {
+  const home = homedir8();
+  return TOKEN_FILE.startsWith(home + sep) ? `~${TOKEN_FILE.slice(home.length)}` : TOKEN_FILE;
+}
 async function loadKey() {
   return loadOrCreateSharedKey();
 }
@@ -10290,10 +10295,10 @@ var init_node_model = __esm({
 // ../../packages/core/src/episodes/derivers/signals.ts
 function mcpToolSignal(name) {
   const rest = name.slice("mcp__".length);
-  const sep5 = rest.indexOf("__");
-  if (sep5 <= 0) return "mcp:custom";
-  const server = rest.slice(0, sep5).toLowerCase();
-  const leaf = rest.slice(sep5 + 2);
+  const sep6 = rest.indexOf("__");
+  if (sep6 <= 0) return "mcp:custom";
+  const server = rest.slice(0, sep6).toLowerCase();
+  const leaf = rest.slice(sep6 + 2);
   if (leaf.length === 0) return "mcp:custom";
   if (MCP_SERVER_CAPABILITY.has(server)) return MCP_SERVER_CAPABILITY.get(server) ?? null;
   return "mcp:custom";
@@ -12903,14 +12908,14 @@ async function run() {
   }
 }
 async function runLogin() {
-  const { runDeviceFlow: runDeviceFlow2, readGitHubToken: readGitHubToken2 } = await Promise.resolve().then(() => (init_github_auth(), github_auth_exports));
+  const { runDeviceFlow: runDeviceFlow2, readGitHubToken: readGitHubToken2, githubTokenDisplayPath: githubTokenDisplayPath2 } = await Promise.resolve().then(() => (init_github_auth(), github_auth_exports));
   const { fetchGitHubProfile: fetchGitHubProfile2, githubToFingerprint: githubToFingerprint2, computeAcceptanceCredential: computeAcceptanceCredential2 } = await Promise.resolve().then(() => (init_src(), src_exports));
   const { readProfile: readProfile2, writeProfile: writeProfile2, accumulateGitHubTags: accumulateGitHubTags2 } = await Promise.resolve().then(() => (init_profile(), profile_exports));
   console.log("");
   console.log("  terminalhire \u2014 Sign in with GitHub");
   console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
   console.log("  Scope: read:user  (public profile + public repos only)");
-  console.log("  Your token is encrypted and stored at ~/.terminalhire/github-token.enc");
+  console.log(`  Your token is encrypted and stored at ${githubTokenDisplayPath2()}`);
   console.log("  GitHub data enriches your LOCAL profile \u2014 no data leaves your machine.");
   console.log("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
   try {
@@ -13035,7 +13040,7 @@ async function runLogin() {
   }
 }
 async function runLogout() {
-  const { deleteGitHubToken: deleteGitHubToken2, hasGitHubToken: hasGitHubToken2 } = await Promise.resolve().then(() => (init_github_auth(), github_auth_exports));
+  const { deleteGitHubToken: deleteGitHubToken2, hasGitHubToken: hasGitHubToken2, githubTokenDisplayPath: githubTokenDisplayPath2 } = await Promise.resolve().then(() => (init_github_auth(), github_auth_exports));
   const { readProfile: readProfile2, writeProfile: writeProfile2 } = await Promise.resolve().then(() => (init_profile(), profile_exports));
   const hasToken = await hasGitHubToken2();
   if (!hasToken) {
@@ -13057,7 +13062,7 @@ async function runLogout() {
     await writeProfile2(profile);
     console.log("\n  GitHub identity + proof-of-work credential cleared from local profile.");
   }
-  console.log("  GitHub token deleted from ~/.terminalhire/github-token.enc");
+  console.log(`  GitHub token deleted from ${githubTokenDisplayPath2()}`);
   console.log("  Skill tags accumulated from GitHub remain in your profile.");
   console.log("  To also delete those: terminalhire profile --delete\n");
 }
@@ -32288,12 +32293,33 @@ function scrubEndpointEnv(env) {
   }
   return out;
 }
-function remoteDockerClient(endpoint) {
+function containerFlagsAt(args5) {
+  if (args5[0] === "run" || args5[0] === "create")
+    return 1;
+  if (args5[0] === "container" && (args5[1] === "run" || args5[1] === "create"))
+    return 2;
+  return -1;
+}
+function remoteDockerClient(endpoint, opts = {}) {
   if (endpoint.trim().length === 0) {
     throw new Error("remoteDockerClient: endpoint must be a non-empty docker host");
   }
   const target = endpoint.trim();
-  const argv = (args5) => ["--host", target, ...args5];
+  const tlsFlags = [];
+  if (opts.tls) {
+    for (const key of ["caPath", "certPath", "keyPath"]) {
+      if (opts.tls[key].trim().length === 0) {
+        throw new Error(`remoteDockerClient: tls.${key} must name a file`);
+      }
+    }
+    tlsFlags.push("--tlsverify", "--tlscacert", opts.tls.caPath, "--tlscert", opts.tls.certPath, "--tlskey", opts.tls.keyPath);
+  }
+  const runArgs = opts.runArgs ?? [];
+  const argv = (args5) => {
+    const at = runArgs.length > 0 ? containerFlagsAt(args5) : -1;
+    const sub = at < 0 ? [...args5] : [...args5.slice(0, at), ...runArgs, ...args5.slice(at)];
+    return ["--host", target, ...tlsFlags, ...sub];
+  };
   return {
     endpoint: target,
     // Always empty, and it is a fact about this client rather than about the
@@ -32310,10 +32336,10 @@ function remoteDockerClient(endpoint) {
         env: scrubEndpointEnv(process.env)
       });
     },
-    sync(args5, opts) {
+    sync(args5, opts2) {
       return syncResult(spawnSync4(DOCKER_BIN, argv(args5), {
         encoding: "utf8",
-        timeout: opts?.timeoutMs,
+        timeout: opts2?.timeoutMs,
         env: scrubEndpointEnv(process.env)
       }));
     },
@@ -34294,6 +34320,197 @@ var init_gceIdentity = __esm({
   }
 });
 
+// ../../packages/attest/dist/confidentialSpace.js
+import { createHash as createHash8, createPublicKey as createPublicKey3, verify as cryptoVerify3 } from "crypto";
+function refuse2(reason, detail) {
+  return { ok: false, reason, detail };
+}
+function isPlainObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function assertExpectationsComplete2(expectations) {
+  const required2 = [
+    ["audience", expectations.audience],
+    ["nonce", expectations.nonce],
+    ["instanceName", expectations.instanceName],
+    ["projectId", expectations.projectId],
+    ...(expectations.additionalNonces ?? []).map((n) => [
+      "additionalNonces[]",
+      n
+    ]),
+    ...Object.entries(expectations.containerEnv ?? {}).flatMap(([name, value]) => [
+      ["containerEnv name", name],
+      [`containerEnv.${name}`, value]
+    ])
+  ];
+  for (const [name, value] of required2) {
+    if (value === "") {
+      throw new TypeError(`verifyConfidentialSpaceToken: expectations.${name} is empty`);
+    }
+  }
+}
+function nonceList(v) {
+  if (typeof v === "string")
+    return [v];
+  if (!Array.isArray(v) || v.length === 0)
+    return null;
+  if (!v.every((n) => typeof n === "string"))
+    return null;
+  return v;
+}
+async function verifyConfidentialSpaceToken(token, expectations, deps) {
+  assertExpectationsComplete2(expectations);
+  if (!Number.isFinite(deps.now)) {
+    throw new TypeError("verifyConfidentialSpaceToken: deps.now is not a finite number");
+  }
+  if (expectations.allowedImageDigests.length === 0) {
+    return refuse2("image-digest-allowlist-unset", "no workload image digest is allowlisted, so no attestation can be accepted");
+  }
+  if (token.length > MAX_TOKEN_LENGTH) {
+    return refuse2("token-malformed", "longer than any attestation token");
+  }
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    return refuse2("token-malformed", "not a three-segment compact JWT");
+  }
+  const [headerB64, payloadB64, signatureB64] = parts;
+  const header = decodeJsonSegment(headerB64);
+  if (header === null) {
+    return refuse2("token-malformed", "header segment is not base64url-encoded JSON");
+  }
+  if (header.alg !== "RS256") {
+    return refuse2("algorithm-not-rs256", "token names an unsupported algorithm");
+  }
+  if (typeof header.kid !== "string" || header.kid === "") {
+    return refuse2("unknown-key", "token header names no key id");
+  }
+  const jwks = await deps.fetchJwks();
+  const jwk = jwks.keys.find((k) => k.kid === header.kid && k.kty === "RSA");
+  if (jwk === void 0) {
+    return refuse2("unknown-key", "token key id is not in the published key set");
+  }
+  const signature = strictBase64UrlDecode(signatureB64);
+  if (signature === null) {
+    return refuse2("token-malformed", "signature segment is not base64url");
+  }
+  let signatureValid = false;
+  try {
+    const publicKey = createPublicKey3({ key: jwk, format: "jwk" });
+    signatureValid = cryptoVerify3("sha256", Buffer.from(`${headerB64}.${payloadB64}`, "utf8"), publicKey, signature);
+  } catch {
+    signatureValid = false;
+  }
+  if (!signatureValid) {
+    return refuse2("signature-invalid", "signature does not verify under the named key");
+  }
+  const payload = decodeJsonSegment(payloadB64);
+  if (payload === null) {
+    return refuse2("token-malformed", "payload segment is not base64url-encoded JSON");
+  }
+  if (payload.iss !== CONFIDENTIAL_SPACE_ISSUER) {
+    return refuse2("wrong-issuer", "issuer is not the Confidential Computing attestation service");
+  }
+  if (payload.aud !== expectations.audience) {
+    return refuse2("wrong-audience", "audience is not the one this run expects");
+  }
+  const nowSeconds = deps.now / 1e3;
+  const exp = payload.exp;
+  if (typeof exp !== "number" || !Number.isFinite(exp) || exp <= nowSeconds) {
+    return refuse2("expired", "exp is missing, malformed, or in the past");
+  }
+  const iat = payload.iat;
+  if (typeof iat !== "number" || !Number.isFinite(iat) || iat > nowSeconds + IAT_FUTURE_SKEW_MS / 1e3) {
+    return refuse2("iat-in-future", "iat is missing, malformed, or too far in the future");
+  }
+  const nonces = nonceList(payload.eat_nonce);
+  if (nonces === null) {
+    return refuse2("nonce-missing", "eat_nonce is absent or not a string or array of strings");
+  }
+  if (!nonces.includes(expectations.nonce)) {
+    return refuse2("nonce-mismatch", "eat_nonce does not carry the nonce this run was dispatched with");
+  }
+  for (const extra of expectations.additionalNonces ?? []) {
+    if (!nonces.includes(extra)) {
+      return refuse2("nonce-mismatch", "eat_nonce does not carry every nonce this caller requires");
+    }
+  }
+  if (payload.swname !== CONFIDENTIAL_SPACE_SWNAME) {
+    return refuse2("swname-not-confidential-space", "the VM is not running a Confidential Space image");
+  }
+  if (payload.dbgstat !== CONFIDENTIAL_SPACE_DBGSTAT_PRODUCTION) {
+    return refuse2("debug-enabled", "the image is not a production image with debug disabled");
+  }
+  if (payload.secboot !== true) {
+    return refuse2("secure-boot-off", "Secure Boot is not reported as enabled");
+  }
+  if (typeof payload.hwmodel !== "string" || !payload.hwmodel.startsWith("GCP_")) {
+    return refuse2("hwmodel-not-gcp", "hardware model is not a Google Cloud confidential model");
+  }
+  const hwmodel = payload.hwmodel;
+  const submods = payload.submods;
+  const gce = isPlainObject(submods) ? submods.gce : void 0;
+  if (!isPlainObject(gce)) {
+    return refuse2("submods-gce-missing", "no submods.gce block names the instance");
+  }
+  if (gce.project_id !== expectations.projectId) {
+    return refuse2("project-mismatch", "token names an instance in a different project");
+  }
+  if (gce.instance_name !== expectations.instanceName) {
+    return refuse2("instance-name-mismatch", "token names a different instance than this run booted");
+  }
+  if (typeof gce.instance_id !== "string" || gce.instance_id === "") {
+    return refuse2("instance-id-missing", "instance id is absent or not a string");
+  }
+  const instanceId = gce.instance_id;
+  if (typeof gce.zone !== "string" || !expectations.allowedZones.includes(gce.zone)) {
+    return refuse2("zone-not-allowed", "zone is not one the pool is configured to use");
+  }
+  const zone = gce.zone;
+  const container = isPlainObject(submods) ? submods.container : void 0;
+  if (!isPlainObject(container)) {
+    return refuse2("submods-container-missing", "no submods.container block names the workload");
+  }
+  if (typeof container.image_reference !== "string" || container.image_reference === "") {
+    return refuse2("image-reference-missing", "the workload image reference is absent");
+  }
+  const imageReference = container.image_reference;
+  if (typeof container.image_digest !== "string" || !expectations.allowedImageDigests.includes(container.image_digest)) {
+    return refuse2("image-digest-not-allowed", "the workload image digest is not on the allowlist");
+  }
+  const env = container.env;
+  for (const [name, value] of Object.entries(expectations.containerEnv ?? {})) {
+    if (!isPlainObject(env) || !Object.prototype.hasOwnProperty.call(env, name) || env[name] !== value) {
+      return refuse2("container-env-mismatch", `the signed container environment does not carry the ${name} this caller booted with`);
+    }
+  }
+  return {
+    ok: true,
+    value: {
+      instanceId,
+      instanceName: expectations.instanceName,
+      zone,
+      projectId: expectations.projectId,
+      imageDigest: container.image_digest,
+      imageReference,
+      hwmodel,
+      iat,
+      exp,
+      tokenSha256: createHash8("sha256").update(token, "utf8").digest("hex")
+    }
+  };
+}
+var CONFIDENTIAL_SPACE_ISSUER, CONFIDENTIAL_SPACE_OIDC_DISCOVERY_URL, CONFIDENTIAL_SPACE_SWNAME, CONFIDENTIAL_SPACE_DBGSTAT_PRODUCTION;
+var init_confidentialSpace = __esm({
+  "../../packages/attest/dist/confidentialSpace.js"() {
+    "use strict";
+    init_gceIdentity();
+    CONFIDENTIAL_SPACE_ISSUER = "https://confidentialcomputing.googleapis.com";
+    CONFIDENTIAL_SPACE_OIDC_DISCOVERY_URL = `${CONFIDENTIAL_SPACE_ISSUER}/.well-known/openid-configuration`;
+    CONFIDENTIAL_SPACE_SWNAME = "CONFIDENTIAL_SPACE";
+    CONFIDENTIAL_SPACE_DBGSTAT_PRODUCTION = "disabled-since-boot";
+  }
+});
+
 // ../../packages/attest/dist/venueInstanceName.js
 function venueInstanceName(runId) {
   return `th-run-${runId}`.replace(/_/g, "-").toLowerCase().slice(0, 62);
@@ -34328,6 +34545,7 @@ var init_dist2 = __esm({
     init_attestation();
     init_nonce();
     init_gceIdentity();
+    init_confidentialSpace();
     init_venueInstanceName();
     init_verify();
   }
@@ -34578,7 +34796,7 @@ var init_result = __esm({
 });
 
