terminalhire 0.42.19 → 0.42.21

package/dist/bin/jpi-run.js

@@ -293,7 +293,7 @@ var init_classify = __esm({
 });
 
 // ../../packages/containment/dist/env.js
-import { homedir as homedir3 } from "os";
+import { homedir as homedir4 } from "os";
 import { posix } from "path";
 function realHomeCandidates(source) {
   const candidates = [];
@@ -302,7 +302,7 @@ function realHomeCandidates(source) {
     candidates.push(fromEnv);
   let fromOs;
   try {
-    fromOs = homedir3();
+    fromOs = homedir4();
   } catch {
     fromOs = void 0;
   }
@@ -336,24 +336,24 @@ function scrubEnv(source, opts) {
   env["PATH"] = [...opts.toolPaths ?? [], ...BASE_PATH].join(":");
   env["HOME"] = jailHome;
   env["TMPDIR"] = tmpDir;
-  env["XDG_CONFIG_HOME"] = join4(jailHome, ".config");
-  env["XDG_CACHE_HOME"] = join4(jailHome, ".cache");
-  env["XDG_DATA_HOME"] = join4(jailHome, ".local", "share");
-  env["GIT_CONFIG_GLOBAL"] = join4(jailHome, ".gitconfig");
+  env["XDG_CONFIG_HOME"] = join5(jailHome, ".config");
+  env["XDG_CACHE_HOME"] = join5(jailHome, ".cache");
+  env["XDG_DATA_HOME"] = join5(jailHome, ".local", "share");
+  env["GIT_CONFIG_GLOBAL"] = join5(jailHome, ".gitconfig");
   env["GIT_CONFIG_SYSTEM"] = "/dev/null";
   env["GIT_TERMINAL_PROMPT"] = "0";
   env["GIT_ASKPASS"] = "/usr/bin/false";
   env["SSH_ASKPASS"] = "/usr/bin/false";
-  env["npm_config_userconfig"] = join4(jailHome, ".npmrc");
-  env["npm_config_cache"] = join4(jailHome, ".npm");
+  env["npm_config_userconfig"] = join5(jailHome, ".npmrc");
+  env["npm_config_cache"] = join5(jailHome, ".npm");
   env["npm_config_update_notifier"] = "false";
   env["npm_config_fund"] = "false";
   env["npm_config_audit"] = "false";
-  env["GOPATH"] = join4(jailHome, "go");
-  env["GOMODCACHE"] = join4(jailHome, "go", "pkg", "mod");
-  env["GOCACHE"] = join4(jailHome, ".cache", "go-build");
+  env["GOPATH"] = join5(jailHome, "go");
+  env["GOMODCACHE"] = join5(jailHome, "go", "pkg", "mod");
+  env["GOCACHE"] = join5(jailHome, ".cache", "go-build");
   env["GOFLAGS"] = "-modcacherw";
-  env["CARGO_HOME"] = join4(jailHome, ".cargo");
+  env["CARGO_HOME"] = join5(jailHome, ".cargo");
   const proxy = opts.proxyUrl ?? DEAD_PROXY;
   env["HTTP_PROXY"] = proxy;
   env["HTTPS_PROXY"] = proxy;
@@ -381,11 +381,11 @@ function auditEnv(env) {
   }
   return leaks;
 }
-var join4, ENV_ALLOWLIST, BASE_PATH, DEAD_PROXY, SandboxEnvError, FORBIDDEN_EXTRA;
+var join5, ENV_ALLOWLIST, BASE_PATH, DEAD_PROXY, SandboxEnvError, FORBIDDEN_EXTRA;
 var init_env = __esm({
   "../../packages/containment/dist/env.js"() {
     "use strict";
-    join4 = posix.join;
+    join5 = posix.join;
     ENV_ALLOWLIST = ["LANG", "LC_ALL", "LC_CTYPE", "TZ", "TERM"];
     BASE_PATH = ["/usr/bin", "/bin", "/usr/sbin", "/sbin"];
     DEAD_PROXY = "http://127.0.0.1:1";
@@ -405,8 +405,8 @@ var init_reap = __esm({
 
 // ../../packages/containment/dist/fence.js
 import { spawn, spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, realpathSync, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname2, isAbsolute, join as join5, posix as posix2 } from "path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync4, realpathSync, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname2, isAbsolute, join as join6, posix as posix2 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function canonical(path, label) {
   if (!isAbsolute(path)) {
@@ -455,15 +455,15 @@ function idOrNull(fn) {
   return typeof f === "function" ? f.call(process) : null;
 }
 function buildJail(root, guestUser) {
-  const jail = join5(root, JAIL_SEGMENT);
-  const tmp = join5(root, JAIL_TMP_SEGMENT);
-  for (const dir of [jail, tmp, join5(jail, ".config"), join5(jail, ".cache"), join5(jail, ".npm")]) {
-    mkdirSync2(dir, { recursive: true });
-  }
-  writeFileSync2(join5(jail, ".npmrc"), "", "utf8");
-  writeFileSync2(join5(jail, JAIL_PASSWD_FILE), guestUser ? jailPasswd(guestUser.uid, guestUser.gid) : jailPasswd(), "utf8");
-  writeFileSync2(join5(jail, JAIL_GROUP_FILE), guestUser ? jailGroup(guestUser.gid) : jailGroup(), "utf8");
-  writeFileSync2(join5(jail, ".gitconfig"), '[user]\n	name = sandbox\n	email = sandbox@localhost\n[safe]\n	directory = *\n[url "https://github.com/"]\n	insteadOf = ssh://git@github.com/\n	insteadOf = git@github.com:\n', "utf8");
+  const jail = join6(root, JAIL_SEGMENT);
+  const tmp = join6(root, JAIL_TMP_SEGMENT);
+  for (const dir of [jail, tmp, join6(jail, ".config"), join6(jail, ".cache"), join6(jail, ".npm")]) {
+    mkdirSync4(dir, { recursive: true });
+  }
+  writeFileSync3(join6(jail, ".npmrc"), "", "utf8");
+  writeFileSync3(join6(jail, JAIL_PASSWD_FILE), guestUser ? jailPasswd(guestUser.uid, guestUser.gid) : jailPasswd(), "utf8");
+  writeFileSync3(join6(jail, JAIL_GROUP_FILE), guestUser ? jailGroup(guestUser.gid) : jailGroup(), "utf8");
+  writeFileSync3(join6(jail, ".gitconfig"), '[user]\n	name = sandbox\n	email = sandbox@localhost\n[safe]\n	directory = *\n[url "https://github.com/"]\n	insteadOf = ssh://git@github.com/\n	insteadOf = git@github.com:\n', "utf8");
   return { jail, tmp };
 }
 var FenceError, ContainmentError, ContainmentRefusalError, JAIL_PASSWD_FILE, JAIL_GROUP_FILE, GUEST_JAIL, FENCE_USER, JAIL_SEGMENT, JAIL_TMP_SEGMENT;
@@ -551,12 +551,33 @@ function scrubEndpointEnv(env) {
   }
   return out;
 }
-function remoteDockerClient(endpoint) {
+function containerFlagsAt(args) {
+  if (args[0] === "run" || args[0] === "create")
+    return 1;
+  if (args[0] === "container" && (args[1] === "run" || args[1] === "create"))
+    return 2;
+  return -1;
+}
+function remoteDockerClient(endpoint, opts = {}) {
   if (endpoint.trim().length === 0) {
     throw new Error("remoteDockerClient: endpoint must be a non-empty docker host");
   }
   const target = endpoint.trim();
-  const argv = (args) => ["--host", target, ...args];
+  const tlsFlags = [];
+  if (opts.tls) {
+    for (const key of ["caPath", "certPath", "keyPath"]) {
+      if (opts.tls[key].trim().length === 0) {
+        throw new Error(`remoteDockerClient: tls.${key} must name a file`);
+      }
+    }
+    tlsFlags.push("--tlsverify", "--tlscacert", opts.tls.caPath, "--tlscert", opts.tls.certPath, "--tlskey", opts.tls.keyPath);
+  }
+  const runArgs = opts.runArgs ?? [];
+  const argv = (args) => {
+    const at = runArgs.length > 0 ? containerFlagsAt(args) : -1;
+    const sub = at < 0 ? [...args] : [...args.slice(0, at), ...runArgs, ...args.slice(at)];
+    return ["--host", target, ...tlsFlags, ...sub];
+  };
   return {
     endpoint: target,
     // Always empty, and it is a fact about this client rather than about the
@@ -573,10 +594,10 @@ function remoteDockerClient(endpoint) {
         env: scrubEndpointEnv(process.env)
       });
     },
-    sync(args, opts) {
+    sync(args, opts2) {
       return syncResult(spawnSync3(DOCKER_BIN, argv(args), {
         encoding: "utf8",
-        timeout: opts?.timeoutMs,
+        timeout: opts2?.timeoutMs,
         env: scrubEndpointEnv(process.env)
       }));
     },
@@ -657,8 +678,8 @@ var init_egressProxy = __esm({
 
 // ../../packages/containment/dist/container.js
 import { fileURLToPath as fileURLToPath3 } from "url";
-import { dirname as dirname3, join as join6 } from "path";
-import { chmodSync, copyFileSync, existsSync as existsSync4, mkdtempSync, rmSync } from "fs";
+import { dirname as dirname3, join as join7 } from "path";
+import { chmodSync, copyFileSync, existsSync as existsSync5, mkdtempSync, rmSync as rmSync2 } from "fs";
 import { tmpdir } from "os";
 function scrubEnvPathsFor(containmentKind, host) {
   return containmentKind === "container" ? { jailHome: GUEST.jail, tmpDir: GUEST.tmp } : { jailHome: host.jail, tmpDir: host.tmp };
@@ -806,7 +827,7 @@ function guestIdentityMounts(spec) {
     return [];
   const domain = pathDomainOf(spec);
   const resolve2 = resolverFor(domain);
-  const under = domain === "venue" ? venueJoin : join6;
+  const under = domain === "venue" ? venueJoin : join7;
   const jail = resolve2(spec.jail, "jail");
   const passwd = resolve2(under(jail, JAIL_PASSWD_FILE), "the jail passwd file");
   const group = resolve2(under(jail, JAIL_GROUP_FILE), "the jail group file");
@@ -992,8 +1013,8 @@ function dockerSync(d, args, timeoutMs = DOCKER_TIMEOUT_MS) {
   };
 }
 function pickProxyDir(baseDir) {
-  const scoped = join6(baseDir, "proxy");
-  if (existsSync4(join6(scoped, "proxyEntry.js")))
+  const scoped = join7(baseDir, "proxy");
+  if (existsSync5(join7(scoped, "proxyEntry.js")))
     return scoped;
   return baseDir;
 }
@@ -1001,22 +1022,22 @@ function resolveProxyCodeSource() {
   return pickProxyDir(dirname3(fileURLToPath3(import.meta.url)));
 }
 function stageProxyCode(source = resolveProxyCodeSource()) {
-  const missing = PROXY_FILES.map((f) => join6(source, f)).filter((p) => !existsSync4(p));
+  const missing = PROXY_FILES.map((f) => join7(source, f)).filter((p) => !existsSync5(p));
   if (missing.length > 0) {
     throw new FenceError(`the egress proxy is missing from this install: ${missing.join(", ")} not found. Reinstall the CLI, or update the Claude Code plugin.`);
   }
-  const dir = mkdtempSync(join6(tmpdir(), "th-proxy-"));
+  const dir = mkdtempSync(join7(tmpdir(), "th-proxy-"));
   try {
     for (const file of PROXY_FILES) {
-      copyFileSync(join6(source, file), join6(dir, file));
+      copyFileSync(join7(source, file), join7(dir, file));
     }
     for (const file of PROXY_FILES) {
-      chmodSync(join6(dir, file), 420);
+      chmodSync(join7(dir, file), 420);
     }
     chmodSync(dir, 493);
   } catch (err) {
     try {
-      rmSync(dir, { recursive: true, force: true });
+      rmSync2(dir, { recursive: true, force: true });
     } catch {
     }
     throw err;
@@ -1025,7 +1046,7 @@ function stageProxyCode(source = resolveProxyCodeSource()) {
     dir,
     cleanup: () => {
       try {
-        rmSync(dir, { recursive: true, force: true });
+        rmSync2(dir, { recursive: true, force: true });
       } catch {
       }
     }
@@ -1438,9 +1459,9 @@ var init_previewRegistry = __esm({
 });
 
 // ../../packages/envrun/dist/preview.js
-import { randomBytes } from "crypto";
-import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync3 } from "fs";
-import { join as join7 } from "path";
+import { randomBytes as randomBytes2 } from "crypto";
+import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync4 } from "fs";
+import { join as join8 } from "path";
 function docker(client, args, timeoutMs = 6e4) {
   const res = client.sync([...args], { timeoutMs });
   return {
@@ -1498,13 +1519,13 @@ async function startPreview(req) {
   if (!LOOPBACK_BINDS.has(bindAddress) && req.authToken === void 0) {
     throw new PreviewError(`refusing to publish the preview on ${bindAddress} without an explicit authToken: a bind wider than loopback puts this run \u2014 the test output tail included \u2014 on the developer's local network`);
   }
-  const authToken = req.authToken ?? randomBytes(24).toString("base64url");
+  const authToken = req.authToken ?? randomBytes2(24).toString("base64url");
   const envArgs = ["--env", `PREVIEW_AUTH_TOKEN=${authToken}`];
   const probeHost = WILDCARD_BINDS.has(bindAddress) ? "127.0.0.1" : bindAddress;
   const probeAuthority = probeHost.includes(":") ? `[${probeHost}]` : probeHost;
-  mkdirSync3(req.scratchDir, { recursive: true });
-  const docPath = join7(req.scratchDir, "preview-run.json");
-  writeFileSync3(docPath, JSON.stringify(req.document, null, 2), "utf8");
+  mkdirSync5(req.scratchDir, { recursive: true });
+  const docPath = join8(req.scratchDir, "preview-run.json");
+  writeFileSync4(docPath, JSON.stringify(req.document, null, 2), "utf8");
   const teardown = () => {
     livePreviews.deregister(client, container);
     for (let i = 0; i < 3; i += 1) {
@@ -1693,11 +1714,11 @@ http
 });
 
 // ../../packages/envrun/dist/venue.js
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 function localJailPaths(scratchRoot) {
   return {
-    jail: join8(scratchRoot, JAIL_SEGMENT),
-    tmp: join8(scratchRoot, JAIL_TMP_SEGMENT)
+    jail: join9(scratchRoot, JAIL_SEGMENT),
+    tmp: join9(scratchRoot, JAIL_TMP_SEGMENT)
   };
 }
 function localVenue() {
@@ -2352,7 +2373,7 @@ var init_dsse = __esm({
 });
 
 // ../../packages/attest/dist/sealedbox.js
-import { createCipheriv, createDecipheriv, diffieHellman, generateKeyPairSync as generateKeyPairSync2, hkdfSync, randomBytes as randomBytes2 } from "crypto";
+import { createCipheriv, createDecipheriv, diffieHellman, generateKeyPairSync as generateKeyPairSync2, hkdfSync, randomBytes as randomBytes3 } from "crypto";
 var init_sealedbox = __esm({
   "../../packages/attest/dist/sealedbox.js"() {
     "use strict";
@@ -2362,7 +2383,7 @@ var init_sealedbox = __esm({
 });
 
 // ../../packages/attest/dist/aead.js
-import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, randomBytes as randomBytes3 } from "crypto";
+import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, randomBytes as randomBytes4 } from "crypto";
 var init_aead = __esm({
   "../../packages/attest/dist/aead.js"() {
     "use strict";
@@ -2557,6 +2578,197 @@ var init_gceIdentity = __esm({
   }
 });
 
+// ../../packages/attest/dist/confidentialSpace.js
+import { createHash as createHash2, createPublicKey as createPublicKey3, verify as cryptoVerify3 } from "crypto";
+function refuse2(reason, detail) {
+  return { ok: false, reason, detail };
+}
+function isPlainObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function assertExpectationsComplete2(expectations) {
+  const required = [
+    ["audience", expectations.audience],
+    ["nonce", expectations.nonce],
+    ["instanceName", expectations.instanceName],
+    ["projectId", expectations.projectId],
+    ...(expectations.additionalNonces ?? []).map((n) => [
+      "additionalNonces[]",
+      n
+    ]),
+    ...Object.entries(expectations.containerEnv ?? {}).flatMap(([name, value]) => [
+      ["containerEnv name", name],
+      [`containerEnv.${name}`, value]
+    ])
+  ];
+  for (const [name, value] of required) {
+    if (value === "") {
+      throw new TypeError(`verifyConfidentialSpaceToken: expectations.${name} is empty`);
+    }
+  }
+}
+function nonceList(v) {
+  if (typeof v === "string")
+    return [v];
+  if (!Array.isArray(v) || v.length === 0)
+    return null;
+  if (!v.every((n) => typeof n === "string"))
+    return null;
+  return v;
+}
+async function verifyConfidentialSpaceToken(token, expectations, deps) {
+  assertExpectationsComplete2(expectations);
+  if (!Number.isFinite(deps.now)) {
+    throw new TypeError("verifyConfidentialSpaceToken: deps.now is not a finite number");
+  }
+  if (expectations.allowedImageDigests.length === 0) {
+    return refuse2("image-digest-allowlist-unset", "no workload image digest is allowlisted, so no attestation can be accepted");
+  }
+  if (token.length > MAX_TOKEN_LENGTH) {
+    return refuse2("token-malformed", "longer than any attestation token");
+  }
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    return refuse2("token-malformed", "not a three-segment compact JWT");
+  }
+  const [headerB64, payloadB64, signatureB64] = parts;
+  const header = decodeJsonSegment(headerB64);
+  if (header === null) {
+    return refuse2("token-malformed", "header segment is not base64url-encoded JSON");
+  }
+  if (header.alg !== "RS256") {
+    return refuse2("algorithm-not-rs256", "token names an unsupported algorithm");
+  }
+  if (typeof header.kid !== "string" || header.kid === "") {
+    return refuse2("unknown-key", "token header names no key id");
+  }
+  const jwks = await deps.fetchJwks();
+  const jwk = jwks.keys.find((k) => k.kid === header.kid && k.kty === "RSA");
+  if (jwk === void 0) {
+    return refuse2("unknown-key", "token key id is not in the published key set");
+  }
+  const signature = strictBase64UrlDecode(signatureB64);
+  if (signature === null) {
+    return refuse2("token-malformed", "signature segment is not base64url");
+  }
+  let signatureValid = false;
+  try {
+    const publicKey = createPublicKey3({ key: jwk, format: "jwk" });
+    signatureValid = cryptoVerify3("sha256", Buffer.from(`${headerB64}.${payloadB64}`, "utf8"), publicKey, signature);
+  } catch {
+    signatureValid = false;
+  }
+  if (!signatureValid) {
+    return refuse2("signature-invalid", "signature does not verify under the named key");
+  }
+  const payload = decodeJsonSegment(payloadB64);
+  if (payload === null) {
+    return refuse2("token-malformed", "payload segment is not base64url-encoded JSON");
+  }
+  if (payload.iss !== CONFIDENTIAL_SPACE_ISSUER) {
+    return refuse2("wrong-issuer", "issuer is not the Confidential Computing attestation service");
+  }
+  if (payload.aud !== expectations.audience) {
+    return refuse2("wrong-audience", "audience is not the one this run expects");
+  }
+  const nowSeconds = deps.now / 1e3;
+  const exp = payload.exp;
+  if (typeof exp !== "number" || !Number.isFinite(exp) || exp <= nowSeconds) {
+    return refuse2("expired", "exp is missing, malformed, or in the past");
+  }
+  const iat = payload.iat;
+  if (typeof iat !== "number" || !Number.isFinite(iat) || iat > nowSeconds + IAT_FUTURE_SKEW_MS / 1e3) {
+    return refuse2("iat-in-future", "iat is missing, malformed, or too far in the future");
+  }
+  const nonces = nonceList(payload.eat_nonce);
+  if (nonces === null) {
+    return refuse2("nonce-missing", "eat_nonce is absent or not a string or array of strings");
+  }
+  if (!nonces.includes(expectations.nonce)) {
+    return refuse2("nonce-mismatch", "eat_nonce does not carry the nonce this run was dispatched with");
+  }
+  for (const extra of expectations.additionalNonces ?? []) {
+    if (!nonces.includes(extra)) {
+      return refuse2("nonce-mismatch", "eat_nonce does not carry every nonce this caller requires");
+    }
+  }
+  if (payload.swname !== CONFIDENTIAL_SPACE_SWNAME) {
+    return refuse2("swname-not-confidential-space", "the VM is not running a Confidential Space image");
+  }
+  if (payload.dbgstat !== CONFIDENTIAL_SPACE_DBGSTAT_PRODUCTION) {
+    return refuse2("debug-enabled", "the image is not a production image with debug disabled");
+  }
+  if (payload.secboot !== true) {
+    return refuse2("secure-boot-off", "Secure Boot is not reported as enabled");
+  }
+  if (typeof payload.hwmodel !== "string" || !payload.hwmodel.startsWith("GCP_")) {
+    return refuse2("hwmodel-not-gcp", "hardware model is not a Google Cloud confidential model");
+  }
+  const hwmodel = payload.hwmodel;
+  const submods = payload.submods;
+  const gce = isPlainObject(submods) ? submods.gce : void 0;
+  if (!isPlainObject(gce)) {
+    return refuse2("submods-gce-missing", "no submods.gce block names the instance");
+  }
+  if (gce.project_id !== expectations.projectId) {
+    return refuse2("project-mismatch", "token names an instance in a different project");
+  }
+  if (gce.instance_name !== expectations.instanceName) {
+    return refuse2("instance-name-mismatch", "token names a different instance than this run booted");
+  }
+  if (typeof gce.instance_id !== "string" || gce.instance_id === "") {
+    return refuse2("instance-id-missing", "instance id is absent or not a string");
+  }
+  const instanceId = gce.instance_id;
+  if (typeof gce.zone !== "string" || !expectations.allowedZones.includes(gce.zone)) {
+    return refuse2("zone-not-allowed", "zone is not one the pool is configured to use");
+  }
+  const zone = gce.zone;
+  const container = isPlainObject(submods) ? submods.container : void 0;
+  if (!isPlainObject(container)) {
+    return refuse2("submods-container-missing", "no submods.container block names the workload");
+  }
+  if (typeof container.image_reference !== "string" || container.image_reference === "") {
+    return refuse2("image-reference-missing", "the workload image reference is absent");
+  }
+  const imageReference = container.image_reference;
+  if (typeof container.image_digest !== "string" || !expectations.allowedImageDigests.includes(container.image_digest)) {
+    return refuse2("image-digest-not-allowed", "the workload image digest is not on the allowlist");
+  }
+  const env = container.env;
+  for (const [name, value] of Object.entries(expectations.containerEnv ?? {})) {
+    if (!isPlainObject(env) || !Object.prototype.hasOwnProperty.call(env, name) || env[name] !== value) {
+      return refuse2("container-env-mismatch", `the signed container environment does not carry the ${name} this caller booted with`);
+    }
+  }
+  return {
+    ok: true,
+    value: {
+      instanceId,
+      instanceName: expectations.instanceName,
+      zone,
+      projectId: expectations.projectId,
+      imageDigest: container.image_digest,
+      imageReference,
+      hwmodel,
+      iat,
+      exp,
+      tokenSha256: createHash2("sha256").update(token, "utf8").digest("hex")
+    }
+  };
+}
+var CONFIDENTIAL_SPACE_ISSUER, CONFIDENTIAL_SPACE_OIDC_DISCOVERY_URL, CONFIDENTIAL_SPACE_SWNAME, CONFIDENTIAL_SPACE_DBGSTAT_PRODUCTION;
+var init_confidentialSpace = __esm({
+  "../../packages/attest/dist/confidentialSpace.js"() {
+    "use strict";
+    init_gceIdentity();
+    CONFIDENTIAL_SPACE_ISSUER = "https://confidentialcomputing.googleapis.com";
+    CONFIDENTIAL_SPACE_OIDC_DISCOVERY_URL = `${CONFIDENTIAL_SPACE_ISSUER}/.well-known/openid-configuration`;
+    CONFIDENTIAL_SPACE_SWNAME = "CONFIDENTIAL_SPACE";
+    CONFIDENTIAL_SPACE_DBGSTAT_PRODUCTION = "disabled-since-boot";
+  }
+});
+
 // ../../packages/attest/dist/venueInstanceName.js
 function venueInstanceName(runId) {
   return `th-run-${runId}`.replace(/_/g, "-").toLowerCase().slice(0, 62);
@@ -2591,6 +2803,7 @@ var init_dist2 = __esm({
     init_attestation();
     init_nonce();
     init_gceIdentity();
+    init_confidentialSpace();
     init_venueInstanceName();
     init_verify();
   }
@@ -2841,7 +3054,7 @@ var init_result = __esm({
 });
 