 // ../../packages/envrun/dist/attestation.js
-import { createHash as createHash8, randomBytes as randomBytes11 } from "crypto";
+import { createHash as createHash9, randomBytes as randomBytes11 } from "crypto";
 function contradicts(outcome, counts, exitCode) {
   const budget = OUTCOME_TO_BUDGET[outcome];
   if (budget === null)
@@ -34620,7 +34838,7 @@ function imageDigestOf(ref) {
   return at === -1 ? null : ref.slice(at + 1);
 }
 function sha256Hex(data) {
-  return createHash8("sha256").update(typeof data === "string" ? Buffer.from(data, "utf8") : data).digest("hex");
+  return createHash9("sha256").update(typeof data === "string" ? Buffer.from(data, "utf8") : data).digest("hex");
 }
 function toTestRunResult(result, outputSha256) {
   return {
@@ -34632,50 +34850,50 @@ function toTestRunResult(result, outputSha256) {
 function toAcceptancePredicate(pair, opts = {}) {
   const { baseline, patched } = pair;
   if (baseline.runId === patched.runId) {
-    return refuse2("pair-is-the-same-run", `both sides are run ${patched.runId}. A baseline and a patched result that are the same execution prove nothing about the patch, and every field of the pair would be equal by construction.`);
+    return refuse3("pair-is-the-same-run", `both sides are run ${patched.runId}. A baseline and a patched result that are the same execution prove nothing about the patch, and every field of the pair would be equal by construction.`);
   }
   if (patched.status === "refused") {
-    return refuse2("run-was-refused", `the patched run was refused before executing (${patched.boundaryRefusals.length} boundary refusal(s)), so there is no result to attest`);
+    return refuse3("run-was-refused", `the patched run was refused before executing (${patched.boundaryRefusals.length} boundary refusal(s)), so there is no result to attest`);
   }
   if (patched.outcome === null) {
-    return refuse2("no-outcome-recorded", "the patched run recorded no outcome");
+    return refuse3("no-outcome-recorded", "the patched run recorded no outcome");
   }
   if (baseline.status === "refused") {
-    return refuse2("baseline-was-refused", `the baseline run was refused before executing (${baseline.boundaryRefusals.length} boundary refusal(s)), so there is no "before" to compare against`);
+    return refuse3("baseline-was-refused", `the baseline run was refused before executing (${baseline.boundaryRefusals.length} boundary refusal(s)), so there is no "before" to compare against`);
   }
   if (baseline.outcome === null) {
-    return refuse2("baseline-no-outcome", "the baseline run recorded no outcome");
+    return refuse3("baseline-no-outcome", "the baseline run recorded no outcome");
   }
   if (!BASELINE_IS_A_VERDICT[baseline.outcome]) {
-    return refuse2("baseline-environment-failed", `the baseline ended ${baseline.outcome}, which is not an observed verdict about the unpatched tree. Signing it would let a baseline we could not read stand in for one that failed, and a broken baseline flatters every patch.`);
+    return refuse3("baseline-environment-failed", `the baseline ended ${baseline.outcome}, which is not an observed verdict about the unpatched tree. Signing it would let a baseline we could not read stand in for one that failed, and a broken baseline flatters every patch.`);
   }
   const budget = OUTCOME_TO_BUDGET[patched.outcome];
   if (budget === null) {
-    return refuse2("our-environment-failed", `the patched run ended ${patched.outcome}: the test command could not be invoked, which is our environment failing and not a verdict about the work. No statement is emitted, because every possible value would be a claim we cannot support.`);
+    return refuse3("our-environment-failed", `the patched run ended ${patched.outcome}: the test command could not be invoked, which is our environment failing and not a verdict about the work. No statement is emitted, because every possible value would be a claim we cannot support.`);
   }
   if (patched.testCommand === null) {
-    return refuse2("no-test-command", "no test command was recorded, so none can be attested");
+    return refuse3("no-test-command", "no test command was recorded, so none can be attested");
   }
   if (baseline.testCommand !== patched.testCommand) {
-    return refuse2("pair-disagrees-on-harness", `baseline ran ${JSON.stringify(baseline.testCommand)} and patched ran ${JSON.stringify(patched.testCommand)}. Opposite verdicts from different harnesses say nothing about the patch.`);
+    return refuse3("pair-disagrees-on-harness", `baseline ran ${JSON.stringify(baseline.testCommand)} and patched ran ${JSON.stringify(patched.testCommand)}. Opposite verdicts from different harnesses say nothing about the patch.`);
   }
   if (baseline.targetSha !== patched.targetSha) {
-    return refuse2("pair-disagrees-on-base", `baseline is at ${baseline.targetSha} and patched at ${patched.targetSha}`);
+    return refuse3("pair-disagrees-on-base", `baseline is at ${baseline.targetSha} and patched at ${patched.targetSha}`);
   }
   if (patched.treeDigest === null || patched.treeDigest === "") {
-    return refuse2("missing-tree-digest", "the patched run recorded no tree digest to bind to");
+    return refuse3("missing-tree-digest", "the patched run recorded no tree digest to bind to");
   }
   if (patched.patchSha256 === null || patched.patchSha256 === "") {
-    return refuse2("missing-patch-digest", "the patched run recorded no patch digest");
+    return refuse3("missing-patch-digest", "the patched run recorded no patch digest");
   }
   if (baseline.treeDigest === null || baseline.treeDigest === "") {
-    return refuse2("missing-tree-digest", "the baseline recorded no tree digest, so the two halves cannot be shown to differ");
+    return refuse3("missing-tree-digest", "the baseline recorded no tree digest, so the two halves cannot be shown to differ");
   }
   if (baseline.treeDigest === patched.treeDigest) {
-    return refuse2("pair-has-identical-tree", `both sides are tree ${String(patched.treeDigest).slice(0, 12)}\u2026, so whatever the two runs disagree about, it is not the patch`);
+    return refuse3("pair-has-identical-tree", `both sides are tree ${String(patched.treeDigest).slice(0, 12)}\u2026, so whatever the two runs disagree about, it is not the patch`);
   }
   if (patched.baselinePatchSha256 !== null || baseline.baselinePatchSha256 !== null) {
-    return refuse2("patch-binding-incomplete", `a baseline patch shaped the ${patched.baselinePatchSha256 !== null ? "patched" : "baseline"} tree, so it cannot be reproduced from (base_commit_oid, patch_sha256) alone. Fold it into the binding before signing; do not sign a triple a verifier cannot follow.`);
+    return refuse3("patch-binding-incomplete", `a baseline patch shaped the ${patched.baselinePatchSha256 !== null ? "patched" : "baseline"} tree, so it cannot be reproduced from (base_commit_oid, patch_sha256) alone. Fold it into the binding before signing; do not sign a triple a verifier cannot follow.`);
   }
   for (const [side, outcome, counts, exitCode] of [
     ["patched", patched.outcome, patched.counts, patched.exitCode],
@@ -34683,7 +34901,7 @@ function toAcceptancePredicate(pair, opts = {}) {
   ]) {
     const why = contradicts(outcome, counts, exitCode);
     if (why !== null) {
-      return refuse2("outcome-contradicts-counts", `the ${side} run is ${why}`);
+      return refuse3("outcome-contradicts-counts", `the ${side} run is ${why}`);
     }
   }
   for (const [side, source] of [
@@ -34692,44 +34910,44 @@ function toAcceptancePredicate(pair, opts = {}) {
   ]) {
     const why = SOURCE_IS_SIGNABLE[source](patched.testCommand);
     if (why !== null)
-      return refuse2("test-command-origin-unattested", `the ${side} run ${why}`);
+      return refuse3("test-command-origin-unattested", `the ${side} run ${why}`);
   }
   if (patched.testCommandSource === "developer-declared") {
-    return refuse2("test-command-origin-unattested", "the developer supplied the test command (unreachable \u2014 the source rules above cover it)");
+    return refuse3("test-command-origin-unattested", "the developer supplied the test command (unreachable \u2014 the source rules above cover it)");
   }
   if (baseline.testCommandSource !== patched.testCommandSource) {
-    return refuse2("test-command-origin-unattested", `the pair disagrees on where the command came from: baseline ${baseline.testCommandSource}, patched ${patched.testCommandSource}. One signed value cannot describe both.`);
+    return refuse3("test-command-origin-unattested", `the pair disagrees on where the command came from: baseline ${baseline.testCommandSource}, patched ${patched.testCommandSource}. One signed value cannot describe both.`);
   }
   if (baseline.containerImage !== patched.containerImage) {
-    return refuse2("pair-disagrees-on-image", `baseline ran in ${String(baseline.containerImage)} and patched in ${String(patched.containerImage)}. The signed measurement names one image, so a pair from two environments would attribute to the patch whatever the image changed.`);
+    return refuse3("pair-disagrees-on-image", `baseline ran in ${String(baseline.containerImage)} and patched in ${String(patched.containerImage)}. The signed measurement names one image, so a pair from two environments would attribute to the patch whatever the image changed.`);
   }
   if (patched.containerImage === null || patched.containerImage === "") {
-    return refuse2("missing-container-image", "no container image was recorded, so the measurement would name a stand-in rather than the environment the suite actually ran in");
+    return refuse3("missing-container-image", "no container image was recorded, so the measurement would name a stand-in rather than the environment the suite actually ran in");
   }
   if (patched.containerImageDigest == null || patched.containerImageDigest === "") {
-    return refuse2("missing-image-digest", "no image digest was recorded for the patched half, so the measurement would name the mutable tag rather than the bytes the suite actually ran in. A run without the digest is recordable but not attestable \u2014 the `missing-patch-digest` split.");
+    return refuse3("missing-image-digest", "no image digest was recorded for the patched half, so the measurement would name the mutable tag rather than the bytes the suite actually ran in. A run without the digest is recordable but not attestable \u2014 the `missing-patch-digest` split.");
   }
   if (typeof patched.containerImageDigest !== "string" || !isCanonicalRepoDigest(patched.containerImageDigest)) {
-    return refuse2("malformed-image-digest", `the patched half carries ${JSON.stringify(patched.containerImageDigest).slice(0, 120)} where a RepoDigest (\`repo@sha256:<64 hex>\`) belongs. A tag or a stand-in string here would be signed as if it were content-addressed, which is the lie the digest axis exists to refuse.`);
+    return refuse3("malformed-image-digest", `the patched half carries ${JSON.stringify(patched.containerImageDigest).slice(0, 120)} where a RepoDigest (\`repo@sha256:<64 hex>\`) belongs. A tag or a stand-in string here would be signed as if it were content-addressed, which is the lie the digest axis exists to refuse.`);
   }
   if (imageRepo(patched.containerImageDigest) !== imageRepo(patched.containerImage)) {
-    return refuse2("image-digest-repo-mismatch", `the patched half's digest names repository ${imageRepo(patched.containerImageDigest)} but the pair ran ${patched.containerImage}. An image can carry digests for several repositories; signing one the pair did not name would attribute these bytes to a different name.`);
+    return refuse3("image-digest-repo-mismatch", `the patched half's digest names repository ${imageRepo(patched.containerImageDigest)} but the pair ran ${patched.containerImage}. An image can carry digests for several repositories; signing one the pair did not name would attribute these bytes to a different name.`);
   }
   if (baseline.containerImageDigest == null || baseline.containerImageDigest === "") {
-    return refuse2("missing-image-digest", "no image digest was recorded for the baseline half, so the measurement would name the mutable tag rather than the bytes the suite actually ran in. A run without the digest is recordable but not attestable \u2014 the `missing-patch-digest` split.");
+    return refuse3("missing-image-digest", "no image digest was recorded for the baseline half, so the measurement would name the mutable tag rather than the bytes the suite actually ran in. A run without the digest is recordable but not attestable \u2014 the `missing-patch-digest` split.");
   }
   if (typeof baseline.containerImageDigest !== "string" || !isCanonicalRepoDigest(baseline.containerImageDigest)) {
-    return refuse2("malformed-image-digest", `the baseline half carries ${JSON.stringify(baseline.containerImageDigest).slice(0, 120)} where a RepoDigest (\`repo@sha256:<64 hex>\`) belongs. A tag or a stand-in string here would be signed as if it were content-addressed, which is the lie the digest axis exists to refuse.`);
+    return refuse3("malformed-image-digest", `the baseline half carries ${JSON.stringify(baseline.containerImageDigest).slice(0, 120)} where a RepoDigest (\`repo@sha256:<64 hex>\`) belongs. A tag or a stand-in string here would be signed as if it were content-addressed, which is the lie the digest axis exists to refuse.`);
   }
   if (imageRepo(baseline.containerImageDigest) !== imageRepo(patched.containerImage)) {
-    return refuse2("image-digest-repo-mismatch", `the baseline half's digest names repository ${imageRepo(baseline.containerImageDigest)} but the pair ran ${patched.containerImage}. An image can carry digests for several repositories; signing one the pair did not name would attribute these bytes to a different name.`);
+    return refuse3("image-digest-repo-mismatch", `the baseline half's digest names repository ${imageRepo(baseline.containerImageDigest)} but the pair ran ${patched.containerImage}. An image can carry digests for several repositories; signing one the pair did not name would attribute these bytes to a different name.`);
   }
   if (baseline.containerImageDigest !== patched.containerImageDigest) {
-    return refuse2("pair-disagrees-on-image-digest", `baseline ran image digest ${String(baseline.containerImageDigest)} and patched ${String(patched.containerImageDigest)} under one tag. The tag agreeing is the trap: a re-pointed tag is two environments wearing one name.`);
+    return refuse3("pair-disagrees-on-image-digest", `baseline ran image digest ${String(baseline.containerImageDigest)} and patched ${String(patched.containerImageDigest)} under one tag. The tag agreeing is the trap: a re-pointed tag is two environments wearing one name.`);
   }
   const claimedDigest = imageDigestOf(patched.containerImage);
   if (claimedDigest !== null && claimedDigest !== imageDigestOf(patched.containerImageDigest)) {
-    return refuse2("image-digest-contradicts-image", `the pair ran ${patched.containerImage}, whose reference pins digest ${claimedDigest}, but the digest field says ${String(imageDigestOf(patched.containerImageDigest))}. A measurement must not sign one digest while the record names another.`);
+    return refuse3("image-digest-contradicts-image", `the pair ran ${patched.containerImage}, whose reference pins digest ${claimedDigest}, but the digest field says ${String(imageDigestOf(patched.containerImageDigest))}. A measurement must not sign one digest while the record names another.`);
   }
   return {
     ok: true,
@@ -34756,7 +34974,7 @@ function signRunStatement(predicate, privateKey, keyid) {
   const statement = createAcceptanceStatement(predicate);
   return { statement, envelope: signStatement(statement, privateKey, keyid) };
 }
-var OUTCOME_TO_BUDGET, BASELINE_IS_A_VERDICT, CONTRADICTS_COUNTS, SOURCE_IS_SIGNABLE, ATTEST_REFUSAL_REASONS, refuse2, LOCAL_MEASUREMENT_PREFIX, REFERENCE_DOMAIN_COMPONENT, REFERENCE_DOMAIN_NAME, REFERENCE_IPV6, REFERENCE_DOMAIN, REFERENCE_PATH_COMPONENT, REPO_DIGEST_RE;
+var OUTCOME_TO_BUDGET, BASELINE_IS_A_VERDICT, CONTRADICTS_COUNTS, SOURCE_IS_SIGNABLE, ATTEST_REFUSAL_REASONS, refuse3, LOCAL_MEASUREMENT_PREFIX, REFERENCE_DOMAIN_COMPONENT, REFERENCE_DOMAIN_NAME, REFERENCE_IPV6, REFERENCE_DOMAIN, REFERENCE_PATH_COMPONENT, REPO_DIGEST_RE;
 var init_attestation2 = __esm({
   "../../packages/envrun/dist/attestation.js"() {
     "use strict";
@@ -34860,7 +35078,7 @@ var init_attestation2 = __esm({
       "outcome-contradicts-counts",
       "test-command-origin-unattested"
     ];
-    refuse2 = (reason, detail) => ({
+    refuse3 = (reason, detail) => ({
       ok: false,
       reason,
       detail
@@ -35243,6 +35461,73 @@ var init_boundary = __esm({
 });
 