 // ../../packages/envrun/dist/attestation.js
-import { createHash as createHash2, randomBytes as randomBytes4 } from "crypto";
+import { createHash as createHash3, randomBytes as randomBytes5 } from "crypto";
 function contradicts(outcome, counts, exitCode) {
   const budget = OUTCOME_TO_BUDGET[outcome];
   if (budget === null)
@@ -2883,7 +3096,7 @@ function imageDigestOf(ref) {
   return at === -1 ? null : ref.slice(at + 1);
 }
 function sha256Hex(data) {
-  return createHash2("sha256").update(typeof data === "string" ? Buffer.from(data, "utf8") : data).digest("hex");
+  return createHash3("sha256").update(typeof data === "string" ? Buffer.from(data, "utf8") : data).digest("hex");
 }
 function toTestRunResult(result, outputSha256) {
   return {
@@ -2895,50 +3108,50 @@ function toTestRunResult(result, outputSha256) {
 function toAcceptancePredicate(pair, opts = {}) {
   const { baseline, patched } = pair;
   if (baseline.runId === patched.runId) {
-    return refuse2("pair-is-the-same-run", `both sides are run ${patched.runId}. A baseline and a patched result that are the same execution prove nothing about the patch, and every field of the pair would be equal by construction.`);
+    return refuse3("pair-is-the-same-run", `both sides are run ${patched.runId}. A baseline and a patched result that are the same execution prove nothing about the patch, and every field of the pair would be equal by construction.`);
   }
   if (patched.status === "refused") {
-    return refuse2("run-was-refused", `the patched run was refused before executing (${patched.boundaryRefusals.length} boundary refusal(s)), so there is no result to attest`);
+    return refuse3("run-was-refused", `the patched run was refused before executing (${patched.boundaryRefusals.length} boundary refusal(s)), so there is no result to attest`);
   }
   if (patched.outcome === null) {
-    return refuse2("no-outcome-recorded", "the patched run recorded no outcome");
+    return refuse3("no-outcome-recorded", "the patched run recorded no outcome");
   }
   if (baseline.status === "refused") {
-    return refuse2("baseline-was-refused", `the baseline run was refused before executing (${baseline.boundaryRefusals.length} boundary refusal(s)), so there is no "before" to compare against`);
+    return refuse3("baseline-was-refused", `the baseline run was refused before executing (${baseline.boundaryRefusals.length} boundary refusal(s)), so there is no "before" to compare against`);
   }
   if (baseline.outcome === null) {
-    return refuse2("baseline-no-outcome", "the baseline run recorded no outcome");
+    return refuse3("baseline-no-outcome", "the baseline run recorded no outcome");
   }
   if (!BASELINE_IS_A_VERDICT[baseline.outcome]) {
-    return refuse2("baseline-environment-failed", `the baseline ended ${baseline.outcome}, which is not an observed verdict about the unpatched tree. Signing it would let a baseline we could not read stand in for one that failed, and a broken baseline flatters every patch.`);
+    return refuse3("baseline-environment-failed", `the baseline ended ${baseline.outcome}, which is not an observed verdict about the unpatched tree. Signing it would let a baseline we could not read stand in for one that failed, and a broken baseline flatters every patch.`);
   }
   const budget = OUTCOME_TO_BUDGET[patched.outcome];
   if (budget === null) {
-    return refuse2("our-environment-failed", `the patched run ended ${patched.outcome}: the test command could not be invoked, which is our environment failing and not a verdict about the work. No statement is emitted, because every possible value would be a claim we cannot support.`);
+    return refuse3("our-environment-failed", `the patched run ended ${patched.outcome}: the test command could not be invoked, which is our environment failing and not a verdict about the work. No statement is emitted, because every possible value would be a claim we cannot support.`);
   }
   if (patched.testCommand === null) {
-    return refuse2("no-test-command", "no test command was recorded, so none can be attested");
+    return refuse3("no-test-command", "no test command was recorded, so none can be attested");
   }
   if (baseline.testCommand !== patched.testCommand) {
-    return refuse2("pair-disagrees-on-harness", `baseline ran ${JSON.stringify(baseline.testCommand)} and patched ran ${JSON.stringify(patched.testCommand)}. Opposite verdicts from different harnesses say nothing about the patch.`);
+    return refuse3("pair-disagrees-on-harness", `baseline ran ${JSON.stringify(baseline.testCommand)} and patched ran ${JSON.stringify(patched.testCommand)}. Opposite verdicts from different harnesses say nothing about the patch.`);
   }
   if (baseline.targetSha !== patched.targetSha) {
-    return refuse2("pair-disagrees-on-base", `baseline is at ${baseline.targetSha} and patched at ${patched.targetSha}`);
+    return refuse3("pair-disagrees-on-base", `baseline is at ${baseline.targetSha} and patched at ${patched.targetSha}`);
   }
   if (patched.treeDigest === null || patched.treeDigest === "") {
-    return refuse2("missing-tree-digest", "the patched run recorded no tree digest to bind to");
+    return refuse3("missing-tree-digest", "the patched run recorded no tree digest to bind to");
   }
   if (patched.patchSha256 === null || patched.patchSha256 === "") {
-    return refuse2("missing-patch-digest", "the patched run recorded no patch digest");
+    return refuse3("missing-patch-digest", "the patched run recorded no patch digest");
   }
   if (baseline.treeDigest === null || baseline.treeDigest === "") {
-    return refuse2("missing-tree-digest", "the baseline recorded no tree digest, so the two halves cannot be shown to differ");
+    return refuse3("missing-tree-digest", "the baseline recorded no tree digest, so the two halves cannot be shown to differ");
   }
   if (baseline.treeDigest === patched.treeDigest) {
-    return refuse2("pair-has-identical-tree", `both sides are tree ${String(patched.treeDigest).slice(0, 12)}\u2026, so whatever the two runs disagree about, it is not the patch`);
+    return refuse3("pair-has-identical-tree", `both sides are tree ${String(patched.treeDigest).slice(0, 12)}\u2026, so whatever the two runs disagree about, it is not the patch`);
   }
   if (patched.baselinePatchSha256 !== null || baseline.baselinePatchSha256 !== null) {
-    return refuse2("patch-binding-incomplete", `a baseline patch shaped the ${patched.baselinePatchSha256 !== null ? "patched" : "baseline"} tree, so it cannot be reproduced from (base_commit_oid, patch_sha256) alone. Fold it into the binding before signing; do not sign a triple a verifier cannot follow.`);
+    return refuse3("patch-binding-incomplete", `a baseline patch shaped the ${patched.baselinePatchSha256 !== null ? "patched" : "baseline"} tree, so it cannot be reproduced from (base_commit_oid, patch_sha256) alone. Fold it into the binding before signing; do not sign a triple a verifier cannot follow.`);
   }
   for (const [side, outcome, counts, exitCode] of [
     ["patched", patched.outcome, patched.counts, patched.exitCode],
@@ -2946,7 +3159,7 @@ function toAcceptancePredicate(pair, opts = {}) {
   ]) {
     const why = contradicts(outcome, counts, exitCode);
     if (why !== null) {
-      return refuse2("outcome-contradicts-counts", `the ${side} run is ${why}`);
+      return refuse3("outcome-contradicts-counts", `the ${side} run is ${why}`);
     }
   }
   for (const [side, source] of [
@@ -2955,44 +3168,44 @@ function toAcceptancePredicate(pair, opts = {}) {
   ]) {
     const why = SOURCE_IS_SIGNABLE[source](patched.testCommand);
     if (why !== null)
-      return refuse2("test-command-origin-unattested", `the ${side} run ${why}`);
+      return refuse3("test-command-origin-unattested", `the ${side} run ${why}`);
   }
   if (patched.testCommandSource === "developer-declared") {
-    return refuse2("test-command-origin-unattested", "the developer supplied the test command (unreachable \u2014 the source rules above cover it)");
+    return refuse3("test-command-origin-unattested", "the developer supplied the test command (unreachable \u2014 the source rules above cover it)");
   }
   if (baseline.testCommandSource !== patched.testCommandSource) {
-    return refuse2("test-command-origin-unattested", `the pair disagrees on where the command came from: baseline ${baseline.testCommandSource}, patched ${patched.testCommandSource}. One signed value cannot describe both.`);
+    return refuse3("test-command-origin-unattested", `the pair disagrees on where the command came from: baseline ${baseline.testCommandSource}, patched ${patched.testCommandSource}. One signed value cannot describe both.`);
   }
   if (baseline.containerImage !== patched.containerImage) {
-    return refuse2("pair-disagrees-on-image", `baseline ran in ${String(baseline.containerImage)} and patched in ${String(patched.containerImage)}. The signed measurement names one image, so a pair from two environments would attribute to the patch whatever the image changed.`);
+    return refuse3("pair-disagrees-on-image", `baseline ran in ${String(baseline.containerImage)} and patched in ${String(patched.containerImage)}. The signed measurement names one image, so a pair from two environments would attribute to the patch whatever the image changed.`);
   }
   if (patched.containerImage === null || patched.containerImage === "") {
-    return refuse2("missing-container-image", "no container image was recorded, so the measurement would name a stand-in rather than the environment the suite actually ran in");
+    return refuse3("missing-container-image", "no container image was recorded, so the measurement would name a stand-in rather than the environment the suite actually ran in");
   }
   if (patched.containerImageDigest == null || patched.containerImageDigest === "") {
-    return refuse2("missing-image-digest", "no image digest was recorded for the patched half, so the measurement would name the mutable tag rather than the bytes the suite actually ran in. A run without the digest is recordable but not attestable \u2014 the `missing-patch-digest` split.");
+    return refuse3("missing-image-digest", "no image digest was recorded for the patched half, so the measurement would name the mutable tag rather than the bytes the suite actually ran in. A run without the digest is recordable but not attestable \u2014 the `missing-patch-digest` split.");
   }
   if (typeof patched.containerImageDigest !== "string" || !isCanonicalRepoDigest(patched.containerImageDigest)) {
-    return refuse2("malformed-image-digest", `the patched half carries ${JSON.stringify(patched.containerImageDigest).slice(0, 120)} where a RepoDigest (\`repo@sha256:<64 hex>\`) belongs. A tag or a stand-in string here would be signed as if it were content-addressed, which is the lie the digest axis exists to refuse.`);
+    return refuse3("malformed-image-digest", `the patched half carries ${JSON.stringify(patched.containerImageDigest).slice(0, 120)} where a RepoDigest (\`repo@sha256:<64 hex>\`) belongs. A tag or a stand-in string here would be signed as if it were content-addressed, which is the lie the digest axis exists to refuse.`);
   }
   if (imageRepo(patched.containerImageDigest) !== imageRepo(patched.containerImage)) {
-    return refuse2("image-digest-repo-mismatch", `the patched half's digest names repository ${imageRepo(patched.containerImageDigest)} but the pair ran ${patched.containerImage}. An image can carry digests for several repositories; signing one the pair did not name would attribute these bytes to a different name.`);
+    return refuse3("image-digest-repo-mismatch", `the patched half's digest names repository ${imageRepo(patched.containerImageDigest)} but the pair ran ${patched.containerImage}. An image can carry digests for several repositories; signing one the pair did not name would attribute these bytes to a different name.`);
   }
   if (baseline.containerImageDigest == null || baseline.containerImageDigest === "") {
-    return refuse2("missing-image-digest", "no image digest was recorded for the baseline half, so the measurement would name the mutable tag rather than the bytes the suite actually ran in. A run without the digest is recordable but not attestable \u2014 the `missing-patch-digest` split.");
+    return refuse3("missing-image-digest", "no image digest was recorded for the baseline half, so the measurement would name the mutable tag rather than the bytes the suite actually ran in. A run without the digest is recordable but not attestable \u2014 the `missing-patch-digest` split.");
   }
   if (typeof baseline.containerImageDigest !== "string" || !isCanonicalRepoDigest(baseline.containerImageDigest)) {
-    return refuse2("malformed-image-digest", `the baseline half carries ${JSON.stringify(baseline.containerImageDigest).slice(0, 120)} where a RepoDigest (\`repo@sha256:<64 hex>\`) belongs. A tag or a stand-in string here would be signed as if it were content-addressed, which is the lie the digest axis exists to refuse.`);
+    return refuse3("malformed-image-digest", `the baseline half carries ${JSON.stringify(baseline.containerImageDigest).slice(0, 120)} where a RepoDigest (\`repo@sha256:<64 hex>\`) belongs. A tag or a stand-in string here would be signed as if it were content-addressed, which is the lie the digest axis exists to refuse.`);
   }
   if (imageRepo(baseline.containerImageDigest) !== imageRepo(patched.containerImage)) {
-    return refuse2("image-digest-repo-mismatch", `the baseline half's digest names repository ${imageRepo(baseline.containerImageDigest)} but the pair ran ${patched.containerImage}. An image can carry digests for several repositories; signing one the pair did not name would attribute these bytes to a different name.`);
+    return refuse3("image-digest-repo-mismatch", `the baseline half's digest names repository ${imageRepo(baseline.containerImageDigest)} but the pair ran ${patched.containerImage}. An image can carry digests for several repositories; signing one the pair did not name would attribute these bytes to a different name.`);
   }
   if (baseline.containerImageDigest !== patched.containerImageDigest) {
-    return refuse2("pair-disagrees-on-image-digest", `baseline ran image digest ${String(baseline.containerImageDigest)} and patched ${String(patched.containerImageDigest)} under one tag. The tag agreeing is the trap: a re-pointed tag is two environments wearing one name.`);
+    return refuse3("pair-disagrees-on-image-digest", `baseline ran image digest ${String(baseline.containerImageDigest)} and patched ${String(patched.containerImageDigest)} under one tag. The tag agreeing is the trap: a re-pointed tag is two environments wearing one name.`);
   }
   const claimedDigest = imageDigestOf(patched.containerImage);
   if (claimedDigest !== null && claimedDigest !== imageDigestOf(patched.containerImageDigest)) {
-    return refuse2("image-digest-contradicts-image", `the pair ran ${patched.containerImage}, whose reference pins digest ${claimedDigest}, but the digest field says ${String(imageDigestOf(patched.containerImageDigest))}. A measurement must not sign one digest while the record names another.`);
+    return refuse3("image-digest-contradicts-image", `the pair ran ${patched.containerImage}, whose reference pins digest ${claimedDigest}, but the digest field says ${String(imageDigestOf(patched.containerImageDigest))}. A measurement must not sign one digest while the record names another.`);
   }
   return {
     ok: true,
@@ -3010,7 +3223,7 @@ function toAcceptancePredicate(pair, opts = {}) {
       // RepoDigest (`repo@sha256:…`) carries the repo name and the content hash, and the
       // tag it drops is the part a registry can re-point (TERM-893).
       enclave_measurement: localMeasurement(patched.containerImageDigest),
-      nonce: opts.nonce ?? randomBytes4(16).toString("hex"),
+      nonce: opts.nonce ?? randomBytes5(16).toString("hex"),
       run_policy: { max_attempts: opts.maxAttempts ?? 1, budget_outcome: budget }
     }
   };
@@ -3019,7 +3232,7 @@ function signRunStatement(predicate, privateKey, keyid) {
   const statement = createAcceptanceStatement(predicate);
   return { statement, envelope: signStatement(statement, privateKey, keyid) };
 }
-var OUTCOME_TO_BUDGET, BASELINE_IS_A_VERDICT, CONTRADICTS_COUNTS, SOURCE_IS_SIGNABLE, ATTEST_REFUSAL_REASONS, refuse2, LOCAL_MEASUREMENT_PREFIX, REFERENCE_DOMAIN_COMPONENT, REFERENCE_DOMAIN_NAME, REFERENCE_IPV6, REFERENCE_DOMAIN, REFERENCE_PATH_COMPONENT, REPO_DIGEST_RE;
+var OUTCOME_TO_BUDGET, BASELINE_IS_A_VERDICT, CONTRADICTS_COUNTS, SOURCE_IS_SIGNABLE, ATTEST_REFUSAL_REASONS, refuse3, LOCAL_MEASUREMENT_PREFIX, REFERENCE_DOMAIN_COMPONENT, REFERENCE_DOMAIN_NAME, REFERENCE_IPV6, REFERENCE_DOMAIN, REFERENCE_PATH_COMPONENT, REPO_DIGEST_RE;
 var init_attestation2 = __esm({
   "../../packages/envrun/dist/attestation.js"() {
     "use strict";
@@ -3123,7 +3336,7 @@ var init_attestation2 = __esm({
       "outcome-contradicts-counts",
       "test-command-origin-unattested"
     ];
-    refuse2 = (reason, detail) => ({
+    refuse3 = (reason, detail) => ({
       ok: false,
       reason,
       detail
@@ -3506,6 +3719,73 @@ var init_boundary = __esm({
 });
 
 // ../../packages/envrun/dist/gcpPlacement.js
+function assertWorkloadImage(fn, value) {
+  if (typeof value !== "string" || !WORKLOAD_IMAGE_REFERENCE.test(value)) {
+    throw new GcpPlacementError(`${fn}: the workload image is missing or is not one plain image reference (${String(WORKLOAD_IMAGE_REFERENCE)}). It lands inside a comma-separated --metadata= list, so anything that could start a second key is refused.`);
+  }
+}
+function venueImageFromEnv(env) {
+  const image = env["VENUE_IMAGE"] ?? "";
+  if (image === "" || image === "cos-stable")
+    return { venueImage: "cos-stable" };
+  if (image !== "confidential-space") {
+    throw new GcpPlacementError("VENUE_IMAGE is set to something other than cos-stable or confidential-space. An unknown value is refused rather than booted as the default.");
+  }
+  const workloadImage = env["VENUE_WORKLOAD_IMAGE"] ?? "";
+  if (workloadImage === "") {
+    throw new GcpPlacementError("VENUE_IMAGE=confidential-space needs VENUE_WORKLOAD_IMAGE, the image reference the Confidential Space launcher runs. Nothing boots without one.");
+  }
+  assertWorkloadImage("venueImageFromEnv", workloadImage);
+  return { venueImage: "confidential-space", workloadImage };
+}
+function bootImageFlags(p) {
+  const image = p.venueImage ?? "cos-stable";
+  if (image === "cos-stable")
+    return ["--image-family=cos-stable", "--image-project=cos-cloud"];
+  if (image !== "confidential-space") {
+    throw new GcpPlacementError("gcpBootArgv: venueImage is not one of cos-stable, confidential-space. An unknown image is refused rather than booted as the default.");
+  }
+  const workloadImage = p.workloadImage;
+  assertWorkloadImage("gcpBootArgv", workloadImage);
+  const clientCert = p.clientCert;
+  if (typeof clientCert !== "string" || !CLIENT_CERT_BASE64URL.test(clientCert)) {
+    throw new GcpPlacementError(`gcpBootArgv: the client certificate is missing or is not one base64url value (${String(CLIENT_CERT_BASE64URL)}). It lands inside the --metadata value, so anything that could start a second key is refused.`);
+  }
+  if (p.runId.length < MIN_NONCE_BYTES) {
+    throw new GcpPlacementError(`gcpBootArgv: a Confidential Space run id must be at least ${String(MIN_NONCE_BYTES)} characters, because it is the attestation token's nonce and the launcher refuses a shorter one. Refused here, before a VM is billed for a token it cannot mint.`);
+  }
+  const metadata = [
+    `tee-image-reference=${workloadImage}`,
+    "tee-container-log-redirect=true",
+    'tee-added-capabilities=["CAP_SYS_ADMIN","CAP_NET_ADMIN"]',
+    "tee-cgroup-ns=true",
+    `tee-env-TH_AUDIENCE=${expectedAudience(p.runId)}`,
+    `tee-env-TH_NONCE=${p.runId}`,
+    `tee-env-TH_CLIENT_CERT=${clientCert}`
+  ];
+  return [
+    // The production family. The debug family reports `dbgstat: enabled`, which the
+    // intake's verifier refuses, so a debug boot could never produce a run we record.
+    "--image-family=confidential-space",
+    "--image-project=confidential-space-images",
+    "--confidential-compute-type=SEV",
+    // The deploy-workloads page says N2D with SEV may set MIGRATE for live migration,
+    // and every other machine type needs TERMINATE. The spec chose TERMINATE: a
+    // maintenance event ends the VM instead of moving it, which for a VM that lives at
+    // most GCP_MAX_RUN_DURATION_SECONDS costs one run. Whether GCE boots this exact
+    // combination is phase 5's measurement.
+    "--maintenance-policy=TERMINATE",
+    `--metadata=^;^${metadata.join(";")}`,
+    // What the standing firewall rule for IAP's range matches, so the tunnels to the
+    // workload's dockerd and attest ports open on these VMs and no others.
+    "--tags=th-cs-venue",
+    // The family's 11 GB default leaves the workload a 7.7 GB root, and dockerd there
+    // runs vfs, which copies every layer and every container's rootfs in full. Pulling
+    // node:20-bookworm left 992 MB, and the next container create failed ENOSPC
+    // (measured, TERM-1094). COS runs overlay2 on its own disk and keeps the default.
+    "--boot-disk-size=50GB"
+  ];
+}
 function assertInstanceIdentity(fn, id) {
   const fields = [
     ["vmName", id.vmName, GCE_INSTANCE_NAME],
@@ -3531,8 +3811,8 @@ function gcpBootArgv(p) {
     `--project=${p.project}`,
     `--zone=${p.zone}`,
     `--machine-type=${p.machineType}`,
-    "--image-family=cos-stable",
-    "--image-project=cos-cloud",
+    // What the VM boots, and the one part of this argv the two images do not share.
+    ...bootImageFlags(p),
     // ── THE OUTER REAP. This, not the `finally` below, is what bounds the bill. ──
     //
     // An in-process `finally` is a best effort, not a reap. SIGKILL, a crashed
@@ -3577,7 +3857,13 @@ function gcpBootArgv(p) {
     // expectation uses (TERM-832): two inline spellings of one value is how
     // the boot path and the verifier drift apart silently.
     `--service-account=${venueIdentityEmail(p.project)}`,
-    "--no-scopes",
+    // A Confidential Space VM takes `cloud-platform` instead (TERM-1094): the launcher
+    // pulls the workload image and mints the attestation token with this account, and
+    // under `--no-scopes` it can do neither. What bounds a lifted token there is the
+    // account's two grants — `confidentialcomputing.workloadUser` and a reader on the
+    // one venue image repository — plus point 2 above, which is unchanged: the fence
+    // still denies untrusted code the metadata server.
+    ...p.venueImage === "confidential-space" ? ["--scopes=cloud-platform"] : ["--no-scopes"],
     "--shielded-secure-boot",
     "--shielded-vtpm",
     "--shielded-integrity-monitoring",
@@ -3610,7 +3896,7 @@ function gcpDeleteArgv(p) {
     "--quiet"
   ];
 }
-var DEFAULT_GCP_PROJECT, DEFAULT_GCP_ZONE, DEFAULT_GCP_MACHINE_TYPE, GcpPlacementError, GCP_MAX_RUN_DURATION_SECONDS, GCP_MANAGED_LABEL_KEY, GCP_RUN_LABEL_KEY, GCP_LABEL_VALUE, GCE_INSTANCE_NAME, GCP_RESOURCE_ID;
+var DEFAULT_GCP_PROJECT, DEFAULT_GCP_ZONE, DEFAULT_GCP_MACHINE_TYPE, GcpPlacementError, GCP_MAX_RUN_DURATION_SECONDS, GCP_MANAGED_LABEL_KEY, GCP_RUN_LABEL_KEY, CONFIDENTIAL_SPACE_MACHINE_TYPE, WORKLOAD_IMAGE_REFERENCE, CLIENT_CERT_BASE64URL, MIN_NONCE_BYTES, GCP_LABEL_VALUE, GCE_INSTANCE_NAME, GCP_RESOURCE_ID;
 var init_gcpPlacement = __esm({
   "../../packages/envrun/dist/gcpPlacement.js"() {
     "use strict";
@@ -3627,6 +3913,10 @@ var init_gcpPlacement = __esm({
     GCP_MAX_RUN_DURATION_SECONDS = 3600;
     GCP_MANAGED_LABEL_KEY = "th-managed";
     GCP_RUN_LABEL_KEY = "th-run";
+    CONFIDENTIAL_SPACE_MACHINE_TYPE = "n2d-standard-2";
+    WORKLOAD_IMAGE_REFERENCE = /^[A-Za-z0-9][A-Za-z0-9._/:@-]{0,511}$/;
+    CLIENT_CERT_BASE64URL = /^[A-Za-z0-9_-]{16,8192}$/;
+    MIN_NONCE_BYTES = 10;
     GCP_LABEL_VALUE = /^[a-z0-9_-]{1,63}$/;
     GCE_INSTANCE_NAME = /^[a-z](?:[-a-z0-9]{0,61}[a-z0-9])?$/;
     GCP_RESOURCE_ID = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
@@ -3634,25 +3924,25 @@ var init_gcpPlacement = __esm({
 });
 
 // ../../packages/envrun/dist/emptyGitConfig.js
-import { mkdtempSync as mkdtempSync2, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
+import { mkdtempSync as mkdtempSync2, rmSync as rmSync3, writeFileSync as writeFileSync5 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 function emptyGitConfig() {
   if (emptyGitConfigFile !== void 0)
     return emptyGitConfigFile;
   let dir;
   let file;
   try {
-    dir = mkdtempSync2(join9(tmpdir2(), "th-run-nogitconfig-"));
-    file = join9(dir, "config");
-    writeFileSync4(file, "", { mode: 384 });
+    dir = mkdtempSync2(join10(tmpdir2(), "th-run-nogitconfig-"));
+    file = join10(dir, "config");
+    writeFileSync5(file, "", { mode: 384 });
   } catch (err) {
     throw new RunRefusalError("could not create the empty git config this run points GIT_CONFIG_GLOBAL and GIT_CONFIG_SYSTEM at, so git would read the configuration \u2014 and the credential helpers \u2014 on this machine instead. That is our environment failing, not your tests: check that the temp directory is writable.", { cause: err });
   }
   emptyGitConfigFile = file;
   process.once("exit", () => {
     try {
-      rmSync2(dir, { recursive: true, force: true });
+      rmSync3(dir, { recursive: true, force: true });
     } catch {
     }
   });
@@ -3668,8 +3958,11 @@ var init_emptyGitConfig = __esm({
 