 // ../../packages/envrun/dist/gcpPlacement.js
+function assertWorkloadImage(fn, value) {
+  if (typeof value !== "string" || !WORKLOAD_IMAGE_REFERENCE.test(value)) {
+    throw new GcpPlacementError(`${fn}: the workload image is missing or is not one plain image reference (${String(WORKLOAD_IMAGE_REFERENCE)}). It lands inside a comma-separated --metadata= list, so anything that could start a second key is refused.`);
+  }
+}
+function venueImageFromEnv(env) {
+  const image = env["VENUE_IMAGE"] ?? "";
+  if (image === "" || image === "cos-stable")
+    return { venueImage: "cos-stable" };
+  if (image !== "confidential-space") {
+    throw new GcpPlacementError("VENUE_IMAGE is set to something other than cos-stable or confidential-space. An unknown value is refused rather than booted as the default.");
+  }
+  const workloadImage = env["VENUE_WORKLOAD_IMAGE"] ?? "";
+  if (workloadImage === "") {
+    throw new GcpPlacementError("VENUE_IMAGE=confidential-space needs VENUE_WORKLOAD_IMAGE, the image reference the Confidential Space launcher runs. Nothing boots without one.");
+  }
+  assertWorkloadImage("venueImageFromEnv", workloadImage);
+  return { venueImage: "confidential-space", workloadImage };
+}
+function bootImageFlags(p) {
+  const image = p.venueImage ?? "cos-stable";
+  if (image === "cos-stable")
+    return ["--image-family=cos-stable", "--image-project=cos-cloud"];
+  if (image !== "confidential-space") {
+    throw new GcpPlacementError("gcpBootArgv: venueImage is not one of cos-stable, confidential-space. An unknown image is refused rather than booted as the default.");
+  }
+  const workloadImage = p.workloadImage;
+  assertWorkloadImage("gcpBootArgv", workloadImage);
+  const clientCert = p.clientCert;
+  if (typeof clientCert !== "string" || !CLIENT_CERT_BASE64URL.test(clientCert)) {
+    throw new GcpPlacementError(`gcpBootArgv: the client certificate is missing or is not one base64url value (${String(CLIENT_CERT_BASE64URL)}). It lands inside the --metadata value, so anything that could start a second key is refused.`);
+  }
+  if (p.runId.length < MIN_NONCE_BYTES) {
+    throw new GcpPlacementError(`gcpBootArgv: a Confidential Space run id must be at least ${String(MIN_NONCE_BYTES)} characters, because it is the attestation token's nonce and the launcher refuses a shorter one. Refused here, before a VM is billed for a token it cannot mint.`);
+  }
+  const metadata = [
+    `tee-image-reference=${workloadImage}`,
+    "tee-container-log-redirect=true",
+    'tee-added-capabilities=["CAP_SYS_ADMIN","CAP_NET_ADMIN"]',
+    "tee-cgroup-ns=true",
+    `tee-env-TH_AUDIENCE=${expectedAudience(p.runId)}`,
+    `tee-env-TH_NONCE=${p.runId}`,
+    `tee-env-TH_CLIENT_CERT=${clientCert}`
+  ];
+  return [
+    // The production family. The debug family reports `dbgstat: enabled`, which the
+    // intake's verifier refuses, so a debug boot could never produce a run we record.
+    "--image-family=confidential-space",
+    "--image-project=confidential-space-images",
+    "--confidential-compute-type=SEV",
+    // The deploy-workloads page says N2D with SEV may set MIGRATE for live migration,
+    // and every other machine type needs TERMINATE. The spec chose TERMINATE: a
+    // maintenance event ends the VM instead of moving it, which for a VM that lives at
+    // most GCP_MAX_RUN_DURATION_SECONDS costs one run. Whether GCE boots this exact
+    // combination is phase 5's measurement.
+    "--maintenance-policy=TERMINATE",
+    `--metadata=^;^${metadata.join(";")}`,
+    // What the standing firewall rule for IAP's range matches, so the tunnels to the
+    // workload's dockerd and attest ports open on these VMs and no others.
+    "--tags=th-cs-venue",
+    // The family's 11 GB default leaves the workload a 7.7 GB root, and dockerd there
+    // runs vfs, which copies every layer and every container's rootfs in full. Pulling
+    // node:20-bookworm left 992 MB, and the next container create failed ENOSPC
+    // (measured, TERM-1094). COS runs overlay2 on its own disk and keeps the default.
+    "--boot-disk-size=50GB"
+  ];
+}
 function assertInstanceIdentity(fn, id) {
   const fields = [
     ["vmName", id.vmName, GCE_INSTANCE_NAME],
@@ -35268,8 +35553,8 @@ function gcpBootArgv(p) {
     `--project=${p.project}`,
     `--zone=${p.zone}`,
     `--machine-type=${p.machineType}`,
-    "--image-family=cos-stable",
-    "--image-project=cos-cloud",
+    // What the VM boots, and the one part of this argv the two images do not share.
+    ...bootImageFlags(p),
     // ── THE OUTER REAP. This, not the `finally` below, is what bounds the bill. ──
     //
     // An in-process `finally` is a best effort, not a reap. SIGKILL, a crashed
@@ -35314,7 +35599,13 @@ function gcpBootArgv(p) {
     // expectation uses (TERM-832): two inline spellings of one value is how
     // the boot path and the verifier drift apart silently.
     `--service-account=${venueIdentityEmail(p.project)}`,
-    "--no-scopes",
+    // A Confidential Space VM takes `cloud-platform` instead (TERM-1094): the launcher
+    // pulls the workload image and mints the attestation token with this account, and
+    // under `--no-scopes` it can do neither. What bounds a lifted token there is the
+    // account's two grants — `confidentialcomputing.workloadUser` and a reader on the
+    // one venue image repository — plus point 2 above, which is unchanged: the fence
+    // still denies untrusted code the metadata server.
+    ...p.venueImage === "confidential-space" ? ["--scopes=cloud-platform"] : ["--no-scopes"],
     "--shielded-secure-boot",
     "--shielded-vtpm",
     "--shielded-integrity-monitoring",
@@ -35347,7 +35638,7 @@ function gcpDeleteArgv(p) {
     "--quiet"
   ];
 }
-var DEFAULT_GCP_PROJECT, DEFAULT_GCP_ZONE, DEFAULT_GCP_MACHINE_TYPE, GcpPlacementError, GCP_MAX_RUN_DURATION_SECONDS, GCP_MANAGED_LABEL_KEY, GCP_RUN_LABEL_KEY, GCP_LABEL_VALUE, GCE_INSTANCE_NAME, GCP_RESOURCE_ID;
+var DEFAULT_GCP_PROJECT, DEFAULT_GCP_ZONE, DEFAULT_GCP_MACHINE_TYPE, GcpPlacementError, GCP_MAX_RUN_DURATION_SECONDS, GCP_MANAGED_LABEL_KEY, GCP_RUN_LABEL_KEY, CONFIDENTIAL_SPACE_MACHINE_TYPE, WORKLOAD_IMAGE_REFERENCE, CLIENT_CERT_BASE64URL, MIN_NONCE_BYTES, GCP_LABEL_VALUE, GCE_INSTANCE_NAME, GCP_RESOURCE_ID;
 var init_gcpPlacement = __esm({
   "../../packages/envrun/dist/gcpPlacement.js"() {
     "use strict";
@@ -35364,6 +35655,10 @@ var init_gcpPlacement = __esm({
     GCP_MAX_RUN_DURATION_SECONDS = 3600;
     GCP_MANAGED_LABEL_KEY = "th-managed";
     GCP_RUN_LABEL_KEY = "th-run";
+    CONFIDENTIAL_SPACE_MACHINE_TYPE = "n2d-standard-2";
+    WORKLOAD_IMAGE_REFERENCE = /^[A-Za-z0-9][A-Za-z0-9._/:@-]{0,511}$/;
+    CLIENT_CERT_BASE64URL = /^[A-Za-z0-9_-]{16,8192}$/;
+    MIN_NONCE_BYTES = 10;
     GCP_LABEL_VALUE = /^[a-z0-9_-]{1,63}$/;
     GCE_INSTANCE_NAME = /^[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?$/;
     GCP_RESOURCE_ID = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
@@ -35405,7 +35700,10 @@ var init_emptyGitConfig = __esm({
 
 // ../../packages/envrun/dist/hostedVenue.js
 import { spawn as spawn6, spawnSync as spawnSync6 } from "child_process";
-import { chmodSync as chmodSync3, existsSync as existsSync18, mkdtempSync as mkdtempSync3, readFileSync as readFileSync25, rmSync as rmSync10 } from "fs";
+import { createHash as createHash10, X509Certificate } from "crypto";
+import { chmodSync as chmodSync3, existsSync as existsSync18, mkdtempSync as mkdtempSync3, readFileSync as readFileSync25, rmSync as rmSync10, writeFileSync as writeFileSync22 } from "fs";
+import { request as httpsRequest } from "https";
+import { createServer } from "net";
 import { join as join40 } from "path";
 import { tmpdir as tmpdir3 } from "os";
 function credentialInGitConfig(text) {
@@ -35607,6 +35905,89 @@ timed out after ${String(timeoutMs)}ms` : stderr,
     });
   });
 }
+function socketErrorReason(err) {
+  if (err.message !== "")
+    return err.message;
+  const code = err.code;
+  if (code !== void 0)
+    return code;
+  const inner = err.errors;
+  if (Array.isArray(inner) && inner[0] instanceof Error && inner[0].message !== "") {
+    return inner[0].message;
+  }
+  return err.name;
+}
+function fetchAttestationOverTls(req) {
+  return new Promise((resolve7) => {
+    let whole;
+    const settle = (reading) => {
+      if (whole !== void 0)
+        clearTimeout(whole);
+      resolve7(reading);
+    };
+    let cert;
+    let key;
+    try {
+      cert = readFileSync25(req.certPath);
+      key = readFileSync25(req.keyPath);
+    } catch (err) {
+      settle({ ok: false, reason: `the client key could not be read: ${describeErr(err)}` });
+      return;
+    }
+    const call = httpsRequest({
+      host: "localhost",
+      port: req.port,
+      path: "/attest",
+      method: "GET",
+      servername: "localhost",
+      cert,
+      key,
+      rejectUnauthorized: false,
+      agent: false,
+      timeout: req.timeoutMs
+    }, (res) => {
+      const peer = res.socket.getPeerCertificate();
+      let body = "";
+      res.setEncoding("utf8");
+      res.on("data", (chunk) => {
+        body += chunk;
+        if (body.length > MAX_TOKEN_LENGTH) {
+          settle({ ok: false, reason: "the answer is longer than any attestation token" });
+          res.destroy();
+        }
+      });
+      res.on("end", () => {
+        if (res.statusCode !== 200) {
+          settle({
+            ok: false,
+            reason: `the attest endpoint answered HTTP ${String(res.statusCode)}`
+          });
+          return;
+        }
+        const raw = peer.raw;
+        if (raw === void 0 || raw.length === 0) {
+          settle({ ok: false, reason: "the attest endpoint presented no certificate" });
+          return;
+        }
+        settle({ ok: true, token: body.trim(), peerCertDer: new Uint8Array(raw) });
+      });
+      res.on("error", (err) => {
+        settle({ ok: false, reason: socketErrorReason(err) });
+      });
+    });
+    whole = setTimeout(() => {
+      settle({ ok: false, reason: `no complete answer within ${String(req.timeoutMs)}ms` });
+      call.destroy();
+    }, req.timeoutMs);
+    call.on("timeout", () => {
+      call.destroy(new Error(`no answer within ${String(req.timeoutMs)}ms`));
+    });
+    call.on("error", (err) => {
+      settle({ ok: false, reason: socketErrorReason(err) });
+    });
+    call.end();
+  });
+}
 function quoteForRemoteShell(arg) {
   return `'${arg.replace(/'/g, "'\\''")}'`;
 }
@@ -35941,25 +36322,370 @@ ${res.stderr}`);
 function manualDeleteCommand(vm, project, zone) {
   return `gcloud compute instances delete ${vm} --project=${project} --zone=${zone} --quiet`;
 }
+function clientCertArgv(keyPath, certPath) {
+  return [
+    "req",
+    "-x509",
+    "-newkey",
+    "ec",
+    "-pkeyopt",
+    "ec_paramgen_curve:P-256",
+    "-nodes",
+    "-keyout",
+    keyPath,
+    "-out",
+    certPath,
+    "-subj",
+    "/CN=terminalhire-worker",
+    "-days",
+    "1",
+    "-addext",
+    "extendedKeyUsage=clientAuth"
+  ];
+}
+function iapPortTunnelArgv(vm, project, zone, remotePort, localPort) {
+  return [
+    "compute",
+    "start-iap-tunnel",
+    vm,
+    String(remotePort),
+    `--local-host-port=localhost:${String(localPort)}`,
+    `--project=${project}`,
+    `--zone=${zone}`,
+    "--iap-tunnel-disable-connection-check"
+  ];
+}
+function spkiSha256Hex(certDer) {
+  const spki = new X509Certificate(certDer).publicKey.export({ type: "spki", format: "der" });
+  return createHash10("sha256").update(spki).digest("hex");
+}
+function certMetadataValue(pem) {
+  return new X509Certificate(pem).raw.toString("base64url");
+}
+function requireWorkloadDigest(reference) {
+  const named = /@(sha256:[0-9a-f]{64})$/.exec(reference);
+  if (named === null) {
+    throw new GcpPlacementError("VENUE_WORKLOAD_IMAGE must name its image by digest (\u2026@sha256:<64 hex>) for a Confidential Space venue: the attestation is checked against that digest, and a tag names whatever was pushed last.");
+  }
+  return named[1];
+}
+function underStageRoot(path6) {
+  if (!path6.startsWith(`${CS_STAGE_ROOT}/`)) {
+    throw new Error(`${path6} is outside ${CS_STAGE_ROOT}, the only directory the stage helpers mount`);
+  }
+  return path6;
+}
+function userFlag(owner) {
+  return `--user=${String(owner.uid)}:${String(owner.gid)}`;
+}
+function csStagePrepareArgv(stageBase, owner) {
+  const dirs = Object.values(venueStagePaths(underStageRoot(stageBase))).map(quoteForRemoteShell);
+  return [
+    "run",
+    "--rm",
+    "--network=none",
+    `--volume=${CS_STAGE_ROOT}:${CS_STAGE_ROOT}:rw`,
+    "--",
+    STAGE_HELPER_IMAGE,
+    "sh",
+    "-c",
+    `mkdir -p ${dirs.join(" ")} && chown -R ${String(owner.uid)}:${String(owner.gid)} ` + quoteForRemoteShell(stageBase)
+  ];
+}
+function csUntarArgv(dir, owner) {
+  return [
+    "run",
+    "-i",
+    "--rm",
+    "--network=none",
+    userFlag(owner),
+    `--volume=${underStageRoot(dir)}:/dst:rw`,
+    "--",
+    STAGE_HELPER_IMAGE,
+    "tar",
+    "-xf",
+    "-",
+    "-C",
+    "/dst"
+  ];
+}
+function csUntarProxyArgv(dir, owner) {
+  const d = quoteForRemoteShell(underStageRoot(dir));
+  return [
+    "run",
+    "-i",
+    "--rm",
+    "--network=none",
+    userFlag(owner),
+    `--volume=${CS_STAGE_ROOT}:${CS_STAGE_ROOT}:rw`,
+    "--",
+    STAGE_HELPER_IMAGE,
+    "sh",
+    "-c",
+    `mkdir -p ${d} && tar -C ${d} -xf - && chmod 0644 ${d}/*.js && chmod 0755 ${d}`
+  ];
+}
+function csRemoveArgv(dir, owner) {
+  return [
+    "run",
+    "--rm",
+    "--network=none",
+    userFlag(owner),
+    `--volume=${CS_STAGE_ROOT}:${CS_STAGE_ROOT}:rw`,
+    "--",
+    STAGE_HELPER_IMAGE,
+    "rm",
+    "-rf",
+    "--",
+    underStageRoot(dir)
+  ];
+}
+function sshStageTransport(vm, project, zone, env, io) {
+  return {
+    /**
+     * `id -u` / `id -g` on the venue, as the account that untarred the tree.
+     *
+     * That account is the owner BY CONSTRUCTION — the untar runs as the ssh user,
+     * so asking it who it is answers exactly the question the mount needs, without
+     * a chown and without assuming a uid. One ssh round trip, once per run.
+     *
+     * Both ids come from ONE invocation. Two calls could straddle a reconnect and
+     * pair a uid with another session's gid — a third wrong answer rather than a
+     * half-right one, which is the reason `GuestUser` is a pair in the first place.
+     */
+    readOwner: () => {
+      const res = io.exec(
+        "gcloud",
+        iapSshArgv(vm, project, zone, "id -u && id -g"),
+        OWNER_PROBE_TIMEOUT_MS,
+        // `env`, like every other gcloud call here. TERM-724 made the venue boot under the
+        // SERVICE configuration rather than whoever is at the terminal, and a probe that
+        // omitted this would ssh under the person's own credential — then report an owner
+        // measured against a session the run does not use.
+        env
+      );
+      if (!res.ok) {
+        throw new HostedVenueError(`could not read the staged tree's owner on ${vm}: ${execDetail(res).slice(0, 300)}. Refusing rather than falling back to this machine\u2019s uid, which would hand the guest an id with no write access to its own clone.`);
+      }
+      const lines = res.stdout.split("\n").map((l) => l.trim()).filter((l) => l.length > 0);
+      const ids2 = lines.slice(-2).map((l) => Number(l));
+      if (ids2.length !== 2 || !ids2.every((n) => Number.isInteger(n) && n > 0)) {
+        throw new HostedVenueError(`the venue ${vm} answered 'id -u && id -g' with ${JSON.stringify(res.stdout.slice(0, 120))}, which is not a uid/gid pair. Refusing rather than guessing an owner.`);
+      }
+      return { uid: ids2[0], gid: ids2[1] };
+    },
+    push: (from, to) => io.pushTree(from, "gcloud", iapUntarArgv(vm, project, zone, to), STAGE_PUSH_TIMEOUT_MS, env),
+    pushProxy: (from, dir) => io.pushTree(from, "gcloud", iapUntarProxyArgv(vm, project, zone, dir), STAGE_PUSH_TIMEOUT_MS, env),
+    removeProxy: (dir) => {
+      io.exec("gcloud", iapSshArgv(vm, project, zone, `rm -rf ${quoteForRemoteShell(dir)}`), PROXY_CLEANUP_TIMEOUT_MS, env);
+    }
+  };
+}
+function dockerStageTransport(docker3, env, io) {
+  const pushVia = (from, args5) => {
+    const [file, ...rest] = docker3.commandLine(args5);
+    if (file === void 0)
+      throw new Error("the docker client returned an empty command line");
+    return io.pushTree(from, file, rest, STAGE_PUSH_TIMEOUT_MS, env);
+  };
+  return {
+    // Fixed rather than probed: the helpers unpack as this account, so it owns the tree.
+    readOwner: () => CS_GUEST_USER,
+    push: (from, to) => pushVia(from, csUntarArgv(to, CS_GUEST_USER)),
+    pushProxy: (from, dir) => pushVia(from, csUntarProxyArgv(dir, CS_GUEST_USER)),
+    removeProxy: (dir) => {
+      docker3.sync(csRemoveArgv(dir, CS_GUEST_USER), { timeoutMs: PROXY_CLEANUP_TIMEOUT_MS });
+    }
+  };
+}
+function bothTunnels(a, b) {
+  return {
+    kill: (signal) => {
+      let failed = false;
+      let error2;
+      for (const t of [a, b]) {
+        try {
+          t.kill(signal);
+        } catch (err) {
+          if (!failed)
+            error2 = err;
+          failed = true;
+        }
+      }
+      if (failed)
+        throw error2;
+    },
+    failure: () => a.failure() ?? b.failure()
+  };
+}
+function makeClientTls(io, allocated, vm) {
+  let dir;
+  try {
+    dir = io.makePrivateDir();
+  } catch (err) {
+    throw new HostedVenueError(`could not create a private directory for ${vm}'s client key: ${describeErr(err)}`, "ours");
+  }
+  allocated.onRollback(() => {
+    try {
+      io.removeTree(dir);
+    } catch (err) {
+      throw new HostedVenueError(`the directory ${dir} holding ${vm}'s client key could not be removed and is left behind: ${describeErr(err)}`);
+    }
+  });
+  const certPath = join40(dir, "client.pem");
+  const keyPath = join40(dir, "client-key.pem");
+  const made = io.exec("openssl", clientCertArgv(keyPath, certPath), OPENSSL_TIMEOUT_MS, {});
+  if (!made.ok) {
+    throw new HostedVenueError(`could not make ${vm}'s client certificate with openssl: ${execDetail(made).slice(0, 300)}`, "ours");
+  }
+  let metadataValue;
+  try {
+    const pem = io.readTextIfPresent(certPath);
+    if (pem === null)
+      throw new Error(`openssl wrote nothing to ${certPath}`);
+    metadataValue = certMetadataValue(pem);
+  } catch (err) {
+    throw new HostedVenueError(`could not read back ${vm}'s client certificate: ${describeErr(err)}`, "ours");
+  }
+  return { dir, certPath, keyPath, metadataValue };
+}
+async function reachConfidentialSpace(a) {
+  const { io, vm } = a;
+  let ports;
+  try {
+    ports = await io.freeLocalPorts(2);
+  } catch (err) {
+    throw new HostedVenueError(`could not find two free local ports for ${vm}'s forwards: ${describeErr(err)}`, "ours");
+  }
+  const [attestPort, dockerPort] = ports;
+  if (attestPort === void 0 || dockerPort === void 0 || attestPort === dockerPort) {
+    throw new HostedVenueError(`could not find two distinct free local ports for ${vm}'s forwards`, "ours");
+  }
+  const forward = (remote, local) => {
+    const t = io.spawnTunnel("gcloud", iapPortTunnelArgv(vm, a.project, a.zone, remote, local), a.env);
+    a.allocated.onRollback(() => {
+      try {
+        t.kill("SIGTERM");
+      } catch {
+      }
+    });
+    return t;
+  };
+  const tunnel = bothTunnels(forward(CS_ATTEST_PORT, attestPort), forward(CS_DOCKER_PORT, dockerPort));
+  const deadline = io.now() + CS_READY_BUDGET_MS;
+  let reading = { ok: false, reason: "no request was made" };
+  while (io.now() < deadline) {
+    const dead = tunnel.failure();
+    if (dead !== null) {
+      throw new HostedVenueError(`the IAP port forward to ${vm} could not be kept up \u2014 ${dead}`);
+    }
+    reading = await io.fetchAttestation({
+      port: attestPort,
+      certPath: a.tls.certPath,
+      keyPath: a.tls.keyPath,
+      timeoutMs: CS_ATTEST_TIMEOUT_MS
+    });
+    if (reading.ok)
+      break;
+    await io.sleep(CS_ATTEST_INTERVAL_MS);
+  }
+  if (!reading.ok) {
+    throw new HostedVenueError(`${vm}'s attest endpoint did not answer within ${String(CS_READY_BUDGET_MS / 1e3)}s \u2014 last reason: ${reading.reason}`);
+  }
+  let spki;
+  let venuePem;
+  try {
+    spki = spkiSha256Hex(reading.peerCertDer);
+    venuePem = new X509Certificate(reading.peerCertDer).toString();
+  } catch (err) {
+    throw new HostedVenueError(`${vm}'s attest endpoint presented a certificate that does not parse: ${describeErr(err)}`);
+  }
+  let jwks;
+  try {
+    jwks = await io.fetchConfidentialSpaceJwks();
+  } catch (err) {
+    throw new HostedVenueError(`could not reach the Confidential Space key set to check ${vm}'s attestation \u2014 ` + describeErr(err), "ours", { cause: err });
+  }
+  const verdict = await verifyConfidentialSpaceToken(reading.token, {
+    audience: expectedAudience(a.runId),
+    nonce: a.runId,
+    additionalNonces: [spki],
+    instanceName: vm,
+    allowedZones: [a.zone],
+    projectId: a.project,
+    allowedImageDigests: [a.imageDigest],
+    containerEnv: { TH_CLIENT_CERT: a.tls.metadataValue }
+  }, { fetchJwks: () => Promise.resolve(jwks), now: io.now() });
+  if (!verdict.ok) {
+    throw new HostedVenueError(`${vm} presented an attestation this lease refuses (${verdict.reason}): ${verdict.detail}`);
+  }
+  const caPath = join40(a.tls.dir, "venue.pem");
+  try {
+    io.writeFile(caPath, venuePem);
+  } catch (err) {
+    throw new HostedVenueError(`could not write ${vm}'s attested certificate to ${caPath}: ${describeErr(err)}`, "ours");
+  }
+  const dockerAt = `tcp://localhost:${String(dockerPort)}`;
+  const docker3 = io.dockerOverTls(dockerAt, { caPath, certPath: a.tls.certPath, keyPath: a.tls.keyPath }, CS_RUN_ARGS);
+  const daemon = io.classifyDaemon(docker3);
+  if (!daemon.distinct) {
+    throw new HostedVenueError(`refusing to hand out a hosted lease: ${describeVenueDaemon(daemon)}`);
+  }
+  const prepared = docker3.sync(csStagePrepareArgv(a.stageBase, CS_GUEST_USER), {
+    timeoutMs: MKDIR_TIMEOUT_MS
+  });
+  if (prepared.error || prepared.status !== 0) {
+    throw new HostedVenueError(`could not prepare the stage on ${vm}: ${dockerDetail(prepared).slice(0, 300)}`);
+  }
+  const pulled = docker3.sync(["pull", DEFAULT_CONTAINER_IMAGE], { timeoutMs: CS_PULL_TIMEOUT_MS });