 // ../../packages/envrun/dist/hostedVenue.js
 import { spawn as spawn3, spawnSync as spawnSync5 } from "child_process";
-import { chmodSync as chmodSync2, existsSync as existsSync5, mkdtempSync as mkdtempSync3, readFileSync as readFileSync3, rmSync as rmSync3 } from "fs";
-import { join as join10 } from "path";
+import { createHash as createHash4, X509Certificate } from "crypto";
+import { chmodSync as chmodSync2, existsSync as existsSync6, mkdtempSync as mkdtempSync3, readFileSync as readFileSync4, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "fs";
+import { request as httpsRequest } from "https";
+import { createServer } from "net";
+import { join as join11 } from "path";
 import { tmpdir as tmpdir3 } from "os";
 function credentialInGitConfig(text) {
   for (const match of text.matchAll(/\b([a-z][a-z0-9+.-]*):\/\/(\S+)/gi)) {
@@ -3706,19 +3999,19 @@ function decodeMaybe(url) {
 }
 function dispatchedGitBinary() {
   for (const candidate of DISPATCHED_GIT_CANDIDATES) {
-    if (existsSync5(candidate))
+    if (existsSync6(candidate))
       return candidate;
   }
   return "git";
 }
 function dispatchedProbeEnv(cloneDir, base) {
-  const gitDir = join10(cloneDir, ".git");
+  const gitDir = join11(cloneDir, ".git");
   return {
     ...base,
     GIT_DIR: gitDir,
     GIT_WORK_TREE: cloneDir,
-    GIT_INDEX_FILE: join10(gitDir, "index"),
-    GIT_OBJECT_DIRECTORY: join10(gitDir, "objects"),
+    GIT_INDEX_FILE: join11(gitDir, "index"),
+    GIT_OBJECT_DIRECTORY: join11(gitDir, "objects"),
     GIT_ALTERNATE_OBJECT_DIRECTORIES: "",
     GIT_COMMON_DIR: gitDir,
     GIT_NAMESPACE: "",
@@ -3870,6 +4163,89 @@ timed out after ${String(timeoutMs)}ms` : stderr,
     });
   });
 }
+function socketErrorReason(err) {
+  if (err.message !== "")
+    return err.message;
+  const code = err.code;
+  if (code !== void 0)
+    return code;
+  const inner = err.errors;
+  if (Array.isArray(inner) && inner[0] instanceof Error && inner[0].message !== "") {
+    return inner[0].message;
+  }
+  return err.name;
+}
+function fetchAttestationOverTls(req) {
+  return new Promise((resolve2) => {
+    let whole;
+    const settle = (reading) => {
+      if (whole !== void 0)
+        clearTimeout(whole);
+      resolve2(reading);
+    };
+    let cert;
+    let key;
+    try {
+      cert = readFileSync4(req.certPath);
+      key = readFileSync4(req.keyPath);
+    } catch (err) {
+      settle({ ok: false, reason: `the client key could not be read: ${describeErr(err)}` });
+      return;
+    }
+    const call = httpsRequest({
+      host: "localhost",
+      port: req.port,
+      path: "/attest",
+      method: "GET",
+      servername: "localhost",
+      cert,
+      key,
+      rejectUnauthorized: false,
+      agent: false,
+      timeout: req.timeoutMs
+    }, (res) => {
+      const peer = res.socket.getPeerCertificate();
+      let body = "";
+      res.setEncoding("utf8");
+      res.on("data", (chunk) => {
+        body += chunk;
+        if (body.length > MAX_TOKEN_LENGTH) {
+          settle({ ok: false, reason: "the answer is longer than any attestation token" });
+          res.destroy();
+        }
+      });
+      res.on("end", () => {
+        if (res.statusCode !== 200) {
+          settle({
+            ok: false,
+            reason: `the attest endpoint answered HTTP ${String(res.statusCode)}`
+          });
+          return;
+        }
+        const raw = peer.raw;
+        if (raw === void 0 || raw.length === 0) {
+          settle({ ok: false, reason: "the attest endpoint presented no certificate" });
+          return;
+        }
+        settle({ ok: true, token: body.trim(), peerCertDer: new Uint8Array(raw) });
+      });
+      res.on("error", (err) => {
+        settle({ ok: false, reason: socketErrorReason(err) });
+      });
+    });
+    whole = setTimeout(() => {
+      settle({ ok: false, reason: `no complete answer within ${String(req.timeoutMs)}ms` });
+      call.destroy();
+    }, req.timeoutMs);
+    call.on("timeout", () => {
+      call.destroy(new Error(`no answer within ${String(req.timeoutMs)}ms`));
+    });
+    call.on("error", (err) => {
+      settle({ ok: false, reason: socketErrorReason(err) });
+    });
+    call.end();
+  });
+}
 function quoteForRemoteShell(arg) {
   return `'${arg.replace(/'/g, "'\\''")}'`;
 }
@@ -4204,25 +4580,370 @@ ${res.stderr}`);
 function manualDeleteCommand(vm, project, zone) {
   return `gcloud compute instances delete ${vm} --project=${project} --zone=${zone} --quiet`;
 }
+function clientCertArgv(keyPath, certPath) {
+  return [
+    "req",
+    "-x509",
+    "-newkey",
+    "ec",
+    "-pkeyopt",
+    "ec_paramgen_curve:P-256",
+    "-nodes",
+    "-keyout",
+    keyPath,
+    "-out",
+    certPath,
+    "-subj",
+    "/CN=terminalhire-worker",
+    "-days",
+    "1",
+    "-addext",
+    "extendedKeyUsage=clientAuth"
+  ];
+}
+function iapPortTunnelArgv(vm, project, zone, remotePort, localPort) {
+  return [
+    "compute",
+    "start-iap-tunnel",
+    vm,
+    String(remotePort),
+    `--local-host-port=localhost:${String(localPort)}`,
+    `--project=${project}`,
+    `--zone=${zone}`,
+    "--iap-tunnel-disable-connection-check"
+  ];
+}
+function spkiSha256Hex(certDer) {
+  const spki = new X509Certificate(certDer).publicKey.export({ type: "spki", format: "der" });
+  return createHash4("sha256").update(spki).digest("hex");
+}
+function certMetadataValue(pem) {
+  return new X509Certificate(pem).raw.toString("base64url");
+}
+function requireWorkloadDigest(reference) {
+  const named = /@(sha256:[0-9a-f]{64})$/.exec(reference);
+  if (named === null) {
+    throw new GcpPlacementError("VENUE_WORKLOAD_IMAGE must name its image by digest (\u2026@sha256:<64 hex>) for a Confidential Space venue: the attestation is checked against that digest, and a tag names whatever was pushed last.");
+  }
+  return named[1];
+}
+function underStageRoot(path) {
+  if (!path.startsWith(`${CS_STAGE_ROOT}/`)) {
+    throw new Error(`${path} is outside ${CS_STAGE_ROOT}, the only directory the stage helpers mount`);
+  }
+  return path;
+}
+function userFlag(owner) {
+  return `--user=${String(owner.uid)}:${String(owner.gid)}`;
+}
+function csStagePrepareArgv(stageBase, owner) {
+  const dirs = Object.values(venueStagePaths(underStageRoot(stageBase))).map(quoteForRemoteShell);
+  return [
+    "run",
+    "--rm",
+    "--network=none",
+    `--volume=${CS_STAGE_ROOT}:${CS_STAGE_ROOT}:rw`,
+    "--",
+    STAGE_HELPER_IMAGE,
+    "sh",
+    "-c",
+    `mkdir -p ${dirs.join(" ")} && chown -R ${String(owner.uid)}:${String(owner.gid)} ` + quoteForRemoteShell(stageBase)
+  ];
+}
+function csUntarArgv(dir, owner) {
+  return [
+    "run",
+    "-i",
+    "--rm",
+    "--network=none",
+    userFlag(owner),
+    `--volume=${underStageRoot(dir)}:/dst:rw`,
+    "--",
+    STAGE_HELPER_IMAGE,
+    "tar",
+    "-xf",
+    "-",
+    "-C",
+    "/dst"
+  ];
+}
+function csUntarProxyArgv(dir, owner) {
+  const d = quoteForRemoteShell(underStageRoot(dir));
+  return [
+    "run",
+    "-i",
+    "--rm",
+    "--network=none",
+    userFlag(owner),
+    `--volume=${CS_STAGE_ROOT}:${CS_STAGE_ROOT}:rw`,
+    "--",
+    STAGE_HELPER_IMAGE,
+    "sh",
+    "-c",
+    `mkdir -p ${d} && tar -C ${d} -xf - && chmod 0644 ${d}/*.js && chmod 0755 ${d}`
+  ];
+}
+function csRemoveArgv(dir, owner) {
+  return [
+    "run",
+    "--rm",
+    "--network=none",
+    userFlag(owner),
+    `--volume=${CS_STAGE_ROOT}:${CS_STAGE_ROOT}:rw`,
+    "--",
+    STAGE_HELPER_IMAGE,
+    "rm",
+    "-rf",
+    "--",
+    underStageRoot(dir)
+  ];
+}
+function sshStageTransport(vm, project, zone, env, io) {
+  return {
+    /**
+     * `id -u` / `id -g` on the venue, as the account that untarred the tree.
+     *
+     * That account is the owner BY CONSTRUCTION — the untar runs as the ssh user,
+     * so asking it who it is answers exactly the question the mount needs, without
+     * a chown and without assuming a uid. One ssh round trip, once per run.
+     *
+     * Both ids come from ONE invocation. Two calls could straddle a reconnect and
+     * pair a uid with another session's gid — a third wrong answer rather than a
+     * half-right one, which is the reason `GuestUser` is a pair in the first place.
+     */
+    readOwner: () => {
+      const res = io.exec(
+        "gcloud",
+        iapSshArgv(vm, project, zone, "id -u && id -g"),
+        OWNER_PROBE_TIMEOUT_MS,
+        // `env`, like every other gcloud call here. TERM-724 made the venue boot under the
+        // SERVICE configuration rather than whoever is at the terminal, and a probe that
+        // omitted this would ssh under the person's own credential — then report an owner
+        // measured against a session the run does not use.
+        env
+      );
+      if (!res.ok) {
+        throw new HostedVenueError(`could not read the staged tree's owner on ${vm}: ${execDetail(res).slice(0, 300)}. Refusing rather than falling back to this machine\u2019s uid, which would hand the guest an id with no write access to its own clone.`);
+      }
+      const lines = res.stdout.split("\n").map((l) => l.trim()).filter((l) => l.length > 0);
+      const ids2 = lines.slice(-2).map((l) => Number(l));
+      if (ids2.length !== 2 || !ids2.every((n) => Number.isInteger(n) && n > 0)) {
+        throw new HostedVenueError(`the venue ${vm} answered 'id -u && id -g' with ${JSON.stringify(res.stdout.slice(0, 120))}, which is not a uid/gid pair. Refusing rather than guessing an owner.`);
+      }
+      return { uid: ids2[0], gid: ids2[1] };
+    },
+    push: (from, to) => io.pushTree(from, "gcloud", iapUntarArgv(vm, project, zone, to), STAGE_PUSH_TIMEOUT_MS, env),
+    pushProxy: (from, dir) => io.pushTree(from, "gcloud", iapUntarProxyArgv(vm, project, zone, dir), STAGE_PUSH_TIMEOUT_MS, env),
+    removeProxy: (dir) => {
+      io.exec("gcloud", iapSshArgv(vm, project, zone, `rm -rf ${quoteForRemoteShell(dir)}`), PROXY_CLEANUP_TIMEOUT_MS, env);
+    }
+  };
+}
+function dockerStageTransport(docker3, env, io) {
+  const pushVia = (from, args) => {
+    const [file, ...rest] = docker3.commandLine(args);
+    if (file === void 0)
+      throw new Error("the docker client returned an empty command line");
+    return io.pushTree(from, file, rest, STAGE_PUSH_TIMEOUT_MS, env);
+  };
+  return {
+    // Fixed rather than probed: the helpers unpack as this account, so it owns the tree.
+    readOwner: () => CS_GUEST_USER,
+    push: (from, to) => pushVia(from, csUntarArgv(to, CS_GUEST_USER)),
+    pushProxy: (from, dir) => pushVia(from, csUntarProxyArgv(dir, CS_GUEST_USER)),
+    removeProxy: (dir) => {
+      docker3.sync(csRemoveArgv(dir, CS_GUEST_USER), { timeoutMs: PROXY_CLEANUP_TIMEOUT_MS });
+    }
+  };
+}
+function bothTunnels(a, b) {
+  return {
+    kill: (signal) => {
+      let failed = false;
+      let error;
+      for (const t of [a, b]) {
+        try {
+          t.kill(signal);
+        } catch (err) {
+          if (!failed)
+            error = err;
+          failed = true;
+        }
+      }
+      if (failed)
+        throw error;
+    },
+    failure: () => a.failure() ?? b.failure()
+  };
+}
+function makeClientTls(io, allocated, vm) {
+  let dir;
+  try {
+    dir = io.makePrivateDir();
+  } catch (err) {
+    throw new HostedVenueError(`could not create a private directory for ${vm}'s client key: ${describeErr(err)}`, "ours");
+  }
+  allocated.onRollback(() => {
+    try {
+      io.removeTree(dir);
+    } catch (err) {
+      throw new HostedVenueError(`the directory ${dir} holding ${vm}'s client key could not be removed and is left behind: ${describeErr(err)}`);
+    }
+  });
+  const certPath = join11(dir, "client.pem");
+  const keyPath = join11(dir, "client-key.pem");
+  const made = io.exec("openssl", clientCertArgv(keyPath, certPath), OPENSSL_TIMEOUT_MS, {});
+  if (!made.ok) {
+    throw new HostedVenueError(`could not make ${vm}'s client certificate with openssl: ${execDetail(made).slice(0, 300)}`, "ours");
+  }
+  let metadataValue;
+  try {
+    const pem = io.readTextIfPresent(certPath);
+    if (pem === null)
+      throw new Error(`openssl wrote nothing to ${certPath}`);
+    metadataValue = certMetadataValue(pem);
+  } catch (err) {
+    throw new HostedVenueError(`could not read back ${vm}'s client certificate: ${describeErr(err)}`, "ours");
+  }
+  return { dir, certPath, keyPath, metadataValue };
+}
+async function reachConfidentialSpace(a) {
+  const { io, vm } = a;
+  let ports;
+  try {
+    ports = await io.freeLocalPorts(2);
+  } catch (err) {
+    throw new HostedVenueError(`could not find two free local ports for ${vm}'s forwards: ${describeErr(err)}`, "ours");
+  }
+  const [attestPort, dockerPort] = ports;
+  if (attestPort === void 0 || dockerPort === void 0 || attestPort === dockerPort) {
+    throw new HostedVenueError(`could not find two distinct free local ports for ${vm}'s forwards`, "ours");
+  }
+  const forward = (remote, local) => {
+    const t = io.spawnTunnel("gcloud", iapPortTunnelArgv(vm, a.project, a.zone, remote, local), a.env);
+    a.allocated.onRollback(() => {
+      try {
+        t.kill("SIGTERM");
+      } catch {
+      }
+    });
+    return t;
+  };
+  const tunnel = bothTunnels(forward(CS_ATTEST_PORT, attestPort), forward(CS_DOCKER_PORT, dockerPort));
+  const deadline = io.now() + CS_READY_BUDGET_MS;
+  let reading = { ok: false, reason: "no request was made" };
+  while (io.now() < deadline) {
+    const dead = tunnel.failure();
+    if (dead !== null) {
+      throw new HostedVenueError(`the IAP port forward to ${vm} could not be kept up \u2014 ${dead}`);
+    }
+    reading = await io.fetchAttestation({
+      port: attestPort,
+      certPath: a.tls.certPath,
+      keyPath: a.tls.keyPath,
+      timeoutMs: CS_ATTEST_TIMEOUT_MS
+    });
+    if (reading.ok)
+      break;
+    await io.sleep(CS_ATTEST_INTERVAL_MS);
+  }
+  if (!reading.ok) {
+    throw new HostedVenueError(`${vm}'s attest endpoint did not answer within ${String(CS_READY_BUDGET_MS / 1e3)}s \u2014 last reason: ${reading.reason}`);
+  }
+  let spki;
+  let venuePem;
+  try {
+    spki = spkiSha256Hex(reading.peerCertDer);
+    venuePem = new X509Certificate(reading.peerCertDer).toString();
+  } catch (err) {
+    throw new HostedVenueError(`${vm}'s attest endpoint presented a certificate that does not parse: ${describeErr(err)}`);
+  }
+  let jwks;
+  try {
+    jwks = await io.fetchConfidentialSpaceJwks();
+  } catch (err) {
+    throw new HostedVenueError(`could not reach the Confidential Space key set to check ${vm}'s attestation \u2014 ` + describeErr(err), "ours", { cause: err });
+  }
+  const verdict = await verifyConfidentialSpaceToken(reading.token, {
+    audience: expectedAudience(a.runId),
+    nonce: a.runId,
+    additionalNonces: [spki],
+    instanceName: vm,
+    allowedZones: [a.zone],
+    projectId: a.project,
+    allowedImageDigests: [a.imageDigest],
+    containerEnv: { TH_CLIENT_CERT: a.tls.metadataValue }
+  }, { fetchJwks: () => Promise.resolve(jwks), now: io.now() });
+  if (!verdict.ok) {
+    throw new HostedVenueError(`${vm} presented an attestation this lease refuses (${verdict.reason}): ${verdict.detail}`);
+  }
+  const caPath = join11(a.tls.dir, "venue.pem");
+  try {
+    io.writeFile(caPath, venuePem);
+  } catch (err) {
+    throw new HostedVenueError(`could not write ${vm}'s attested certificate to ${caPath}: ${describeErr(err)}`, "ours");
+  }
+  const dockerAt = `tcp://localhost:${String(dockerPort)}`;
+  const docker3 = io.dockerOverTls(dockerAt, { caPath, certPath: a.tls.certPath, keyPath: a.tls.keyPath }, CS_RUN_ARGS);
+  const daemon = io.classifyDaemon(docker3);
+  if (!daemon.distinct) {
+    throw new HostedVenueError(`refusing to hand out a hosted lease: ${describeVenueDaemon(daemon)}`);
+  }
+  const prepared = docker3.sync(csStagePrepareArgv(a.stageBase, CS_GUEST_USER), {
+    timeoutMs: MKDIR_TIMEOUT_MS
+  });
+  if (prepared.error || prepared.status !== 0) {
+    throw new HostedVenueError(`could not prepare the stage on ${vm}: ${dockerDetail(prepared).slice(0, 300)}`);
+  }
+  const pulled = docker3.sync(["pull", DEFAULT_CONTAINER_IMAGE], { timeoutMs: CS_PULL_TIMEOUT_MS });
+  if (pulled.error || pulled.status !== 0) {
+    throw new HostedVenueError(`could not pull ${DEFAULT_CONTAINER_IMAGE} on ${vm}: ${dockerDetail(pulled).slice(0, 300)}`);
+  }
+  return {
+    docker: docker3,
+    tunnel,
+    socketDir: a.tls.dir,
+    socketPath: dockerAt,
+    venueDaemonId: daemon.venueDaemonId,
+    venueIdentity: { kind: "confidential-space", token: reading.token, claims: verdict.value },
+    transport: dockerStageTransport(docker3, a.env, io)
+  };
+}
 function hostedVenue(opts = {}, io = defaultHostedVenueIo) {
   const project = opts.project ?? DEFAULT_GCP_PROJECT;
   const zone = opts.zone ?? DEFAULT_GCP_ZONE;
   const gcloudConfig = opts.gcloudConfig ?? VENUE_GCLOUD_CONFIG;
   const keyFile = resolveServiceAccountKeyFile(opts);
+  const image = venueImageFromEnv(process.env);
+  const csImageDigest = image.venueImage === "confidential-space" ? requireWorkloadDigest(image.workloadImage) : null;