+  if (pulled.error || pulled.status !== 0) {
+    throw new HostedVenueError(`could not pull ${DEFAULT_CONTAINER_IMAGE} on ${vm}: ${dockerDetail(pulled).slice(0, 300)}`);
+  }
+  return {
+    docker: docker3,
+    tunnel,
+    socketDir: a.tls.dir,
+    socketPath: dockerAt,
+    venueDaemonId: daemon.venueDaemonId,
+    venueIdentity: { kind: "confidential-space", token: reading.token, claims: verdict.value },
+    transport: dockerStageTransport(docker3, a.env, io)
+  };
+}
 function hostedVenue(opts = {}, io = defaultHostedVenueIo) {
   const project = opts.project ?? DEFAULT_GCP_PROJECT;
   const zone = opts.zone ?? DEFAULT_GCP_ZONE;
   const gcloudConfig = opts.gcloudConfig ?? VENUE_GCLOUD_CONFIG;
   const keyFile = resolveServiceAccountKeyFile(opts);
+  const image = venueImageFromEnv(process.env);
+  const csImageDigest = image.venueImage === "confidential-space" ? requireWorkloadDigest(image.workloadImage) : null;
   const env = venueGcloudEnv(gcloudConfig);
   return {
     kind: "hosted-pool",
     acquire: (runId) => acquireTransactionally(async (allocated) => {
       const vm = venueInstanceName(runId);
       const stageBase = `/tmp/th-stage-${runId}`;
-      const bootArgv = gcpBootArgv({
+      const bootParams = (clientCert) => image.venueImage === "confidential-space" ? {
         vmName: vm,
         project,
         zone,
         runId,
-        machineType: opts.machineType ?? DEFAULT_GCP_MACHINE_TYPE
-      });
+        machineType: opts.machineType ?? CONFIDENTIAL_SPACE_MACHINE_TYPE,
+        venueImage: "confidential-space",
+        workloadImage: image.workloadImage,
+        clientCert
+      } : {
+        vmName: vm,
+        project,
+        zone,
+        runId,
+        machineType: opts.machineType ?? DEFAULT_GCP_MACHINE_TYPE,
+        ...image
+      };
+      let bootArgv = gcpBootArgv(bootParams(CLIENT_CERT_STAND_IN));
       ensureVenueServiceCredentials(gcloudConfig, keyFile, io);
+      const clientTls = csImageDigest === null ? null : { ...makeClientTls(io, allocated, vm), imageDigest: csImageDigest };
+      if (clientTls !== null)
+        bootArgv = gcpBootArgv(bootParams(clientTls.metadataValue));
       const boot = io.exec("gcloud", bootArgv, BOOT_TIMEOUT_MS, env);
       let instanceState = "unknown";
       allocated.onRollback(() => {
@@ -35975,6 +36701,20 @@ function hostedVenue(opts = {}, io = defaultHostedVenueIo) {
         throw new HostedVenueError(`could not boot ${vm}: ${verdict2.reason.slice(0, 400)}`, verdict2.source);
       }
       instanceState = "exists";
+      if (clientTls !== null) {
+        return finishAcquire(await reachConfidentialSpace({
+          vm,
+          project,
+          zone,
+          runId,
+          stageBase,
+          env,
+          io,
+          allocated,
+          tls: clientTls,
+          imageDigest: clientTls.imageDigest
+        }));
+      }
       const deadline = io.now() + SSH_READY_BUDGET_MS;
       let last = { retryable: true, reason: "no probe ran" };
       let identity = null;
@@ -36069,43 +36809,56 @@ function hostedVenue(opts = {}, io = defaultHostedVenueIo) {
       if (!prepared.ok) {
         throw new HostedVenueError(`could not prepare the stage on ${vm}: ${execDetail(prepared).slice(0, 300)}`);
       }
-      const stageVolumes = stageVolumeNames(vm);
-      for (const name of [stageVolumes.clone, stageVolumes.jail]) {
-        const created = docker3.sync(volumeCreateArgv(name, runId), {
-          timeoutMs: VOLUME_CREATE_TIMEOUT_MS
-        });
-        if (created.error || created.status !== 0) {
-          throw new HostedVenueError(`could not create the stage volume ${name} on ${vm}: ${dockerDetail(created).slice(0, 300)}`);
-        }
-      }
-      for (const name of [stageVolumes.clone, stageVolumes.jail]) {
-        const probe = docker3.sync(execProbeArgv(name), {
-          timeoutMs: EXEC_PROBE_TIMEOUT_MS
-        });
-        if (probe.error || probe.status !== 0) {
-          throw new HostedVenueError(`${vm} cannot execute a file written to its own Docker volume ${name}, so no install step with a native postinstall could run there. Refusing before staging anything: ${dockerDetail(probe).slice(0, 300)}`);
-        }
-      }
-      const after = io.classifyDaemon(docker3);
-      if (!after.distinct || after.venueDaemonId !== venueDaemonId) {
-        throw new HostedVenueError(`the daemon at ${socketPath} changed while the stage volumes were being created and proved: it now answers as ${after.distinct ? `daemon ${after.venueDaemonId}` : describeVenueDaemon(after)}, not ${venueDaemonId}. Refusing to hand out a lease whose proof was made elsewhere.`);
-      }
-      return makeLease({
-        runId,
-        vm,
-        project,
-        zone,
-        stageBase,
-        stageVolumes,
+      return finishAcquire({
         docker: docker3,
         tunnel,
         socketDir,
         socketPath,
         venueDaemonId,
         venueIdentity,
-        env,
-        io
+        transport: sshStageTransport(vm, project, zone, env, io)
       });
+      function finishAcquire(r) {
+        const { docker: docker4, socketPath: socketPath2, venueDaemonId: venueDaemonId2 } = r;
+        const stageVolumes = stageVolumeNames(vm);
+        for (const name of [stageVolumes.clone, stageVolumes.jail]) {
+          const created = docker4.sync(volumeCreateArgv(name, runId), {
+            timeoutMs: VOLUME_CREATE_TIMEOUT_MS
+          });
+          if (created.error || created.status !== 0) {
+            throw new HostedVenueError(`could not create the stage volume ${name} on ${vm}: ${dockerDetail(created).slice(0, 300)}`);
+          }
+        }
+        for (const name of [stageVolumes.clone, stageVolumes.jail]) {
+          const probe = docker4.sync(execProbeArgv(name), {
+            timeoutMs: EXEC_PROBE_TIMEOUT_MS
+          });
+          if (probe.error || probe.status !== 0) {
+            throw new HostedVenueError(`${vm} cannot execute a file written to its own Docker volume ${name}, so no install step with a native postinstall could run there. Refusing before staging anything: ${dockerDetail(probe).slice(0, 300)}`);
+          }
+        }
+        const after = io.classifyDaemon(docker4);
+        if (!after.distinct || after.venueDaemonId !== venueDaemonId2) {
+          throw new HostedVenueError(`the daemon at ${socketPath2} changed while the stage volumes were being created and proved: it now answers as ${after.distinct ? `daemon ${after.venueDaemonId}` : describeVenueDaemon(after)}, not ${venueDaemonId2}. Refusing to hand out a lease whose proof was made elsewhere.`);
+        }
+        return makeLease({
+          runId,
+          vm,
+          project,
+          zone,
+          stageBase,
+          stageVolumes,
+          docker: docker4,
+          tunnel: r.tunnel,
+          socketDir: r.socketDir,
+          socketPath: socketPath2,
+          venueDaemonId: venueDaemonId2,
+          venueIdentity: r.venueIdentity,
+          transport: r.transport,
+          env,
+          io
+        });
+      }
     })
   };
 }
@@ -36164,28 +36917,7 @@ function makeLease(p) {
     return null;
   };
   let stagedOwner;
-  const readStagedOwner = () => {
-    const res = p.io.exec(
-      "gcloud",
-      iapSshArgv(p.vm, p.project, p.zone, "id -u && id -g"),
-      OWNER_PROBE_TIMEOUT_MS,
-      // `p.env`, like every other gcloud call here. TERM-724 made the venue boot under the
-      // SERVICE configuration rather than whoever is at the terminal, and a probe that
-      // omitted this would ssh under the person's own credential — then report an owner
-      // measured against a session the run does not use.
-      p.env
-    );
-    if (!res.ok) {
-      throw new HostedVenueError(`could not read the staged tree's owner on ${p.vm}: ${execDetail(res).slice(0, 300)}. Refusing rather than falling back to this machine\u2019s uid, which would hand the guest an id with no write access to its own clone.`);
-    }
-    const lines = res.stdout.split("\n").map((l) => l.trim()).filter((l) => l.length > 0);
-    const ids2 = lines.slice(-2).map((l) => Number(l));
-    if (ids2.length !== 2 || !ids2.every((n) => Number.isInteger(n) && n > 0)) {
-      throw new HostedVenueError(`the venue ${p.vm} answered 'id -u && id -g' with ${JSON.stringify(res.stdout.slice(0, 120))}, which is not a uid/gid pair. Refusing rather than guessing an owner.`);
-    }
-    return { uid: ids2[0], gid: ids2[1] };
-  };
-  stagedOwner = readStagedOwner();
+  stagedOwner = p.transport.readOwner();
   return {
     kind: "hosted-pool",
     runId: p.runId,
@@ -36220,7 +36952,7 @@ function makeLease(p) {
       const dir = venueProxyDir(p.stageBase);
       const buffer = stageProxyCode();
       try {
-        const res = await p.io.pushTree(buffer.dir, "gcloud", iapUntarProxyArgv(p.vm, p.project, p.zone, dir), STAGE_PUSH_TIMEOUT_MS, p.env);
+        const res = await p.transport.pushProxy(buffer.dir, dir);
         if (!res.ok) {
           throw new HostedVenueError(`could not stage the egress proxy onto ${p.vm}: ${execDetail(res).slice(0, 300)}`);
         }
@@ -36230,7 +36962,7 @@ function makeLease(p) {
       return {
         dir,
         cleanup: () => {
-          p.io.exec("gcloud", iapSshArgv(p.vm, p.project, p.zone, `rm -rf ${quoteForRemoteShell(dir)}`), PROXY_CLEANUP_TIMEOUT_MS, p.env);
+          p.transport.removeProxy(dir);
         }
       };
     },
@@ -36238,7 +36970,7 @@ function makeLease(p) {
       check("staging the tree");
       const paths = venueStagePaths(p.stageBase);
       const push = async (from, to) => {
-        const res = await p.io.pushTree(from, "gcloud", iapUntarArgv(p.vm, p.project, p.zone, to), STAGE_PUSH_TIMEOUT_MS, p.env);
+        const res = await p.transport.push(from, to);
         if (!res.ok) {
           throw new HostedVenueError(`could not stage ${from} onto ${p.vm}: ${execDetail(res).slice(0, 300)}`);
         }
@@ -36396,7 +37128,7 @@ function makeLease(p) {
     }
   };
 }
-var SSH_READY_BUDGET_MS, SSH_PROBE_INTERVAL_MS, SSH_PROBE_TIMEOUT_MS, TUNNEL_BUDGET_MS, TUNNEL_POLL_INTERVAL_MS, GOOGLE_JWKS_URL, JWKS_FETCH_TIMEOUT_MS, CREDENTIAL_QUERY_PARAM, UNDECODABLE, STAGE_PUSH_TIMEOUT_MS, DISPATCHED_PROBE_TIMEOUT_MS, DISPATCHED_STATUS_ARGV, DISPATCHED_GIT_CANDIDATES, PROXY_CLEANUP_TIMEOUT_MS, OWNER_PROBE_TIMEOUT_MS, BOOT_TIMEOUT_MS, MKDIR_TIMEOUT_MS, DELETE_TIMEOUT_MS, LOCAL_GCLOUD_TIMEOUT_MS, SERVICE_ACCOUNT_ACTIVATE_TIMEOUT_MS, SOCKET_DIR_PREFIX, VENUE_SOCKET_NAME, HostedVenueError, VENUE_GCLOUD_CONFIG, SERVICE_ACCOUNT_SUFFIX, GCLOUD_PRINCIPAL_OVERRIDES, defaultHostedVenueIo, VENUE_SSH_USER, GCE_METADATA_IDENTITY_URL, COMPACT_JWT, STAGE_HELPER_IMAGE, VOLUME_CREATE_TIMEOUT_MS, EXEC_PROBE_TIMEOUT_MS, POPULATE_TIMEOUT_MS, STAGE_VOLUME_LABEL_KEY, STAGE_PROOF_PREFIX, IAP_NOT_READY, IAP_BACKEND_UNREACHABLE, IAP_DENIED, TERMINAL_GCP, INSTANCE_NOT_RUNNING, PREEMPTED, HOST_KEY_MISMATCH, SSH_KEY_NOT_READY, DAEMON_NOT_READY, SSH_NOT_ANSWERING;
+var SSH_READY_BUDGET_MS, SSH_PROBE_INTERVAL_MS, SSH_PROBE_TIMEOUT_MS, TUNNEL_BUDGET_MS, TUNNEL_POLL_INTERVAL_MS, GOOGLE_JWKS_URL, JWKS_FETCH_TIMEOUT_MS, CREDENTIAL_QUERY_PARAM, UNDECODABLE, STAGE_PUSH_TIMEOUT_MS, DISPATCHED_PROBE_TIMEOUT_MS, DISPATCHED_STATUS_ARGV, DISPATCHED_GIT_CANDIDATES, PROXY_CLEANUP_TIMEOUT_MS, OWNER_PROBE_TIMEOUT_MS, BOOT_TIMEOUT_MS, MKDIR_TIMEOUT_MS, DELETE_TIMEOUT_MS, LOCAL_GCLOUD_TIMEOUT_MS, SERVICE_ACCOUNT_ACTIVATE_TIMEOUT_MS, SOCKET_DIR_PREFIX, VENUE_SOCKET_NAME, HostedVenueError, VENUE_GCLOUD_CONFIG, SERVICE_ACCOUNT_SUFFIX, GCLOUD_PRINCIPAL_OVERRIDES, defaultHostedVenueIo, VENUE_SSH_USER, GCE_METADATA_IDENTITY_URL, COMPACT_JWT, STAGE_HELPER_IMAGE, VOLUME_CREATE_TIMEOUT_MS, EXEC_PROBE_TIMEOUT_MS, POPULATE_TIMEOUT_MS, STAGE_VOLUME_LABEL_KEY, STAGE_PROOF_PREFIX, IAP_NOT_READY, IAP_BACKEND_UNREACHABLE, IAP_DENIED, TERMINAL_GCP, INSTANCE_NOT_RUNNING, PREEMPTED, HOST_KEY_MISMATCH, SSH_KEY_NOT_READY, DAEMON_NOT_READY, SSH_NOT_ANSWERING, CS_ATTEST_PORT, CS_DOCKER_PORT, CS_READY_BUDGET_MS, CS_ATTEST_TIMEOUT_MS, CS_PULL_TIMEOUT_MS, CS_ATTEST_INTERVAL_MS, OPENSSL_TIMEOUT_MS, CS_RUN_ARGS, CS_GUEST_USER, CS_STAGE_ROOT, CLIENT_CERT_STAND_IN;
 var init_hostedVenue = __esm({
   "../../packages/envrun/dist/hostedVenue.js"() {
     "use strict";
@@ -36517,7 +37249,55 @@ var init_hostedVenue = __esm({
           throw new Error("JWKS fetch returned a body with no keys array");
         }
         return body;
-      }
+      },
+      fetchConfidentialSpaceJwks: async () => {
+        const getJson = async (url, what) => {
+          const res = await globalThis.fetch(url, {
+            signal: AbortSignal.timeout(JWKS_FETCH_TIMEOUT_MS)
+          });
+          if (!res.ok) {
+            throw new Error(`Confidential Space ${what} returned HTTP ${String(res.status)}`);
+          }
+          return res.json();
+        };
+        const discovery = await getJson(CONFIDENTIAL_SPACE_OIDC_DISCOVERY_URL, "discovery");
+        const jwksUri = typeof discovery === "object" && discovery !== null ? discovery.jwks_uri : void 0;
+        if (typeof jwksUri !== "string" || !jwksUri.startsWith("https://")) {
+          throw new Error("Confidential Space discovery names no https jwks_uri");
+        }
+        const body = await getJson(jwksUri, "key set");
+        if (typeof body !== "object" || body === null || !Array.isArray(body.keys)) {
+          throw new Error("Confidential Space key set has no keys array");
+        }
+        return body;
+      },
+      freeLocalPorts: async (n) => {
+        const servers = [];
+        try {
+          for (let i = 0; i < n; i += 1) {
+            const server = createServer();
+            servers.push(server);
+            await new Promise((resolve7, reject) => {
+              server.once("error", reject);
+              server.listen(0, "localhost", () => {
+                resolve7();
+              });
+            });
+          }
+          return servers.map((s) => s.address().port);
+        } finally {
+          await Promise.all(servers.map((s) => new Promise((resolve7) => {
+            s.close(() => {
+              resolve7();
+            });
+          })));
+        }
+      },
+      writeFile: (path6, text) => {
+        writeFileSync22(path6, text, { mode: 384, flag: "wx" });
+      },
+      fetchAttestation: (req) => fetchAttestationOverTls(req),
+      dockerOverTls: (endpoint, tls, runArgs) => remoteDockerClient(endpoint, { tls, runArgs })
     };
     VENUE_SSH_USER = "th-runner";
     GCE_METADATA_IDENTITY_URL = "http://169.254.169.254/computeMetadata/v1/instance/service-accounts/default/identity";
@@ -36538,6 +37318,17 @@ var init_hostedVenue = __esm({
     SSH_KEY_NOT_READY = /Permission denied \(publickey/;
     DAEMON_NOT_READY = /Cannot connect to the Docker daemon/;
     SSH_NOT_ANSWERING = /Connection refused|Connection reset|Connection closed by|kex_exchange_identification|Operation timed out/;
+    CS_ATTEST_PORT = 8443;
+    CS_DOCKER_PORT = 2376;
+    CS_READY_BUDGET_MS = 48e4;
+    CS_ATTEST_TIMEOUT_MS = 15e3;
+    CS_PULL_TIMEOUT_MS = 6e5;
+    CS_ATTEST_INTERVAL_MS = 5e3;
+    OPENSSL_TIMEOUT_MS = 3e4;
+    CS_RUN_ARGS = ["--oom-score-adj", "1000"];
+    CS_GUEST_USER = { uid: 1e3, gid: 1e3 };
+    CS_STAGE_ROOT = "/tmp";
+    CLIENT_CERT_STAND_IN = "stand-in-certificate";
   }
 });
 