   const env = venueGcloudEnv(gcloudConfig);
   return {
     kind: "hosted-pool",
     acquire: (runId) => acquireTransactionally(async (allocated) => {
       const vm = venueInstanceName(runId);
       const stageBase = `/tmp/th-stage-${runId}`;
-      const bootArgv = gcpBootArgv({
+      const bootParams = (clientCert) => image.venueImage === "confidential-space" ? {
         vmName: vm,
         project,
         zone,
         runId,
-        machineType: opts.machineType ?? DEFAULT_GCP_MACHINE_TYPE
-      });
+        machineType: opts.machineType ?? CONFIDENTIAL_SPACE_MACHINE_TYPE,
+        venueImage: "confidential-space",
+        workloadImage: image.workloadImage,
+        clientCert
+      } : {
+        vmName: vm,
+        project,
+        zone,
+        runId,
+        machineType: opts.machineType ?? DEFAULT_GCP_MACHINE_TYPE,
+        ...image
+      };
+      let bootArgv = gcpBootArgv(bootParams(CLIENT_CERT_STAND_IN));
       ensureVenueServiceCredentials(gcloudConfig, keyFile, io);
+      const clientTls = csImageDigest === null ? null : { ...makeClientTls(io, allocated, vm), imageDigest: csImageDigest };
+      if (clientTls !== null)
+        bootArgv = gcpBootArgv(bootParams(clientTls.metadataValue));
       const boot = io.exec("gcloud", bootArgv, BOOT_TIMEOUT_MS, env);
       let instanceState = "unknown";
       allocated.onRollback(() => {
@@ -4238,6 +4959,20 @@ function hostedVenue(opts = {}, io = defaultHostedVenueIo) {
         throw new HostedVenueError(`could not boot ${vm}: ${verdict2.reason.slice(0, 400)}`, verdict2.source);
       }
       instanceState = "exists";
+      if (clientTls !== null) {
+        return finishAcquire(await reachConfidentialSpace({
+          vm,
+          project,
+          zone,
+          runId,
+          stageBase,
+          env,
+          io,
+          allocated,
+          tls: clientTls,
+          imageDigest: clientTls.imageDigest
+        }));
+      }
       const deadline = io.now() + SSH_READY_BUDGET_MS;
       let last = { retryable: true, reason: "no probe ran" };
       let identity = null;
@@ -4297,7 +5032,7 @@ function hostedVenue(opts = {}, io = defaultHostedVenueIo) {
           throw new HostedVenueError(`the tunnel socket directory ${socketDir} could not be removed and is left behind: ${describeErr(err)}`);
         }
       });
-      const socketPath = join10(socketDir, VENUE_SOCKET_NAME);
+      const socketPath = join11(socketDir, VENUE_SOCKET_NAME);
       if (io.exists(socketPath)) {
         throw new HostedVenueError(`something already exists at ${socketPath}, inside a directory created seconds ago for this run alone. Refusing rather than clearing it: the tunnel would carry the whole run over a path we cannot account for`, "ours");
       }
@@ -4332,43 +5067,56 @@ function hostedVenue(opts = {}, io = defaultHostedVenueIo) {
       if (!prepared.ok) {
         throw new HostedVenueError(`could not prepare the stage on ${vm}: ${execDetail(prepared).slice(0, 300)}`);
       }
-      const stageVolumes = stageVolumeNames(vm);
-      for (const name of [stageVolumes.clone, stageVolumes.jail]) {
-        const created = docker3.sync(volumeCreateArgv(name, runId), {
-          timeoutMs: VOLUME_CREATE_TIMEOUT_MS
-        });
-        if (created.error || created.status !== 0) {
-          throw new HostedVenueError(`could not create the stage volume ${name} on ${vm}: ${dockerDetail(created).slice(0, 300)}`);
-        }
-      }
-      for (const name of [stageVolumes.clone, stageVolumes.jail]) {
-        const probe = docker3.sync(execProbeArgv(name), {
-          timeoutMs: EXEC_PROBE_TIMEOUT_MS
-        });
-        if (probe.error || probe.status !== 0) {
-          throw new HostedVenueError(`${vm} cannot execute a file written to its own Docker volume ${name}, so no install step with a native postinstall could run there. Refusing before staging anything: ${dockerDetail(probe).slice(0, 300)}`);
-        }
-      }
-      const after = io.classifyDaemon(docker3);
-      if (!after.distinct || after.venueDaemonId !== venueDaemonId) {
-        throw new HostedVenueError(`the daemon at ${socketPath} changed while the stage volumes were being created and proved: it now answers as ${after.distinct ? `daemon ${after.venueDaemonId}` : describeVenueDaemon(after)}, not ${venueDaemonId}. Refusing to hand out a lease whose proof was made elsewhere.`);
-      }
-      return makeLease({
-        runId,
-        vm,
-        project,
-        zone,
-        stageBase,
-        stageVolumes,
+      return finishAcquire({
         docker: docker3,
         tunnel,
         socketDir,
         socketPath,
         venueDaemonId,
         venueIdentity,
-        env,
-        io
+        transport: sshStageTransport(vm, project, zone, env, io)
       });
+      function finishAcquire(r) {
+        const { docker: docker4, socketPath: socketPath2, venueDaemonId: venueDaemonId2 } = r;
+        const stageVolumes = stageVolumeNames(vm);
+        for (const name of [stageVolumes.clone, stageVolumes.jail]) {
+          const created = docker4.sync(volumeCreateArgv(name, runId), {
+            timeoutMs: VOLUME_CREATE_TIMEOUT_MS
+          });
+          if (created.error || created.status !== 0) {
+            throw new HostedVenueError(`could not create the stage volume ${name} on ${vm}: ${dockerDetail(created).slice(0, 300)}`);
+          }
+        }
+        for (const name of [stageVolumes.clone, stageVolumes.jail]) {
+          const probe = docker4.sync(execProbeArgv(name), {
+            timeoutMs: EXEC_PROBE_TIMEOUT_MS
+          });
+          if (probe.error || probe.status !== 0) {
+            throw new HostedVenueError(`${vm} cannot execute a file written to its own Docker volume ${name}, so no install step with a native postinstall could run there. Refusing before staging anything: ${dockerDetail(probe).slice(0, 300)}`);
+          }
+        }
+        const after = io.classifyDaemon(docker4);
+        if (!after.distinct || after.venueDaemonId !== venueDaemonId2) {
+          throw new HostedVenueError(`the daemon at ${socketPath2} changed while the stage volumes were being created and proved: it now answers as ${after.distinct ? `daemon ${after.venueDaemonId}` : describeVenueDaemon(after)}, not ${venueDaemonId2}. Refusing to hand out a lease whose proof was made elsewhere.`);
+        }
+        return makeLease({
+          runId,
+          vm,
+          project,
+          zone,
+          stageBase,
+          stageVolumes,
+          docker: docker4,
+          tunnel: r.tunnel,
+          socketDir: r.socketDir,
+          socketPath: socketPath2,
+          venueDaemonId: venueDaemonId2,
+          venueIdentity: r.venueIdentity,
+          transport: r.transport,
+          env,
+          io
+        });
+      }
     })
   };
 }
@@ -4427,28 +5175,7 @@ function makeLease(p) {
     return null;
   };
   let stagedOwner;
-  const readStagedOwner = () => {
-    const res = p.io.exec(
-      "gcloud",
-      iapSshArgv(p.vm, p.project, p.zone, "id -u && id -g"),
-      OWNER_PROBE_TIMEOUT_MS,
-      // `p.env`, like every other gcloud call here. TERM-724 made the venue boot under the
-      // SERVICE configuration rather than whoever is at the terminal, and a probe that
-      // omitted this would ssh under the person's own credential — then report an owner
-      // measured against a session the run does not use.
-      p.env
-    );
-    if (!res.ok) {
-      throw new HostedVenueError(`could not read the staged tree's owner on ${p.vm}: ${execDetail(res).slice(0, 300)}. Refusing rather than falling back to this machine\u2019s uid, which would hand the guest an id with no write access to its own clone.`);
-    }
-    const lines = res.stdout.split("\n").map((l) => l.trim()).filter((l) => l.length > 0);
-    const ids2 = lines.slice(-2).map((l) => Number(l));
-    if (ids2.length !== 2 || !ids2.every((n) => Number.isInteger(n) && n > 0)) {
-      throw new HostedVenueError(`the venue ${p.vm} answered 'id -u && id -g' with ${JSON.stringify(res.stdout.slice(0, 120))}, which is not a uid/gid pair. Refusing rather than guessing an owner.`);
-    }
-    return { uid: ids2[0], gid: ids2[1] };
-  };
-  stagedOwner = readStagedOwner();
+  stagedOwner = p.transport.readOwner();
   return {
     kind: "hosted-pool",
     runId: p.runId,
@@ -4483,7 +5210,7 @@ function makeLease(p) {
       const dir = venueProxyDir(p.stageBase);
       const buffer = stageProxyCode();
       try {
-        const res = await p.io.pushTree(buffer.dir, "gcloud", iapUntarProxyArgv(p.vm, p.project, p.zone, dir), STAGE_PUSH_TIMEOUT_MS, p.env);
+        const res = await p.transport.pushProxy(buffer.dir, dir);
         if (!res.ok) {
           throw new HostedVenueError(`could not stage the egress proxy onto ${p.vm}: ${execDetail(res).slice(0, 300)}`);
         }
@@ -4493,7 +5220,7 @@ function makeLease(p) {
       return {
         dir,
         cleanup: () => {
-          p.io.exec("gcloud", iapSshArgv(p.vm, p.project, p.zone, `rm -rf ${quoteForRemoteShell(dir)}`), PROXY_CLEANUP_TIMEOUT_MS, p.env);
+          p.transport.removeProxy(dir);
         }
       };
     },
@@ -4501,7 +5228,7 @@ function makeLease(p) {
       check("staging the tree");
       const paths = venueStagePaths(p.stageBase);
       const push = async (from, to) => {
-        const res = await p.io.pushTree(from, "gcloud", iapUntarArgv(p.vm, p.project, p.zone, to), STAGE_PUSH_TIMEOUT_MS, p.env);
+        const res = await p.transport.push(from, to);
         if (!res.ok) {
           throw new HostedVenueError(`could not stage ${from} onto ${p.vm}: ${execDetail(res).slice(0, 300)}`);
         }
@@ -4509,14 +5236,14 @@ function makeLease(p) {
       const { jail: localJail, tmp: localTmp } = localJailPaths(local.scratchRoot);
       const required = [
         localTmp,
-        join10(localJail, JAIL_PASSWD_FILE),
-        join10(localJail, JAIL_GROUP_FILE)
+        join11(localJail, JAIL_PASSWD_FILE),
+        join11(localJail, JAIL_GROUP_FILE)
       ];
       const missing = required.filter((path) => !p.io.exists(path));
       if (missing.length > 0) {
         throw new HostedVenueError(`refusing to stage ${local.scratchRoot} onto ${p.vm}: the jail at ${localJail} is incomplete \u2014 missing ${missing.join(", ")}. buildJail must run to completion before stage(), or the venue mounts a directory with no identity database.`);
       }
-      const gitConfigPath = join10(local.cloneDir, ".git", "config");
+      const gitConfigPath = join11(local.cloneDir, ".git", "config");
       let gitConfig;
       try {
         gitConfig = p.io.readTextIfPresent(gitConfigPath);
@@ -4659,7 +5386,7 @@ function makeLease(p) {
     }
   };
 }
-var SSH_READY_BUDGET_MS, SSH_PROBE_INTERVAL_MS, SSH_PROBE_TIMEOUT_MS, TUNNEL_BUDGET_MS, TUNNEL_POLL_INTERVAL_MS, GOOGLE_JWKS_URL, JWKS_FETCH_TIMEOUT_MS, CREDENTIAL_QUERY_PARAM, UNDECODABLE, STAGE_PUSH_TIMEOUT_MS, DISPATCHED_PROBE_TIMEOUT_MS, DISPATCHED_STATUS_ARGV, DISPATCHED_GIT_CANDIDATES, PROXY_CLEANUP_TIMEOUT_MS, OWNER_PROBE_TIMEOUT_MS, BOOT_TIMEOUT_MS, MKDIR_TIMEOUT_MS, DELETE_TIMEOUT_MS, LOCAL_GCLOUD_TIMEOUT_MS, SERVICE_ACCOUNT_ACTIVATE_TIMEOUT_MS, SOCKET_DIR_PREFIX, VENUE_SOCKET_NAME, HostedVenueError, VENUE_GCLOUD_CONFIG, SERVICE_ACCOUNT_SUFFIX, GCLOUD_PRINCIPAL_OVERRIDES, defaultHostedVenueIo, VENUE_SSH_USER, GCE_METADATA_IDENTITY_URL, COMPACT_JWT, STAGE_HELPER_IMAGE, VOLUME_CREATE_TIMEOUT_MS, EXEC_PROBE_TIMEOUT_MS, POPULATE_TIMEOUT_MS, STAGE_VOLUME_LABEL_KEY, STAGE_PROOF_PREFIX, IAP_NOT_READY, IAP_BACKEND_UNREACHABLE, IAP_DENIED, TERMINAL_GCP, INSTANCE_NOT_RUNNING, PREEMPTED, HOST_KEY_MISMATCH, SSH_KEY_NOT_READY, DAEMON_NOT_READY, SSH_NOT_ANSWERING;
+var SSH_READY_BUDGET_MS, SSH_PROBE_INTERVAL_MS, SSH_PROBE_TIMEOUT_MS, TUNNEL_BUDGET_MS, TUNNEL_POLL_INTERVAL_MS, GOOGLE_JWKS_URL, JWKS_FETCH_TIMEOUT_MS, CREDENTIAL_QUERY_PARAM, UNDECODABLE, STAGE_PUSH_TIMEOUT_MS, DISPATCHED_PROBE_TIMEOUT_MS, DISPATCHED_STATUS_ARGV, DISPATCHED_GIT_CANDIDATES, PROXY_CLEANUP_TIMEOUT_MS, OWNER_PROBE_TIMEOUT_MS, BOOT_TIMEOUT_MS, MKDIR_TIMEOUT_MS, DELETE_TIMEOUT_MS, LOCAL_GCLOUD_TIMEOUT_MS, SERVICE_ACCOUNT_ACTIVATE_TIMEOUT_MS, SOCKET_DIR_PREFIX, VENUE_SOCKET_NAME, HostedVenueError, VENUE_GCLOUD_CONFIG, SERVICE_ACCOUNT_SUFFIX, GCLOUD_PRINCIPAL_OVERRIDES, defaultHostedVenueIo, VENUE_SSH_USER, GCE_METADATA_IDENTITY_URL, COMPACT_JWT, STAGE_HELPER_IMAGE, VOLUME_CREATE_TIMEOUT_MS, EXEC_PROBE_TIMEOUT_MS, POPULATE_TIMEOUT_MS, STAGE_VOLUME_LABEL_KEY, STAGE_PROOF_PREFIX, IAP_NOT_READY, IAP_BACKEND_UNREACHABLE, IAP_DENIED, TERMINAL_GCP, INSTANCE_NOT_RUNNING, PREEMPTED, HOST_KEY_MISMATCH, SSH_KEY_NOT_READY, DAEMON_NOT_READY, SSH_NOT_ANSWERING, CS_ATTEST_PORT, CS_DOCKER_PORT, CS_READY_BUDGET_MS, CS_ATTEST_TIMEOUT_MS, CS_PULL_TIMEOUT_MS, CS_ATTEST_INTERVAL_MS, OPENSSL_TIMEOUT_MS, CS_RUN_ARGS, CS_GUEST_USER, CS_STAGE_ROOT, CLIENT_CERT_STAND_IN;
 var init_hostedVenue = __esm({
   "../../packages/envrun/dist/hostedVenue.js"() {
     "use strict";
@@ -4724,7 +5451,7 @@ var init_hostedVenue = __esm({
       pushTree: pushTreeWithTar,
       readTextIfPresent: (path) => {
         try {
-          return readFileSync3(path, "utf8");
+          return readFileSync4(path, "utf8");
         } catch (err) {
           if (err.code === "ENOENT")
             return null;
@@ -4756,14 +5483,14 @@ var init_hostedVenue = __esm({
       },
       sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
       now: () => Date.now(),
-      exists: (path) => existsSync5(path),
+      exists: (path) => existsSync6(path),
       makePrivateDir: () => {
-        const dir = mkdtempSync3(join10(tmpdir3(), SOCKET_DIR_PREFIX));
+        const dir = mkdtempSync3(join11(tmpdir3(), SOCKET_DIR_PREFIX));
         chmodSync2(dir, 448);
         return dir;
       },
       removeTree: (path) => {
-        rmSync3(path, { recursive: true, force: true });
+        rmSync4(path, { recursive: true, force: true });
       },
       dockerFor: (socketPath) => remoteDockerClient(`unix://${socketPath}`),
       classifyDaemon: (docker3) => classifyVenueDaemon(docker3),
@@ -4780,7 +5507,55 @@ var init_hostedVenue = __esm({
           throw new Error("JWKS fetch returned a body with no keys array");
         }
         return body;
-      }
+      },
+      fetchConfidentialSpaceJwks: async () => {
+        const getJson = async (url, what) => {
+          const res = await globalThis.fetch(url, {
+            signal: AbortSignal.timeout(JWKS_FETCH_TIMEOUT_MS)
+          });
+          if (!res.ok) {
+            throw new Error(`Confidential Space ${what} returned HTTP ${String(res.status)}`);
+          }
+          return res.json();
+        };
+        const discovery = await getJson(CONFIDENTIAL_SPACE_OIDC_DISCOVERY_URL, "discovery");
+        const jwksUri = typeof discovery === "object" && discovery !== null ? discovery.jwks_uri : void 0;
+        if (typeof jwksUri !== "string" || !jwksUri.startsWith("https://")) {
+          throw new Error("Confidential Space discovery names no https jwks_uri");
+        }
+        const body = await getJson(jwksUri, "key set");
+        if (typeof body !== "object" || body === null || !Array.isArray(body.keys)) {
+          throw new Error("Confidential Space key set has no keys array");
+        }
+        return body;
+      },
+      freeLocalPorts: async (n) => {
+        const servers = [];
+        try {
+          for (let i = 0; i < n; i += 1) {
+            const server = createServer();
+            servers.push(server);
+            await new Promise((resolve2, reject) => {
+              server.once("error", reject);
+              server.listen(0, "localhost", () => {
+                resolve2();
+              });
+            });
+          }
+          return servers.map((s) => s.address().port);
+        } finally {
+          await Promise.all(servers.map((s) => new Promise((resolve2) => {
+            s.close(() => {
+              resolve2();
+            });
+          })));
+        }
+      },
+      writeFile: (path, text) => {
+        writeFileSync6(path, text, { mode: 384, flag: "wx" });
+      },
+      fetchAttestation: (req) => fetchAttestationOverTls(req),
+      dockerOverTls: (endpoint, tls, runArgs) => remoteDockerClient(endpoint, { tls, runArgs })
     };
     VENUE_SSH_USER = "th-runner";
     GCE_METADATA_IDENTITY_URL = "http://169.254.169.254/computeMetadata/v1/instance/service-accounts/default/identity";
@@ -4801,6 +5576,17 @@ var init_hostedVenue = __esm({
     SSH_KEY_NOT_READY = /Permission denied \(publickey/;
     DAEMON_NOT_READY = /Cannot connect to the Docker daemon/;
     SSH_NOT_ANSWERING = /Connection refused|Connection reset|Connection closed by|kex_exchange_identification|Operation timed out/;
+    CS_ATTEST_PORT = 8443;
+    CS_DOCKER_PORT = 2376;
+    CS_READY_BUDGET_MS = 48e4;
+    CS_ATTEST_TIMEOUT_MS = 15e3;
+    CS_PULL_TIMEOUT_MS = 6e5;
+    CS_ATTEST_INTERVAL_MS = 5e3;
+    OPENSSL_TIMEOUT_MS = 3e4;
+    CS_RUN_ARGS = ["--oom-score-adj", "1000"];
+    CS_GUEST_USER = { uid: 1e3, gid: 1e3 };
+    CS_STAGE_ROOT = "/tmp";
+    CLIENT_CERT_STAND_IN = "stand-in-certificate";
   }
 });
 
@@ -5699,21 +6485,21 @@ var init_references = __esm({
 });
 
 // ../../packages/envspec/dist/repo.js
-import { readdirSync as readdirSync2, readFileSync as readFileSync4, statSync as statSync2 } from "fs";
-import { join as join11, relative, sep } from "path";
+import { readdirSync as readdirSync2, readFileSync as readFileSync5, statSync as statSync3 } from "fs";
+import { join as join12, relative, sep } from "path";
 function createRepoReader(repoPath) {
-  const resolveIn = (relativePath) => relativePath === "" ? repoPath : join11(repoPath, relativePath);
+  const resolveIn = (relativePath) => relativePath === "" ? repoPath : join12(repoPath, relativePath);
   const toPosix = (absolute) => relative(repoPath, absolute).split(sep).join("/");
   const readText = (relativePath) => {
     try {
-      return readFileSync4(resolveIn(relativePath), "utf8");
+      return readFileSync5(resolveIn(relativePath), "utf8");
     } catch {
       return null;
     }
   };
   const statOf = (relativePath) => {
     try {
-      return statSync2(resolveIn(relativePath));
+      return statSync3(resolveIn(relativePath));
     } catch {
       return null;
     }
@@ -5732,7 +6518,7 @@ function createRepoReader(repoPath) {
       for (const name of names.slice().sort()) {
         if (SKIP_DIRECTORIES.has(name))
           continue;
-        const child = join11(dir, name);
+        const child = join12(dir, name);
         const st = statOf(toPosix(child));
         if (st === null)
           continue;
@@ -6328,11 +7114,11 @@ var init_dist3 = __esm({
 });
 
 // ../../packages/envrun/dist/thrun.js
-import { execFileSync, spawnSync as spawnSync6 } from "child_process";
-import { existsSync as existsSync6, mkdirSync as mkdirSync4, mkdtempSync as mkdtempSync4, rmSync as rmSync4 } from "fs";
+import { execFileSync as execFileSync2, spawnSync as spawnSync6 } from "child_process";
+import { existsSync as existsSync7, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync4, rmSync as rmSync5 } from "fs";
 import { randomUUID } from "crypto";
 import { tmpdir as tmpdir4 } from "os";
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 function git(repoDir, args, allowNonZero = false) {
   const res = spawnSync6("git", [...args], {
     cwd: repoDir,
@@ -6346,13 +7132,16 @@ function git(repoDir, args, allowNonZero = false) {
   }
   return res.stdout ?? "";
 }
-function collectWorkingDiff(repoDir) {
-  if (!existsSync6(join12(repoDir, ".git"))) {
+function collectWorkingDiff(repoDir, opts = {}) {
+  if (!existsSync7(join13(repoDir, ".git"))) {
     throw new ThRunError(`${repoDir} is not a git checkout (no .git). \`th run\` ships the working diff, so it needs a repository to read one from.`);
   }
   const headSha = git(repoDir, ["rev-parse", "HEAD"]).trim();
-  const tracked = git(repoDir, ["diff", "HEAD", "--binary"]);
-  const trackedChanged = git(repoDir, ["diff", "HEAD", "--name-only"]).split("\n").map((s) => s.trim()).filter((s) => s.length > 0);
+  const diffBase = opts.base === void 0 ? headSha : assertDiffBase(repoDir, opts.base);
+  const trackedArgs = opts.base === void 0 ? ["diff", "HEAD"] : ["diff", diffBase];
+  const pathsEnd = opts.base === void 0 ? [] : ["--"];
+  const tracked = git(repoDir, [...trackedArgs, "--binary", ...pathsEnd]);
+  const trackedChanged = git(repoDir, [...trackedArgs, "--name-only", ...pathsEnd]).split("\n").map((s) => s.trim()).filter((s) => s.length > 0);
   const untracked = git(repoDir, ["ls-files", "--others", "--exclude-standard"]).split("\n").map((s) => s.trim()).filter((s) => s.length > 0);
   const parts = [];
   if (tracked.trim() !== "")
@@ -6362,7 +7151,17 @@ function collectWorkingDiff(repoDir) {
     if (one.trim() !== "")
       parts.push(one.replace(/\n*$/, "\n"));
   }
-  return { patch: parts.join(""), headSha, trackedChanged, untracked };
+  return { patch: parts.join(""), headSha, diffBase, trackedChanged, untracked };
+}
+function assertDiffBase(repoDir, base) {
+  if (!FULL_COMMIT_ID.test(base)) {
+    throw new ThRunError(`the diff base must be a full 40-character commit id, got ${JSON.stringify(base)}.`);
+  }
+  const resolved = git(repoDir, ["rev-parse", "--verify", "--quiet", `${base}^{commit}`], true);
+  if (resolved.trim() !== base) {
+    throw new ThRunError(`the diff base ${base} is not a commit in ${repoDir}.`);
+  }
+  return base;
 }
 function isLocalPath(p) {
   return !UNC_PATH.test(p) && (p.startsWith("/") || WINDOWS_ABSOLUTE.test(p));
@@ -6482,14 +7281,14 @@ function credentialFreeHome() {
     return credentialFreeHomeDir;
   let made;
   try {
-    made = mkdtempSync4(join12(tmpdir4(), "th-run-nohome-"));
+    made = mkdtempSync4(join13(tmpdir4(), "th-run-nohome-"));
   } catch (err) {
     throw new RunRefusalError("could not create the empty directory this clone uses as its home, so the clone would read the credentials on this machine instead. That is our environment failing, not your tests: check that the temp directory is writable.", { cause: err });
   }
   credentialFreeHomeDir = made;
   process.once("exit", () => {
     try {
-      rmSync4(made, { recursive: true, force: true });
+      rmSync5(made, { recursive: true, force: true });
     } catch {
     }
   });
@@ -6557,8 +7356,8 @@ function cloneTargetAtUnguarded(opts) {
   if (persisted !== null) {
     throw new RunRefusalError(`refusing to clone from a URL carrying ${persisted}: \`git remote add\` writes the source verbatim into .git/config, which is mounted where the repo\u2019s own test command runs. Fetch with the credential out of band so it is never written to disk \u2014 this runner takes one as an HTTP header, which is never persisted.`);
   }
-  mkdirSync4(opts.dest, { recursive: true });
-  const runOut = (args) => execFileSync("git", [...gitConfigArgs(), ...args], {
+  mkdirSync6(opts.dest, { recursive: true });
+  const runOut = (args) => execFileSync2("git", [...gitConfigArgs(), ...args], {
     cwd: opts.dest,
     encoding: "utf8",
     stdio: "pipe",
@@ -6596,7 +7395,7 @@ function cloneTargetAtUnguarded(opts) {
 }
 function scrubCloneSource(dest, run2) {
   run2(["remote", "remove", "origin"]);
-  rmSync4(join12(dest, ".git", "FETCH_HEAD"), { force: true });
+  rmSync5(join13(dest, ".git", "FETCH_HEAD"), { force: true });
 }
 function publishableTarget(url) {
   if (separatorInTarget(url) !== null)
@@ -6676,8 +7475,8 @@ function targetCarriesCredential(url) {
   }
 }
 function patchedTreeDigest(repoDir) {
-  execFileSync("git", ["-C", repoDir, "add", "-A", "-f"], { stdio: "pipe" });
-  const treeOid = execFileSync("git", ["-C", repoDir, "write-tree"], {
+  execFileSync2("git", ["-C", repoDir, "add", "-A", "-f"], { stdio: "pipe" });
+  const treeOid = execFileSync2("git", ["-C", repoDir, "write-tree"], {
     encoding: "utf8"
   }).trim();
   return sha256Hex(treeOid);
@@ -6934,8 +7733,9 @@ async function runVerification(req, ctx) {
   let diff = null;
   if (source.kind === "working-diff") {
     progress("collect", `reading the working diff from ${source.localRepoDir}`);
-    diff = collectWorkingDiff(source.localRepoDir);
-    progress("collect", `${String(diff.trackedChanged.length)} tracked, ${String(diff.untracked.length)} untracked, ${String(diff.patch.length)} bytes`);
+    diff = collectWorkingDiff(source.localRepoDir, source.diffBase === void 0 ? {} : { base: source.diffBase });
+    const from = source.diffBase === void 0 ? "" : `, from delivered baseline ${diff.diffBase.slice(0, 12)}`;
+    progress("collect", `${String(diff.trackedChanged.length)} tracked, ${String(diff.untracked.length)} untracked, ${String(diff.patch.length)} bytes${from}`);
   } else {
     progress("collect", "dispatched run: the tree is the stored commit itself");
   }
@@ -6967,10 +7767,10 @@ async function runVerification(req, ctx) {
       venueIdentity: null
     };
   }
-  const stage = join12(req.scratchRoot, runId);
-  const cloneDir = join12(stage, "clone");
-  const scratch = join12(stage, "scratch");
-  mkdirSync4(scratch, { recursive: true });
+  const stage = join13(req.scratchRoot, runId);
+  const cloneDir = join13(stage, "clone");
+  const scratch = join13(stage, "scratch");
+  mkdirSync6(scratch, { recursive: true });
   assertSafeTargetSha(req.targetSha);
   progress("clone", `${publishableTarget(req.targetRepo)} @ ${req.targetSha.slice(0, 12)}`);
   cloneTargetAt({
@@ -7035,7 +7835,7 @@ async function runVerification(req, ctx) {
     const venuePaths = await lease.stage({
       cloneDir,
       scratchRoot: scratch,
-      previewDir: join12(stage, "preview"),
+      previewDir: join13(stage, "preview"),
       // On a dispatched run the commit is the statement of what was tested, so
       // it rides with the tree and the venue seam refuses a tree that is not
       // that commit (design §6 item 4, TERM-892 — the guard lives in
@@ -7137,7 +7937,7 @@ async function runVerification(req, ctx) {
     await releaseWithoutThrowing(lease, progress);
   }
 }
-var ThRunError, OUTPUT_TAIL_BYTES, ALLOWED_URL_SCHEMES, SCP_STYLE, URL_SCHEME, WINDOWS_ABSOLUTE, UNC_PATH, TRANSPORT_REASON, SHA_REASON, FULL_SHA, MIN_GIT_VERSION_FOR_END_OF_OPTIONS, CloneUnavailableError, GIT_ENV_ALLOWLIST, credentialFreeHomeDir, SSH_ISOLATION_ARGS, WITHHELD_SEGMENT, UNPARSEABLE_TARGET, FAILURE_LINE, REDACTED_TARGET_REPO, REDACTED_TARGET_SHA;
+var ThRunError, OUTPUT_TAIL_BYTES, FULL_COMMIT_ID, ALLOWED_URL_SCHEMES, SCP_STYLE, URL_SCHEME, WINDOWS_ABSOLUTE, UNC_PATH, TRANSPORT_REASON, SHA_REASON, FULL_SHA, MIN_GIT_VERSION_FOR_END_OF_OPTIONS, CloneUnavailableError, GIT_ENV_ALLOWLIST, credentialFreeHomeDir, SSH_ISOLATION_ARGS, WITHHELD_SEGMENT, UNPARSEABLE_TARGET, FAILURE_LINE, REDACTED_TARGET_REPO, REDACTED_TARGET_SHA;
 var init_thrun = __esm({
   "../../packages/envrun/dist/thrun.js"() {
     "use strict";
@@ -7155,6 +7955,7 @@ var init_thrun = __esm({
     ThRunError = class extends Error {
     };
     OUTPUT_TAIL_BYTES = 4e3;
+    FULL_COMMIT_ID = /^[0-9a-f]{40}$/;
     ALLOWED_URL_SCHEMES = /* @__PURE__ */ new Set(["https", "http", "ssh", "git"]);
     SCP_STYLE = /^[A-Za-z0-9._~+-]+@[A-Za-z0-9._-]+:[^:]/;
     URL_SCHEME = /^([A-Za-z][A-Za-z0-9+.-]*):\/\//;
@@ -7391,8 +8192,8 @@ var init_dbplan = __esm({
 