@@ -37437,10 +38228,10 @@ var init_references = __esm({
 
 // ../../packages/envspec/dist/repo.js
 import { readdirSync as readdirSync2, readFileSync as readFileSync26, statSync as statSync4 } from "fs";
-import { join as join41, relative as relative2, sep as sep4 } from "path";
+import { join as join41, relative as relative2, sep as sep5 } from "path";
 function createRepoReader(repoPath) {
   const resolveIn = (relativePath) => relativePath === "" ? repoPath : join41(repoPath, relativePath);
-  const toPosix = (absolute) => relative2(repoPath, absolute).split(sep4).join("/");
+  const toPosix = (absolute) => relative2(repoPath, absolute).split(sep5).join("/");
   const readText = (relativePath) => {
     try {
       return readFileSync26(resolveIn(relativePath), "utf8");
@@ -38083,13 +38874,16 @@ function git(repoDir, args5, allowNonZero = false) {
   }
   return res.stdout ?? "";
 }
-function collectWorkingDiff(repoDir) {
+function collectWorkingDiff(repoDir, opts = {}) {
   if (!existsSync19(join42(repoDir, ".git"))) {
     throw new ThRunError(`${repoDir} is not a git checkout (no .git). \`th run\` ships the working diff, so it needs a repository to read one from.`);
   }
   const headSha = git(repoDir, ["rev-parse", "HEAD"]).trim();
-  const tracked = git(repoDir, ["diff", "HEAD", "--binary"]);
-  const trackedChanged = git(repoDir, ["diff", "HEAD", "--name-only"]).split("\n").map((s) => s.trim()).filter((s) => s.length > 0);
+  const diffBase = opts.base === void 0 ? headSha : assertDiffBase(repoDir, opts.base);
+  const trackedArgs = opts.base === void 0 ? ["diff", "HEAD"] : ["diff", diffBase];
+  const pathsEnd = opts.base === void 0 ? [] : ["--"];
+  const tracked = git(repoDir, [...trackedArgs, "--binary", ...pathsEnd]);
+  const trackedChanged = git(repoDir, [...trackedArgs, "--name-only", ...pathsEnd]).split("\n").map((s) => s.trim()).filter((s) => s.length > 0);
   const untracked = git(repoDir, ["ls-files", "--others", "--exclude-standard"]).split("\n").map((s) => s.trim()).filter((s) => s.length > 0);
   const parts = [];
   if (tracked.trim() !== "")
@@ -38099,7 +38893,17 @@ function collectWorkingDiff(repoDir) {
     if (one.trim() !== "")
       parts.push(one.replace(/\n*$/, "\n"));
   }
-  return { patch: parts.join(""), headSha, trackedChanged, untracked };
+  return { patch: parts.join(""), headSha, diffBase, trackedChanged, untracked };
+}
+function assertDiffBase(repoDir, base) {
+  if (!FULL_COMMIT_ID.test(base)) {
+    throw new ThRunError(`the diff base must be a full 40-character commit id, got ${JSON.stringify(base)}.`);
+  }
+  const resolved = git(repoDir, ["rev-parse", "--verify", "--quiet", `${base}^{commit}`], true);
+  if (resolved.trim() !== base) {
+    throw new ThRunError(`the diff base ${base} is not a commit in ${repoDir}.`);
+  }
+  return base;
 }
 function isLocalPath(p) {
   return !UNC_PATH.test(p) && (p.startsWith("/") || WINDOWS_ABSOLUTE.test(p));
@@ -38671,8 +39475,9 @@ async function runVerification(req, ctx) {
   let diff2 = null;
   if (source.kind === "working-diff") {
     progress("collect", `reading the working diff from ${source.localRepoDir}`);
-    diff2 = collectWorkingDiff(source.localRepoDir);
-    progress("collect", `${String(diff2.trackedChanged.length)} tracked, ${String(diff2.untracked.length)} untracked, ${String(diff2.patch.length)} bytes`);
+    diff2 = collectWorkingDiff(source.localRepoDir, source.diffBase === void 0 ? {} : { base: source.diffBase });
+    const from = source.diffBase === void 0 ? "" : `, from delivered baseline ${diff2.diffBase.slice(0, 12)}`;
+    progress("collect", `${String(diff2.trackedChanged.length)} tracked, ${String(diff2.untracked.length)} untracked, ${String(diff2.patch.length)} bytes${from}`);
   } else {
     progress("collect", "dispatched run: the tree is the stored commit itself");
   }
@@ -38874,7 +39679,7 @@ async function runVerification(req, ctx) {
     await releaseWithoutThrowing(lease, progress);
   }
 }
-var ThRunError, OUTPUT_TAIL_BYTES, ALLOWED_URL_SCHEMES, SCP_STYLE, URL_SCHEME, WINDOWS_ABSOLUTE, UNC_PATH, TRANSPORT_REASON, SHA_REASON, FULL_SHA, MIN_GIT_VERSION_FOR_END_OF_OPTIONS, CloneUnavailableError, GIT_ENV_ALLOWLIST, credentialFreeHomeDir, SSH_ISOLATION_ARGS, WITHHELD_SEGMENT, UNPARSEABLE_TARGET, FAILURE_LINE, REDACTED_TARGET_REPO, REDACTED_TARGET_SHA;
+var ThRunError, OUTPUT_TAIL_BYTES, FULL_COMMIT_ID, ALLOWED_URL_SCHEMES, SCP_STYLE, URL_SCHEME, WINDOWS_ABSOLUTE, UNC_PATH, TRANSPORT_REASON, SHA_REASON, FULL_SHA, MIN_GIT_VERSION_FOR_END_OF_OPTIONS, CloneUnavailableError, GIT_ENV_ALLOWLIST, credentialFreeHomeDir, SSH_ISOLATION_ARGS, WITHHELD_SEGMENT, UNPARSEABLE_TARGET, FAILURE_LINE, REDACTED_TARGET_REPO, REDACTED_TARGET_SHA;
 var init_thrun = __esm({
   "../../packages/envrun/dist/thrun.js"() {
     "use strict";
@@ -38892,6 +39697,7 @@ var init_thrun = __esm({
     ThRunError = class extends Error {
     };
     OUTPUT_TAIL_BYTES = 4e3;
+    FULL_COMMIT_ID = /^[0-9a-f]{40}$/;
     ALLOWED_URL_SCHEMES = /* @__PURE__ */ new Set(["https", "http", "ssh", "git"]);
     SCP_STYLE = /^[A-Za-z0-9._~+-]+@[A-Za-z0-9._-]+:[^:]/;
     URL_SCHEME = /^([A-Za-z][A-Za-z0-9+.-]*):\/\//;
@@ -39750,6 +40556,7 @@ __export(dist_exports, {
   ALEMBIC_IMAGE: () => ALEMBIC_IMAGE,
   ATTEST_REFUSAL_REASONS: () => ATTEST_REFUSAL_REASONS,
   BOOKKEEPING_TABLES: () => BOOKKEEPING_TABLES,
+  CONFIDENTIAL_SPACE_MACHINE_TYPE: () => CONFIDENTIAL_SPACE_MACHINE_TYPE,
   CONTAINMENT_UNAVAILABLE_PREFIX: () => CONTAINMENT_UNAVAILABLE_PREFIX,
   CloneUnavailableError: () => CloneUnavailableError,
   DAEMON_FACTS_FORMAT: () => DAEMON_FACTS_FORMAT,
@@ -39891,6 +40698,7 @@ __export(dist_exports, {
   toolingImageFor: () => toolingImageFor,
   unquoteDiffPath: () => unquoteDiffPath,
   venueGcloudEnv: () => venueGcloudEnv,
+  venueImageFromEnv: () => venueImageFromEnv,
   venueStagePaths: () => venueStagePaths,
   verifyWorkingDiff: () => verifyWorkingDiff
 });
@@ -40253,7 +41061,7 @@ __export(jpi_claim_exports, {
 });
 import {
   readFileSync as readFileSync27,
-  writeFileSync as writeFileSync22,
+  writeFileSync as writeFileSync23,
   mkdirSync as mkdirSync9,
   mkdtempSync as mkdtempSync5,
   renameSync as renameSync11,
@@ -40264,7 +41072,7 @@ import {
   readdirSync as readdirSync3
 } from "fs";
 import { join as join43, dirname as dirname10, isAbsolute as isAbsolute5, resolve as pathResolve } from "path";
-import { createHash as createHash9 } from "crypto";
+import { createHash as createHash11 } from "crypto";
 import { homedir as homedir26, hostname as osHostname } from "os";
 import { execFile as execFile3, execFileSync as execFileSync2, spawnSync as spawnSync9 } from "child_process";
 import { promisify as promisify3 } from "util";
@@ -40282,7 +41090,7 @@ function markClaimNudged(id) {
     const ids2 = readNudgedClaimIds();
     ids2.add(id);
     ensureStateDir(TERMINALHIRE_DIR17);
-    writeFileSync22(REPO_CONTINUITY_NUDGE_MARKER, JSON.stringify({ claimIds: [...ids2] }), "utf8");
+    writeFileSync23(REPO_CONTINUITY_NUDGE_MARKER, JSON.stringify({ claimIds: [...ids2] }), "utf8");
   } catch {
   }
 }
@@ -41456,7 +42264,7 @@ async function registerFounderClaim(b) {
   let clearedLocalCredential = false;
   let refusedForPurpose = false;
   let preserveBackgroundToken = false;
-  const refuse3 = (reason) => {
+  const refuse4 = (reason) => {
     console.error(
       `
 terminalhire claim: refusing to record \u2014 ${reason}
@@ -41481,7 +42289,7 @@ terminalhire claim: refusing to record \u2014 ${reason}
     try {
       expectLogin = await localLoginForPaidBrowserClaim();
     } catch (err) {
-      refuse3(
+      refuse4(
         `could not verify which GitHub account this machine is signed in as: ${err instanceof Error ? err.message : String(err)}.
   Run \`terminalhire login\`, then retry this claim. Browser verification was
   not opened and no claim was sent.`
@@ -41497,16 +42305,16 @@ terminalhire claim: refusing to record \u2014 ${reason}
       claimRef: opportunityShortToken(b.bountyId)
     });
     if (!proofToken) {
-      refuse3("could not verify your GitHub identity with terminalhire (see above).");
+      refuse4("could not verify your GitHub identity with terminalhire (see above).");
     }
     const verifiedLogin = proofTokenLogin(proofToken);
     if (!verifiedLogin) {
-      refuse3(
+      refuse4(
         "the browser verification response did not name a GitHub account, so it could not be compared with this machine\u2019s sign-in. Nothing was sent; retry the claim."
       );
     }
     if (verifiedLogin.toLowerCase() !== expectLogin.toLowerCase()) {
-      refuse3(
+      refuse4(
         `you verified in the browser as @${verifiedLogin}, but this machine is signed in as @${expectLogin}.
   Nothing was sent. Sign the browser into @${expectLogin} and run this again, or
   run \`terminalhire login\` if you meant to work as @${verifiedLogin}.`
@@ -41538,7 +42346,7 @@ terminalhire claim: refusing to record \u2014 ${reason}
   try {
     res = await sendRegistration(true);
   } catch (err) {
-    refuse3(
+    refuse4(
       `terminalhire is unreachable (${err instanceof Error ? err.message : String(err)}), so the posting could not be revalidated.`
     );
   }
@@ -41589,7 +42397,7 @@ terminalhire claim: refusing to record \u2014 ${reason}
     try {
       res = await sendRegistration(true);
     } catch (err) {
-      refuse3(
+      refuse4(
         `terminalhire is unreachable (${err instanceof Error ? err.message : String(err)}), so the posting could not be revalidated.`
       );
     }
@@ -41600,14 +42408,14 @@ terminalhire claim: refusing to record \u2014 ${reason}
       res = await sendRegistration(false);
       refusalBody = await readRefusal(res);
     } catch (err) {
-      refuse3(
+      refuse4(
         `terminalhire is unreachable (${err instanceof Error ? err.message : String(err)}), so the posting could not be revalidated.`
       );
     }
   }
   if (!res.ok) {
     const detail = refusalBody?.message || refusalBody?.error || "";
-    refuse3(
+    refuse4(
       detail ? `the server refused this claim (${res.status}): ${detail}` : `the server refused this claim (${res.status}).`
     );
   }
@@ -41618,7 +42426,7 @@ terminalhire claim: refusing to record \u2014 ${reason}
     body = null;
   }
   if (!body || body.ok !== true) {
-    refuse3("malformed registration response from the server.");
+    refuse4("malformed registration response from the server.");
   }
   const mintedToken = typeof body.pushToken === "string" && body.pushToken.length > 0 ? body.pushToken : null;
   if (refusedForPurpose && mintedToken && !preserveBackgroundToken) {
@@ -43048,7 +43856,7 @@ function writeSliceFiles(destDir, files) {
     if (typeof f.content === "string") {
       const abs = join43(destDir, f.path);
       mkdirSync9(dirname10(abs), { recursive: true });
-      writeFileSync22(abs, f.content, "utf8");
+      writeFileSync23(abs, f.content, "utf8");
       written.push(f.path);
     } else {
       unavailable.push({ path: f.path, reason: f.unavailableReason || "(no reason given)" });
@@ -43097,7 +43905,7 @@ function ensureExcludedPackDir(destDir) {
     const existing = existsSync20(excludeFile) ? readFileSync27(excludeFile, "utf8") : "";
     if (!existing.split("\n").includes(BRIEF_EXCLUDE_LINE)) {
       mkdirSync9(dirname10(excludeFile), { recursive: true });
-      writeFileSync22(
+      writeFileSync23(
         excludeFile,
         `${existing}${existing === "" || existing.endsWith("\n") ? "" : "\n"}${BRIEF_EXCLUDE_LINE}
 `,
@@ -43113,23 +43921,33 @@ function writePackFile(destDir, relPath, content, what) {
   try {
     const abs = join43(destDir, relPath);
     mkdirSync9(dirname10(abs), { recursive: true });
-    writeFileSync22(abs, content, { encoding: "utf8", flag: "wx" });
+    writeFileSync23(abs, content, { encoding: "utf8", flag: "wx" });
   } catch (err) {
     return { written: false, reason: `the ${what} could not be written (${err.message})` };
   }
   return { written: true, reason: null, sha256: sha256OfUtf8(content) };
 }
 function sha256OfUtf8(content) {
-  return createHash9("sha256").update(content, "utf8").digest("hex");
+  return createHash11("sha256").update(content, "utf8").digest("hex");
 }
-function writeWorkspacePack(destDir, spec, claim) {
+function writeWorkspacePack(destDir, spec, claim, delivery) {
+  if (delivery !== "full" && delivery !== "sparse") {
+    throw new TypeError(
+      `writeWorkspacePack: delivery must be 'full' or 'sparse', got ${String(delivery)}`
+    );
+  }
   const gate2 = ensureExcludedPackDir(destDir);
   if (!gate2.ok) {
     const refused = { written: false, reason: gate2.reason };
     return { brief: refused, verify: refused, agents: refused };
   }
   const brief = typeof spec !== "string" || spec.trim() === "" ? { written: false, reason: "the server sent no task for this posting" } : writePackFile(destDir, BRIEF_REL_PATH, spec, "task");
-  const verify = writePackFile(destDir, VERIFY_REL_PATH, renderVerifyDoc(claim), "verify note");
+  const verify = writePackFile(
+    destDir,
+    VERIFY_REL_PATH,
+    renderVerifyDoc(claim, delivery),
+    "verify note"
+  );
   const agents = writePackFile(
     destDir,
     AGENTS_REL_PATH,
@@ -43142,20 +43960,30 @@ function packSafeId(claim) {
   const id = String(claim?.id ?? "");
   return PACK_SAFE_ID.test(id) ? id : "<your claim id \u2014 see: terminalhire claim list>";
 }
-function renderVerifyDoc(claim) {
+function renderVerifyDoc(claim, delivery) {
   const id = packSafeId(claim);
+  const runStep2 = delivery === "full" ? `       ${nextStep("terminalhire run")}
+
+   It tests every change since the delivered baseline, committed or not, which
+   is what submit sends once it is all committed.` : `       ${nextStep("terminalhire run --target <clone URL of the full repository>")}
+
+   It tests every change since the delivered baseline, committed or not, which
+   is what submit sends once it is all committed. This delivery contains only the
+   files you were granted, so the local run needs the whole repository; if you
+   don't have access to it, skip to step 4, because the poster-side run in step 5
+   is the verdict that counts.`;
   return `# Verifying claim ${id}
 