 // ../../packages/envrun/dist/dbstack.js
 import { spawnSync as spawnSync7 } from "child_process";
-import { randomBytes as randomBytes5 } from "crypto";
-import { mkdirSync as mkdirSync5 } from "fs";
+import { randomBytes as randomBytes6 } from "crypto";
+import { mkdirSync as mkdirSync7 } from "fs";
 function installCommandFor(runner) {
   switch (runner) {
     case "sql":
@@ -7427,7 +8228,7 @@ function docker2(args, timeoutMs = DOCKER_TIMEOUT_MS2) {
 function generateCredentials(host) {
   return {
     user: "thverify",
-    password: randomBytes5(24).toString("base64url"),
+    password: randomBytes6(24).toString("base64url"),
     database: "thverify",
     host,
     port: 5432
@@ -7734,8 +8535,8 @@ async function installLocalMigrationTooling(opts) {
     };
   }
   const { jail, tmp } = buildJail(opts.scratchRoot);
-  mkdirSync5(jail, { recursive: true });
-  mkdirSync5(tmp, { recursive: true });
+  mkdirSync7(jail, { recursive: true });
+  mkdirSync7(tmp, { recursive: true });
   const spec = {
     profile: "install",
     clone: opts.repoDir,
@@ -8013,6 +8814,7 @@ __export(dist_exports, {
   ALEMBIC_IMAGE: () => ALEMBIC_IMAGE,
   ATTEST_REFUSAL_REASONS: () => ATTEST_REFUSAL_REASONS,
   BOOKKEEPING_TABLES: () => BOOKKEEPING_TABLES,
+  CONFIDENTIAL_SPACE_MACHINE_TYPE: () => CONFIDENTIAL_SPACE_MACHINE_TYPE,
   CONTAINMENT_UNAVAILABLE_PREFIX: () => CONTAINMENT_UNAVAILABLE_PREFIX,
   CloneUnavailableError: () => CloneUnavailableError,
   DAEMON_FACTS_FORMAT: () => DAEMON_FACTS_FORMAT,
@@ -8154,6 +8956,7 @@ __export(dist_exports, {
   toolingImageFor: () => toolingImageFor,
   unquoteDiffPath: () => unquoteDiffPath,
   venueGcloudEnv: () => venueGcloudEnv,
+  venueImageFromEnv: () => venueImageFromEnv,
   venueStagePaths: () => venueStagePaths,
   verifyWorkingDiff: () => verifyWorkingDiff
 });
@@ -8180,10 +8983,11 @@ var init_dist4 = __esm({
 });
 
 // bin/jpi-run.js
-import { existsSync as existsSync7, readFileSync as readFileSync5 } from "fs";
-import { join as join13, resolve } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync6, realpathSync as realpathSync2 } from "fs";
+import { execFileSync as execFileSync3 } from "child_process";
+import { join as join14, resolve } from "path";
 import { tmpdir as tmpdir5 } from "os";
-import { mkdtempSync as mkdtempSync5, rmSync as rmSync5 } from "fs";
+import { mkdtempSync as mkdtempSync5, rmSync as rmSync6 } from "fs";
 
 // bin/recall-check.js
 import {
@@ -8478,6 +9282,107 @@ function readPackageVersion() {
   return "0.1.1";
 }
 
+// src/claims.ts
+import {
+  readFileSync as readFileSync3,
+  writeFileSync as writeFileSync2,
+  mkdirSync as mkdirSync3,
+  renameSync as renameSync2,
+  existsSync as existsSync3,
+  rmSync,
+  statSync as statSync2
+} from "fs";
+import { randomBytes } from "crypto";
+import { join as join4 } from "path";
+import { homedir as homedir3 } from "os";
+
+// src/state-dir.ts
+import { closeSync as closeSync2, constants, fchmodSync, fstatSync, mkdirSync as mkdirSync2, openSync as openSync2 } from "fs";
+
+// src/claims.ts
+var TERMINALHIRE_DIR = process.env.TERMINALHIRE_DIR || join4(homedir3(), ".terminalhire");
+var CLAIMS_FILE = join4(TERMINALHIRE_DIR, "claims.json");
+var LOCK_DIR = `${CLAIMS_FILE}.lock`;
+var LOCK_STALE_MS = Number(process.env.TERMINALHIRE_LOCK_STALE_MS) || 1e4;
+var LOCK_RETRY_MS = Number(process.env.TERMINALHIRE_LOCK_RETRY_MS) || 25;
+var LOCK_TIMEOUT_MS = Number(process.env.TERMINALHIRE_LOCK_TIMEOUT_MS) || 5e3;
+var CLAIM_STATES = Object.freeze([
+  "claimed",
+  // recorded, not started
+  "working",
+  // background executor running / work in progress
+  "in-review",
+  // gate ran / dev reviewing the diff
+  "ready",
+  // passed review, cleared to submit
+  "submitted",
+  // PR opened on the source platform (awaiting maintainer)
+  "merged",
+  // PR merged — accepted; counts toward the metric
+  "abandoned"
+  // released, or PR closed unmerged
+]);
+var CLAIM_TURN_BY_STATE = Object.freeze({
+  claimed: "you",
+  working: "you",
+  "in-review": "you",
+  ready: "you",
+  submitted: "poster",
+  merged: "merged",
+  abandoned: "closed"
+});
+var CLAIM_TURN_LABEL = Object.freeze({
+  you: "waiting on you",
+  poster: "waiting on poster",
+  merged: "merged",
+  closed: "closed"
+});
+var CLAIM_TURN_LABEL_WIDTH = Math.max(
+  ...Object.values(CLAIM_TURN_LABEL).map((label) => label.length)
+);
+var WHITESPACE_CONTROLS = /[\t\n\v\f\r]+/g;
+var CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
+function defangText(s) {
+  return typeof s === "string" ? s.replace(WHITESPACE_CONTROLS, " ").replace(CONTROL_CHARS, "") : s;
+}
+function finiteAmount(a) {
+  if (typeof a === "number") return Number.isFinite(a) ? a : null;
+  if (typeof a !== "string" || a.trim() === "") return null;
+  const n = Number(a);
+  return Number.isFinite(n) ? n : null;
+}
+function normalizeClaim(c) {
+  return {
+    ...c,
+    kind: c.kind ?? "bounty",
+    policy: c.policy ?? null,
+    title: defangText(c.title),
+    repoFullName: defangText(c.repoFullName),
+    amountUSD: finiteAmount(c.amountUSD)
+  };
+}
+function readClaims() {
+  try {
+    if (!existsSync3(CLAIMS_FILE)) return [];
+    const data = JSON.parse(readFileSync3(CLAIMS_FILE, "utf8"));
+    const claims = Array.isArray(data?.claims) ? data.claims : [];
+    return claims.map(normalizeClaim);
+  } catch {
+    return [];
+  }
+}
+
+// src/delivered-baseline.ts
+import { execFileSync } from "child_process";
+function deliveredBaseline(worktree) {
+  const roots = execFileSync("git", ["-C", worktree, "rev-list", "--max-parents=0", "HEAD"], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"]
+  }).split("\n").map((s) => s.trim()).filter((s) => s.length > 0);
+  const [only] = roots;
+  return roots.length === 1 && only !== void 0 ? { kind: "baseline", sha: only } : { kind: "ambiguous", rootCount: roots.length };
+}
+
 // bin/jpi-run.js
 var KEEP_MAX_SECONDS = Math.floor((2 ** 31 - 1) / 1e3);
 var USAGE = `terminalhire run \u2014 verify your working diff in a fresh container
@@ -8506,7 +9411,13 @@ Options:
 Defaults are read from .th-run.json in the local checkout when present, so a
 claim you run repeatedly needs no flags. Every flag overrides the file.
 
-Needs Docker running. Needs network for the first clone of the target.`;
+Run from inside a delivered claim workspace, the claim ledger supplies --claim and
+--sha. The diff is then taken from the delivered baseline, so committed work is tested
+as \`claim submit\` would send it. A full-repository delivery is its own --target: the
+delivered commit is cloned out of the workspace by path, so a private repository needs
+no credential. A delivery of only the files you were granted needs --target.
+
+Needs Docker running. Needs network for the first clone of a remote target.`;
 function parseArgs(argv) {
   const out = { flags: {}, bools: /* @__PURE__ */ new Set() };
   for (let i = 0; i < argv.length; i += 1) {
@@ -8529,7 +9440,7 @@ function parseArgs(argv) {
 function runScratchRoot() {
   let root;
   try {
-    root = mkdtempSync5(join13(tmpdir5(), "th-run-"));
+    root = mkdtempSync5(join14(tmpdir5(), "th-run-"));
   } catch (err) {
     process.stderr.write(
       `terminalhire: could not create the temporary directory this run works in, so nothing was cloned and nothing was executed. That is our environment failing, not your tests: check that the temp directory is writable. (${String(err?.message ?? err)})
@@ -8542,7 +9453,7 @@ function runScratchRoot() {
     if (cleaned) return;
     cleaned = true;
     try {
-      rmSync5(root, { recursive: true, force: true });
+      rmSync6(root, { recursive: true, force: true });
     } catch {
     }
   };
@@ -8566,10 +9477,10 @@ async function loadEngine() {
   }
 }
 function readConfig(localDir) {
-  const file = join13(localDir, ".th-run.json");
-  if (!existsSync7(file)) return {};
+  const file = join14(localDir, ".th-run.json");
+  if (!existsSync8(file)) return {};
   try {
-    const parsed = JSON.parse(readFileSync5(file, "utf8"));
+    const parsed = JSON.parse(readFileSync6(file, "utf8"));
     return parsed && typeof parsed === "object" ? parsed : {};
   } catch (err) {
     throw new Error(
@@ -8581,9 +9492,80 @@ function requireField(value, name, hint) {
   if (typeof value === "string" && value.trim() !== "") return value.trim();
   throw new Error(`terminalhire: run needs ${name}. ${hint}`);
 }
+var given = (value) => typeof value === "string" && value.trim() !== "";
+function realToplevel(dir) {
+  try {
+    const top = execFileSync3("git", ["-C", dir, "rev-parse", "--show-toplevel"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    return top === "" ? null : realpathSync2(top);
+  } catch {
+    return null;
+  }
+}
+function realpathOrNull(path) {
+  try {
+    return realpathSync2(path);
+  } catch {
+    return null;
+  }
+}
+function resolveClaimContext({ localDir, flags, claims }) {
+  const here = realToplevel(localDir);
+  if (here === null) return null;
+  const recordedHere = claims.filter(
+    (c) => c.approval != null && typeof c.worktreePath === "string" && realpathOrNull(c.worktreePath) === here
+  );
+  const matches = given(flags.claim) ? recordedHere.filter((c) => c.id === flags.claim.trim()) : recordedHere;
+  if (matches.length === 0) return null;
+  if (matches.length > 1) {
+    throw new Error(
+      `terminalhire: ${String(matches.length)} claims are recorded against this workspace (${matches.map((c) => c.id).join(", ")}), so run cannot tell which one this is. Name it with --claim <id>.`
+    );
+  }
+  const [claim] = matches;
+  let sha = given(flags.sha) ? flags.sha.trim() : null;
+  if (sha === null) {
+    if (typeof claim.baseSha !== "string" || !/^[0-9a-f]{40}$/.test(claim.baseSha)) {
+      throw new Error(
+        `terminalhire: claim ${claim.id} has no recorded base commit: it was delivered before terminalhire kept one. Pass --sha <40-hex>, the commit the workspace was delivered from.`
+      );
+    }
+    sha = claim.baseSha;
+  }
+  let baseline;
+  try {
+    baseline = deliveredBaseline(here);
+  } catch (err) {
+    throw new Error(
+      `terminalhire: could not read the delivered baseline in ${here} (${String(err?.stderr || err?.message || err).trim()}).`
+    );
+  }
+  if (baseline.kind !== "baseline") {
+    throw new Error(
+      `terminalhire: ${here} has ${String(baseline.rootCount)} root commits \u2014 cannot determine the delivered baseline to diff against. Re-fetch the slice into a fresh directory: terminalhire claim slice ${claim.id} --dir <path>`
+    );
+  }
+  const diffBase = baseline.sha;
+  const target = given(flags.target) ? flags.target.trim() : diffBase === sha ? here : null;
+  if (target === null) {
+    const sparse = typeof claim.baseSha === "string" && diffBase !== claim.baseSha;
+    throw new Error(
+      sparse ? "terminalhire: run needs --target. This delivery holds only the files you were granted, so a local run needs the clone URL of the full repository: --target <url>." : `terminalhire: run needs --target. --sha ${sha.slice(0, 12)} is not the commit this workspace was delivered as (${diffBase.slice(0, 12)}), so the workspace cannot stand in for the repository: pass --target <clone URL of the repository at that commit>.`
+    );
+  }
+  return { claimId: claim.id, target, sha, diffBase, workspaceRoot: here };
+}
 async function once(engine, opts) {
   const { root } = opts.scratch;
   const started = Date.now();
+  if (opts.deliveredCommit && !opts.json) {
+    process.stderr.write(
+      `  ${"tested".padEnd(8)} against the delivered commit ${opts.deliveredCommit.slice(0, 12)}; the poster-side run puts your change on top of the repository's current default branch, so its result can differ if that branch has moved since delivery.
+`
+    );
+  }
   const outcome = await engine.verifyWorkingDiff({
     claimId: opts.claimId,
     // `th run` is the developer's own loop, and this is the variant that says so: it tests
@@ -8591,7 +9573,10 @@ async function once(engine, opts) {
     source: {
       kind: "working-diff",
       localRepoDir: opts.localDir,
-      sliceFiles: opts.slice
+      sliceFiles: opts.slice,
+      // From a claim workspace, the delivered baseline: committed work is then tested,
+      // exactly as `claim submit` would send it (TERM-1098). Absent means HEAD.
+      ...opts.diffBase ? { diffBase: opts.diffBase } : {}
     },
     targetRepo: opts.target,
     targetSha: opts.sha,
@@ -8679,12 +9664,35 @@ async function run() {
       `terminalhire: --keep must be at most ${String(KEEP_MAX_SECONDS)} seconds, got ${JSON.stringify(String(keepRaw))}. Past that the timer overflows its int32 of milliseconds and the wait collapses to 1ms, so asking for a longer hold would give you no hold at all and the URL printed above it would be dead before anyone could open it. Refused rather than clamped, because a preview that died on the way to you looks exactly like one that worked.`
     );
   }
+  const claimContext = resolveClaimContext({
+    localDir,
+    flags: { claim: pick("claim"), target: pick("target"), sha: pick("sha") },
+    claims: readClaims()
+  });
   const opts = {
-    claimId: requireField(pick("claim"), "--claim", "It is the id the result is filed under."),
-    target: requireField(pick("target"), "--target", "e.g. https://github.com/koajs/koa.git"),
-    sha: requireField(pick("sha"), "--sha", "The full 40-character commit your diff applies to."),
+    claimId: requireField(
+      claimContext?.claimId ?? pick("claim"),
+      "--claim",
+      "It is the id the result is filed under."
+    ),
+    // With a claim context the target is always set: `resolveClaimContext` refuses, and
+    // says why, when it cannot name one.
+    target: requireField(
+      claimContext?.target ?? pick("target"),
+      "--target",
+      "e.g. https://github.com/koajs/koa.git"
+    ),
+    sha: requireField(
+      claimContext?.sha ?? pick("sha"),
+      "--sha",
+      "The full 40-character commit your diff applies to."
+    ),
+    diffBase: claimContext?.diffBase ?? null,
+    deliveredCommit: claimContext?.sha ?? null,
     slice,
-    localDir,
+    // From a claim workspace, its root and not the directory run started in: the diff
+    // collector reads `.git` there, and --watch watches the same tree (TERM-1098).
+    localDir: claimContext?.workspaceRoot ?? localDir,
     preview: !parsed.bools.has("no-preview"),
     watch: parsed.bools.has("watch"),
     json: parsed.bools.has("json"),
@@ -8746,5 +9754,6 @@ if (process.argv[1] && process.argv[1].endsWith("jpi-run.js")) {
 }
 export {
   once,
+  resolveClaimContext,
   run
 };