 This workspace was delivered by terminalhire for a posting. "Done" is
 judged on the diff: the submitted patch is the change from the delivered
 baseline (this repo's root commit) to HEAD, so only committed, tracked changes
-count.
+count. Submit needs a clean tree; run does not.
 
 1. Read the poster's task first, when there is one: ${BRIEF_REL_PATH}
 2. Work on the claim branch this delivery checked out, committing as you go.
 3. To verify locally in terminalhire's sandboxed runner, from this directory:
 
-       terminalhire run
+${runStep2}
 
 4. Submit \u2014 the only step that sends anything off this machine. It prints what it
    is about to send first, and asks y/N only at an interactive terminal:
@@ -43521,11 +44349,13 @@ async function cmdSliceFullTier(claims, id, local, fullTierBody, flags, cloneRep
     );
     process.exit(1);
   }
-  const pack = writeWorkspacePack(dest, body.spec, claim);
+  const pack = writeWorkspacePack(dest, body.spec, claim, "full");
   const working = claims.updateClaim(claim.id, {
     worktreePath: dest,
     branch,
     state: "working",
+    // `terminalhire run` clones this commit when run from the workspace (TERM-1098).
+    baseSha,
     workspacePack: {
       brief: pack.brief.written === true,
       verify: pack.verify.written === true,
@@ -43681,7 +44511,7 @@ async function attemptSliceDelivery(id, flags = {}) {
   let pack;
   try {
     await sh("git", ["-C", dest, "init"]);
-    pack = writeWorkspacePack(dest, body.spec, claim);
+    pack = writeWorkspacePack(dest, body.spec, claim, "sparse");
     await sh("git", ["-C", dest, "add", "-A"]);
     await sh("git", [
       "-C",
@@ -43718,6 +44548,11 @@ async function attemptSliceDelivery(id, flags = {}) {
     worktreePath: dest,
     branch,
     state: "working",
+    // The commit these files were cut from, so `terminalhire run` can clone it unasked
+    // (TERM-1098). Recorded only when it is a full sha: a slice confirmed before the
+    // server kept one answers null, and a value of any other shape is not a commit we
+    // could clone, so neither is written and `run` asks for `--sha` instead.
+    ...typeof body.baseSha === "string" && /^[0-9a-f]{40}$/.test(body.baseSha) ? { baseSha: body.baseSha } : {},
     workspacePack: {
       brief: pack.brief.written === true,
       verify: pack.verify.written === true,
@@ -44450,7 +45285,7 @@ function readClaimPushMarker() {
 }
 function writeClaimPushMarker(marker) {
   ensureStateDir(TERMINALHIRE_DIR17);
-  writeFileSync22(CLAIM_PUSH_MARKER, JSON.stringify(marker, null, 2) + "\n", "utf8");
+  writeFileSync23(CLAIM_PUSH_MARKER, JSON.stringify(marker, null, 2) + "\n", "utf8");
 }
 function clearClaimPushMarker() {
   try {
@@ -45637,7 +46472,7 @@ import {
   readFileSync as readFileSync28,
   renameSync as renameSync12,
   rmSync as rmSync13,
-  writeFileSync as writeFileSync23
+  writeFileSync as writeFileSync24
 } from "fs";
 import { homedir as homedir27 } from "os";
 import { join as join44 } from "path";
@@ -45673,7 +46508,7 @@ function writeFile(file) {
   const path6 = postingDraftFilePath();
   const tmp = `${path6}.${process.pid}.${randomUUID4()}.tmp`;
   try {
-    writeFileSync23(tmp, `${JSON.stringify(file, null, 2)}
+    writeFileSync24(tmp, `${JSON.stringify(file, null, 2)}
 `, {
       encoding: "utf8",
       mode: 384,
@@ -46433,7 +47268,7 @@ import {
   renameSync as renameSync13,
   statSync as statSync5,
   unlinkSync as unlinkSync4,
-  writeFileSync as writeFileSync24
+  writeFileSync as writeFileSync25
 } from "fs";
 import { homedir as homedir28 } from "os";
 import { basename as basename7, dirname as dirname11, join as join46 } from "path";
@@ -46496,7 +47331,7 @@ function mutateCache(path6, mutate) {
     if (mutate(existing) === false) return false;
     const tmp = `${path6}.${process.pid}.${tmpCounter3 += 1}.tmp`;
     try {
-      writeFileSync24(tmp, `${JSON.stringify(existing, null, 2)}
+      writeFileSync25(tmp, `${JSON.stringify(existing, null, 2)}
 `, { mode: 384 });
       renameSync13(tmp, path6);
     } catch {
@@ -46604,13 +47439,31 @@ var init_recall_check = __esm({
   }
 });
 
+// src/delivered-baseline.ts
+import { execFileSync as execFileSync3 } from "child_process";
+function deliveredBaseline(worktree) {
+  const roots = execFileSync3("git", ["-C", worktree, "rev-list", "--max-parents=0", "HEAD"], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"]
+  }).split("\n").map((s) => s.trim()).filter((s) => s.length > 0);
+  const [only] = roots;
+  return roots.length === 1 && only !== void 0 ? { kind: "baseline", sha: only } : { kind: "ambiguous", rootCount: roots.length };
+}
+var init_delivered_baseline = __esm({
+  "src/delivered-baseline.ts"() {
+    "use strict";
+  }
+});
+
 // bin/jpi-run.js
 var jpi_run_exports = {};
 __export(jpi_run_exports, {
   once: () => once,
+  resolveClaimContext: () => resolveClaimContext,
   run: () => run10
 });
-import { existsSync as existsSync24, readFileSync as readFileSync31 } from "fs";
+import { existsSync as existsSync24, readFileSync as readFileSync31, realpathSync as realpathSync4 } from "fs";
+import { execFileSync as execFileSync4 } from "child_process";
 import { join as join47, resolve as resolve5 } from "path";
 import { tmpdir as tmpdir5 } from "os";
 import { mkdtempSync as mkdtempSync6, rmSync as rmSync14 } from "fs";
@@ -46688,9 +47541,79 @@ function requireField(value, name, hint) {
   if (typeof value === "string" && value.trim() !== "") return value.trim();
   throw new Error(`terminalhire: run needs ${name}. ${hint}`);
 }
+function realToplevel(dir) {
+  try {
+    const top = execFileSync4("git", ["-C", dir, "rev-parse", "--show-toplevel"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    return top === "" ? null : realpathSync4(top);
+  } catch {
+    return null;
+  }
+}
+function realpathOrNull(path6) {
+  try {
+    return realpathSync4(path6);
+  } catch {
+    return null;
+  }
+}
+function resolveClaimContext({ localDir, flags, claims }) {
+  const here = realToplevel(localDir);
+  if (here === null) return null;
+  const recordedHere = claims.filter(
+    (c) => c.approval != null && typeof c.worktreePath === "string" && realpathOrNull(c.worktreePath) === here
+  );
+  const matches = given(flags.claim) ? recordedHere.filter((c) => c.id === flags.claim.trim()) : recordedHere;
+  if (matches.length === 0) return null;
+  if (matches.length > 1) {
+    throw new Error(
+      `terminalhire: ${String(matches.length)} claims are recorded against this workspace (${matches.map((c) => c.id).join(", ")}), so run cannot tell which one this is. Name it with --claim <id>.`
+    );
+  }
+  const [claim] = matches;
+  let sha = given(flags.sha) ? flags.sha.trim() : null;
+  if (sha === null) {
+    if (typeof claim.baseSha !== "string" || !/^[0-9a-f]{40}$/.test(claim.baseSha)) {
+      throw new Error(
+        `terminalhire: claim ${claim.id} has no recorded base commit: it was delivered before terminalhire kept one. Pass --sha <40-hex>, the commit the workspace was delivered from.`
+      );
+    }
+    sha = claim.baseSha;
+  }
+  let baseline;
+  try {
+    baseline = deliveredBaseline(here);
+  } catch (err) {
+    throw new Error(
+      `terminalhire: could not read the delivered baseline in ${here} (${String(err?.stderr || err?.message || err).trim()}).`
+    );
+  }
+  if (baseline.kind !== "baseline") {
+    throw new Error(
+      `terminalhire: ${here} has ${String(baseline.rootCount)} root commits \u2014 cannot determine the delivered baseline to diff against. Re-fetch the slice into a fresh directory: terminalhire claim slice ${claim.id} --dir <path>`
+    );
+  }
+  const diffBase = baseline.sha;
+  const target = given(flags.target) ? flags.target.trim() : diffBase === sha ? here : null;
+  if (target === null) {
+    const sparse = typeof claim.baseSha === "string" && diffBase !== claim.baseSha;
+    throw new Error(
+      sparse ? "terminalhire: run needs --target. This delivery holds only the files you were granted, so a local run needs the clone URL of the full repository: --target <url>." : `terminalhire: run needs --target. --sha ${sha.slice(0, 12)} is not the commit this workspace was delivered as (${diffBase.slice(0, 12)}), so the workspace cannot stand in for the repository: pass --target <clone URL of the repository at that commit>.`
+    );
+  }
+  return { claimId: claim.id, target, sha, diffBase, workspaceRoot: here };
+}
 async function once(engine, opts) {
   const { root } = opts.scratch;
   const started = Date.now();
+  if (opts.deliveredCommit && !opts.json) {
+    process.stderr.write(
+      `  ${"tested".padEnd(8)} against the delivered commit ${opts.deliveredCommit.slice(0, 12)}; the poster-side run puts your change on top of the repository's current default branch, so its result can differ if that branch has moved since delivery.
+`
+    );
+  }
   const outcome = await engine.verifyWorkingDiff({
     claimId: opts.claimId,
     // `th run` is the developer's own loop, and this is the variant that says so: it tests
@@ -46698,7 +47621,10 @@ async function once(engine, opts) {
     source: {
       kind: "working-diff",
       localRepoDir: opts.localDir,
-      sliceFiles: opts.slice
+      sliceFiles: opts.slice,
+      // From a claim workspace, the delivered baseline: committed work is then tested,
+      // exactly as `claim submit` would send it (TERM-1098). Absent means HEAD.
+      ...opts.diffBase ? { diffBase: opts.diffBase } : {}
     },
     targetRepo: opts.target,
     targetSha: opts.sha,
@@ -46786,12 +47712,35 @@ async function run10() {
       `terminalhire: --keep must be at most ${String(KEEP_MAX_SECONDS)} seconds, got ${JSON.stringify(String(keepRaw))}. Past that the timer overflows its int32 of milliseconds and the wait collapses to 1ms, so asking for a longer hold would give you no hold at all and the URL printed above it would be dead before anyone could open it. Refused rather than clamped, because a preview that died on the way to you looks exactly like one that worked.`
     );
   }
+  const claimContext = resolveClaimContext({
+    localDir,
+    flags: { claim: pick2("claim"), target: pick2("target"), sha: pick2("sha") },
+    claims: readClaims()
+  });
   const opts = {
-    claimId: requireField(pick2("claim"), "--claim", "It is the id the result is filed under."),
-    target: requireField(pick2("target"), "--target", "e.g. https://github.com/koajs/koa.git"),
-    sha: requireField(pick2("sha"), "--sha", "The full 40-character commit your diff applies to."),
+    claimId: requireField(
+      claimContext?.claimId ?? pick2("claim"),
+      "--claim",
+      "It is the id the result is filed under."
+    ),
+    // With a claim context the target is always set: `resolveClaimContext` refuses, and
+    // says why, when it cannot name one.
+    target: requireField(
+      claimContext?.target ?? pick2("target"),
+      "--target",
+      "e.g. https://github.com/koajs/koa.git"
+    ),
+    sha: requireField(
+      claimContext?.sha ?? pick2("sha"),
+      "--sha",
+      "The full 40-character commit your diff applies to."
+    ),
+    diffBase: claimContext?.diffBase ?? null,
+    deliveredCommit: claimContext?.sha ?? null,
     slice,
-    localDir,
+    // From a claim workspace, its root and not the directory run started in: the diff
+    // collector reads `.git` there, and --watch watches the same tree (TERM-1098).
+    localDir: claimContext?.workspaceRoot ?? localDir,
     preview: !parsed.bools.has("no-preview"),
     watch: parsed.bools.has("watch"),
     json: parsed.bools.has("json"),
@@ -46844,12 +47793,14 @@ async function run10() {
   });
   return last;
 }
-var KEEP_MAX_SECONDS, USAGE;
+var KEEP_MAX_SECONDS, USAGE, given;
 var init_jpi_run = __esm({
   "bin/jpi-run.js"() {
     "use strict";
     init_recall_check();
     init_package_version();
+    init_claims();
+    init_delivered_baseline();
     KEEP_MAX_SECONDS = Math.floor((2 ** 31 - 1) / 1e3);
     USAGE = `terminalhire run \u2014 verify your working diff in a fresh container
 
@@ -46877,7 +47828,14 @@ Options:
 Defaults are read from .th-run.json in the local checkout when present, so a
 claim you run repeatedly needs no flags. Every flag overrides the file.
 
-Needs Docker running. Needs network for the first clone of the target.`;
+Run from inside a delivered claim workspace, the claim ledger supplies --claim and
+--sha. The diff is then taken from the delivered baseline, so committed work is tested
+as \`claim submit\` would send it. A full-repository delivery is its own --target: the
+delivered commit is cloned out of the workspace by path, so a private repository needs
+no credential. A delivery of only the files you were granted needs --target.
+
+Needs Docker running. Needs network for the first clone of a remote target.`;
+    given = (value) => typeof value === "string" && value.trim() !== "";
     if (process.argv[1] && process.argv[1].endsWith("jpi-run.js")) {
       run10().then((code) => process.exit(code ?? 0)).catch((err) => {
         process.stderr.write(`${err && err.message ? err.message : String(err)}
@@ -47533,7 +48491,7 @@ __export(trajectory_exports, {
   runTrajectory: () => runTrajectory,
   runTrajectoryPush: () => runTrajectoryPush
 });
-import { existsSync as existsSync25, readFileSync as readFileSync32, readdirSync as readdirSync5, writeFileSync as writeFileSync25 } from "fs";
+import { existsSync as existsSync25, readFileSync as readFileSync32, readdirSync as readdirSync5, writeFileSync as writeFileSync26 } from "fs";
 import { homedir as homedir29 } from "os";
 import { join as join48 } from "path";
 function isRecord4(value) {
@@ -47692,8 +48650,8 @@ function writeExportArtifacts(score, markdown) {
   ensureStateDir(dir);
   const jsonPath = join48(dir, "trajectory-export.json");
   const mdPath = join48(dir, "trajectory-export.md");
-  writeFileSync25(jsonPath, JSON.stringify(score, null, 2) + "\n", "utf8");
-  writeFileSync25(mdPath, markdown, "utf8");
+  writeFileSync26(jsonPath, JSON.stringify(score, null, 2) + "\n", "utf8");
+  writeFileSync26(mdPath, markdown, "utf8");
   return { jsonPath, mdPath };
 }
 function renderInward(allNodes, view, files) {
@@ -48526,7 +49484,7 @@ var init_jpi_intro = __esm({
 });
 
 // src/chat-keystore.ts
-import { existsSync as existsSync26, linkSync as linkSync2, readFileSync as readFileSync33, rmSync as rmSync15, unlinkSync as unlinkSync5, writeFileSync as writeFileSync26 } from "fs";
+import { existsSync as existsSync26, linkSync as linkSync2, readFileSync as readFileSync33, rmSync as rmSync15, unlinkSync as unlinkSync5, writeFileSync as writeFileSync27 } from "fs";
 import { randomBytes as randomBytes13 } from "crypto";
 import { homedir as homedir30 } from "os";
 import { join as join49 } from "path";
@@ -48573,7 +49531,7 @@ Recovery: if you intend to reset your chat identity, delete the file yourself an
 function publishIdentityBlob(blob) {
   const tmpFile = `${IDENTITY_FILE}.${process.pid}.${randomBytes13(6).toString("hex")}.tmp`;
   try {
-    writeFileSync26(tmpFile, JSON.stringify(blob, null, 2), {
+    writeFileSync27(tmpFile, JSON.stringify(blob, null, 2), {
       encoding: "utf8",
       mode: 384,
       flag: "wx"
@@ -48609,7 +49567,7 @@ var init_chat_keystore = __esm({
 });
 
 // src/chat-client.ts
-import { existsSync as existsSync27, readFileSync as readFileSync34, writeFileSync as writeFileSync27 } from "fs";
+import { existsSync as existsSync27, readFileSync as readFileSync34, writeFileSync as writeFileSync28 } from "fs";
 import { homedir as homedir31 } from "os";
 import { join as join50 } from "path";
 function defaultReadPeerPins() {
@@ -48628,7 +49586,7 @@ function defaultReadPeerPins() {
 }
 function defaultWritePeerPins(pins) {
   ensureStateDir(TERMINALHIRE_DIR19);
-  writeFileSync27(PEERS_FILE, JSON.stringify(pins, null, 2), { mode: 384, encoding: "utf8" });
+  writeFileSync28(PEERS_FILE, JSON.stringify(pins, null, 2), { mode: 384, encoding: "utf8" });
 }
 function defaultChatClientDeps() {
   return {
@@ -49257,7 +50215,7 @@ __export(jpi_chat_read_exports, {
   syncUnreadBadge: () => syncUnreadBadge,
   writeReadCursor: () => writeReadCursor
 });
-import { existsSync as existsSync28, readFileSync as readFileSync35, writeFileSync as writeFileSync28 } from "fs";
+import { existsSync as existsSync28, readFileSync as readFileSync35, writeFileSync as writeFileSync29 } from "fs";
 import { homedir as homedir32 } from "os";
 import { join as join51 } from "path";
 async function syncUnreadBadge(deps = {}) {
@@ -49281,7 +50239,7 @@ async function syncUnreadBadge(deps = {}) {
     );
     const entry = JSON.parse(readFileSync35(cacheFile, "utf8"));
     entry.unreadChat = { count: total };
-    writeFileSync28(cacheFile, JSON.stringify(entry), "utf8");
+    writeFileSync29(cacheFile, JSON.stringify(entry), "utf8");
   } catch {
   }
 }
@@ -49306,7 +50264,7 @@ function writeReadCursor(login, iso, deps = {}) {
   if (prev && iso <= prev) return;
   cursors[login] = iso;
   ensureStateDir(TERMINALHIRE_DIR20);
-  writeFileSync28(READS_FILE, JSON.stringify(cursors, null, 2), { mode: 384, encoding: "utf8" });
+  writeFileSync29(READS_FILE, JSON.stringify(cursors, null, 2), { mode: 384, encoding: "utf8" });
 }
 async function postReadCursor(peerLogin, lastReadAt, deps = {}) {
   const readCookie = deps.readCookie ?? readWebSessionCookie;
@@ -52216,7 +53174,7 @@ __export(mcp_config_exports, {
 });
 import { homedir as homedir34 } from "os";
 import { join as join53 } from "path";
-import { existsSync as existsSync30, readFileSync as readFileSync37, copyFileSync as copyFileSync3, writeFileSync as writeFileSync29, mkdirSync as mkdirSync11 } from "fs";
+import { existsSync as existsSync30, readFileSync as readFileSync37, copyFileSync as copyFileSync3, writeFileSync as writeFileSync30, mkdirSync as mkdirSync11 } from "fs";
 import { dirname as dirname12 } from "path";
 function serverEntry() {
   return { command: SERVER_COMMAND, args: [...SERVER_ARGS] };
@@ -52321,7 +53279,7 @@ function writeServerToFile(configPath, serversKey, entry = serverEntry()) {
   } else {
     mkdirSync11(dirname12(configPath), { recursive: true });
   }
-  writeFileSync29(configPath, merged.text, "utf8");
+  writeFileSync30(configPath, merged.text, "utf8");
   return { status: "written", backupPath, added: merged.added };
 }
 async function initMcpStep({
@@ -52559,7 +53517,7 @@ __export(util_exports, {
   getSizableOrigin: () => getSizableOrigin,
   hexToUint8Array: () => hexToUint8Array,
   isObject: () => isObject,
-  isPlainObject: () => isPlainObject,
+  isPlainObject: () => isPlainObject2,
   issue: () => issue,
   joinValues: () => joinValues,
   jsonStringifyReplacer: () => jsonStringifyReplacer,
@@ -52721,7 +53679,7 @@ function slugify(input) {
 function isObject(data) {
   return typeof data === "object" && data !== null && !Array.isArray(data);
 }
-function isPlainObject(o) {
+function isPlainObject2(o) {
   if (isObject(o) === false)
     return false;
   const ctor = o.constructor;
@@ -52738,7 +53696,7 @@ function isPlainObject(o) {
   return true;
 }
 function shallowClone(o) {
-  if (isPlainObject(o))
+  if (isPlainObject2(o))
     return { ...o };
   if (Array.isArray(o))
     return [...o];
@@ -52878,7 +53836,7 @@ function omit(schema, mask) {
   return clone(schema, def);
 }
 function extend(schema, shape) {
-  if (!isPlainObject(shape)) {
+  if (!isPlainObject2(shape)) {
     throw new Error("Invalid input to extend: expected a plain object");
   }
   const checks = schema._zod.def.checks;
@@ -52901,7 +53859,7 @@ function extend(schema, shape) {
   return clone(schema, def);
 }
 function safeExtend(schema, shape) {
-  if (!isPlainObject(shape)) {
+  if (!isPlainObject2(shape)) {
     throw new Error("Invalid input to safeExtend: expected a plain object");
   }
   const def = mergeDefs(schema._zod.def, {
@@ -54062,7 +55020,7 @@ function mergeValues(a, b) {
   if (a instanceof Date && b instanceof Date && +a === +b) {
     return { valid: true, data: a };
   }
-  if (isPlainObject(a) && isPlainObject(b)) {
+  if (isPlainObject2(a) && isPlainObject2(b)) {
     const bKeys = Object.keys(b);
     const sharedKeys = Object.keys(a).filter((key) => bKeys.indexOf(key) !== -1);
     const newObj = { ...a, ...b };
@@ -55014,7 +55972,7 @@ var init_schemas = __esm({
       $ZodType.init(inst, def);
       inst._zod.parse = (payload, ctx) => {
         const input = payload.value;
-        if (!isPlainObject(input)) {
+        if (!isPlainObject2(input)) {
           payload.issues.push({
             expected: "record",
             code: "invalid_type",
@@ -60156,7 +61114,7 @@ var init_zod_json_schema_compat = __esm({
 });
 
 // ../../node_modules/@modelcontextprotocol/sdk/dist/esm/shared/protocol.js
-function isPlainObject2(value) {
+function isPlainObject3(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function mergeCapabilities(base, additional) {
@@ -60167,7 +61125,7 @@ function mergeCapabilities(base, additional) {
     if (addValue === void 0)
       continue;
     const baseValue = result[k];
-    if (isPlainObject2(baseValue) && isPlainObject2(addValue)) {
+    if (isPlainObject3(baseValue) && isPlainObject3(addValue)) {
       result[k] = { ...baseValue, ...addValue };
     } else {
       result[k] = addValue;
@@ -75466,7 +76424,7 @@ __export(link_exports, {
   runLink: () => runLink,
   runLinkLogout: () => runLinkLogout
 });
-import { createServer } from "http";
+import { createServer as createServer2 } from "http";
 import { randomBytes as randomBytes14 } from "crypto";
 function resolveLoopbackRequest(rawUrl, expectedNonce) {
   let u;
@@ -75500,7 +76458,7 @@ function defaultStartLoopback(expectedNonce, timeoutMs) {
         }
       });
     };
-    const server = createServer((req, res) => {
+    const server = createServer2((req, res) => {
       const outcome = resolveLoopbackRequest(req.url ?? "", expectedNonce);
       res.writeHead(outcome.ok ? 200 : 400, { "Content-Type": "text/html; charset=utf-8" });
       res.end(outcome.ok ? LINKED_HTML : FAILED_HTML);
@@ -75894,11 +76852,11 @@ __export(signal_exports, {
   extractFingerprint: () => extractFingerprint
 });
 import { readFileSync as readFileSync38, readdirSync as readdirSync6 } from "fs";
-import { execFileSync as execFileSync3 } from "child_process";
+import { execFileSync as execFileSync5 } from "child_process";
 import { join as join54 } from "path";
 function safeGit(args5, cwd) {
   try {
-    return execFileSync3("git", ["-C", cwd, ...args5], {
+    return execFileSync5("git", ["-C", cwd, ...args5], {
       timeout: 2e3,
       stdio: ["ignore", "pipe", "ignore"]
     }).toString().trim();
@@ -76390,7 +77348,7 @@ var jpi_spinner_exports = {};
 __export(jpi_spinner_exports, {
   run: () => run25
 });
-import { readFileSync as readFileSync39, writeFileSync as writeFileSync30, copyFileSync as copyFileSync4, existsSync as existsSync31 } from "fs";
+import { readFileSync as readFileSync39, writeFileSync as writeFileSync31, copyFileSync as copyFileSync4, existsSync as existsSync31 } from "fs";
 import { join as join56 } from "path";
 import { homedir as homedir36 } from "os";
 import { createInterface as createInterface13 } from "readline";
@@ -76404,7 +77362,7 @@ function readConfig3() {
 function writeConfig2(patch) {
   ensureStateDir(TH_DIR);
   const merged = { ...readConfig3(), ...patch };
-  writeFileSync30(CONFIG_FILE3, JSON.stringify(merged, null, 2) + "\n", "utf8");
+  writeFileSync31(CONFIG_FILE3, JSON.stringify(merged, null, 2) + "\n", "utf8");
 }
 function backupSettings() {
   if (!existsSync31(SETTINGS_PATH)) return null;
@@ -76650,7 +77608,7 @@ var jpi_sync_exports = {};
 __export(jpi_sync_exports, {
   run: () => run26
 });
-import { readFileSync as readFileSync40, writeFileSync as writeFileSync31, existsSync as existsSync32, rmSync as rmSync16 } from "fs";
+import { readFileSync as readFileSync40, writeFileSync as writeFileSync32, existsSync as existsSync32, rmSync as rmSync16 } from "fs";
 import { join as join57 } from "path";
 import { homedir as homedir37, hostname as osHostname2 } from "os";
 import { createInterface as createInterface14 } from "readline";
@@ -76675,7 +77633,7 @@ function readMarker() {
 }
 function writeMarker(marker) {
   ensureStateDir(TH_DIR2);
-  writeFileSync31(TIER1_MARKER, JSON.stringify(marker, null, 2) + "\n", "utf8");
+  writeFileSync32(TIER1_MARKER, JSON.stringify(marker, null, 2) + "\n", "utf8");
 }
 function clearMarker() {
   try {