terminalhire 0.42.23 → 0.42.24

package/dist/bin/jpi-claim.js

@@ -1077,8 +1077,8 @@ function makeGitHubGovernor(fetchImpl, cfg) {
     try {
       const res = bound == null ? await fetchP : await Promise.race([
         fetchP,
-        new Promise((resolve4) => {
-          timer = setTimeout(() => resolve4(null), bound);
+        new Promise((resolve5) => {
+          timer = setTimeout(() => resolve5(null), bound);
         })
       ]);
       if (!res || !res.ok) return null;
@@ -5136,8 +5136,8 @@ async function getWithTimeout(governor, url, token, timeoutMs) {
   try {
     const res = await Promise.race([
       getP,
-      new Promise((resolve4) => {
-        timer = setTimeout(() => resolve4(null), timeoutMs);
+      new Promise((resolve5) => {
+        timer = setTimeout(() => resolve5(null), timeoutMs);
       })
     ]);
     if (res === null) controller.abort();
@@ -6934,7 +6934,7 @@ function eddsa(Point, cHash, eddsaOpts = {}) {
   });
   const { prehash } = eddsaOpts;
   const { BASE, Fp: Fp2, Fn: Fn2 } = Point;
-  const randomBytes12 = eddsaOpts.randomBytes || randomBytes;
+  const randomBytes13 = eddsaOpts.randomBytes || randomBytes;
   const adjustScalarBytes2 = eddsaOpts.adjustScalarBytes || ((bytes) => bytes);
   const domain = eddsaOpts.domain || ((data, ctx, phflag) => {
     _abool2(phflag, "phflag");
@@ -7016,7 +7016,7 @@ function eddsa(Point, cHash, eddsaOpts = {}) {
     signature: 2 * _size,
     seed: _size
   };
-  function randomSecretKey(seed = randomBytes12(lengths.seed)) {
+  function randomSecretKey(seed = randomBytes13(lengths.seed)) {
     return _abytes2(seed, lengths.seed, "seed");
   }
   function keygen(seed) {
@@ -11342,7 +11342,7 @@ async function requireStoredLogin() {
   }
 }
 function sleep(ms) {
-  return new Promise((resolve4) => setTimeout(resolve4, ms));
+  return new Promise((resolve5) => setTimeout(resolve5, ms));
 }
 var TERMINALHIRE_DIR4, TOKEN_FILE, ALGO, IV_BYTES, GITHUB_SCOPE, DEVICE_CODE_URL, ACCESS_TOKEN_URL, BAKED_IN_CLIENT_ID, MOCK_TOKEN, MOCK_LOGIN;
 var init_github_auth = __esm({
@@ -11759,16 +11759,16 @@ var sleep2;
 var init_sleep = __esm({
   "../../node_modules/@anthropic-ai/sdk/internal/utils/sleep.mjs"() {
     "use strict";
-    sleep2 = (ms, signal) => new Promise((resolve4) => {
+    sleep2 = (ms, signal) => new Promise((resolve5) => {
       if (signal?.aborted)
-        return resolve4();
+        return resolve5();
       const onAbort = () => {
         clearTimeout(timer);
-        resolve4();
+        resolve5();
       };
       const timer = setTimeout(() => {
         signal?.removeEventListener("abort", onAbort);
-        resolve4();
+        resolve5();
       }, ms);
       signal?.addEventListener("abort", onAbort, { once: true });
     });
@@ -13897,8 +13897,8 @@ var init_api_promise = __esm({
     init_parse();
     APIPromise = class _APIPromise extends Promise {
       constructor(client, responsePromise, parseResponse = defaultParseResponse) {
-        super((resolve4) => {
-          resolve4(null);
+        super((resolve5) => {
+          resolve5(null);
         });
         this.responsePromise = responsePromise;
         this.parseResponse = parseResponse;
@@ -16418,16 +16418,16 @@ var init_async_queue = __esm({
         if (__classPrivateFieldGet(this, _AsyncQueue_closed, "f") || signal?.aborted) {
           return Promise.resolve({ done: true, value: void 0 });
         }
-        return new Promise((resolve4) => {
+        return new Promise((resolve5) => {
           const waiter = (r) => {
             signal?.removeEventListener("abort", onAbort);
-            resolve4(r);
+            resolve5(r);
           };
           const onAbort = () => {
             const idx = __classPrivateFieldGet(this, _AsyncQueue_waiters, "f").indexOf(waiter);
             if (idx >= 0)
               __classPrivateFieldGet(this, _AsyncQueue_waiters, "f").splice(idx, 1);
-            resolve4({ done: true, value: void 0 });
+            resolve5({ done: true, value: void 0 });
           };
           __classPrivateFieldGet(this, _AsyncQueue_waiters, "f").push(waiter);
           signal?.addEventListener("abort", onAbort, { once: true });
@@ -17027,13 +17027,13 @@ var init_json_schema = __esm({
 
 // ../../node_modules/@anthropic-ai/sdk/internal/utils/promise.mjs
 function promiseWithResolvers() {
-  let resolve4;
+  let resolve5;
   let reject;
   const promise = new Promise((res, rej) => {
-    resolve4 = res;
+    resolve5 = res;
     reject = rej;
   });
-  return { promise, resolve: resolve4, reject };
+  return { promise, resolve: resolve5, reject };
 }
 var init_promise = __esm({
   "../../node_modules/@anthropic-ai/sdk/internal/utils/promise.mjs"() {
@@ -17635,7 +17635,7 @@ function betaGrepTool(ctx) {
   });
 }
 function runRipgrep(rg, pattern, searchPath, signal) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const proc = cp.spawn(rg, ["-n", "--no-heading", "-e", pattern, "--", searchPath], {
       ...signal ? { signal } : {}
     });
@@ -17657,12 +17657,12 @@ function runRipgrep(rg, pattern, searchPath, signal) {
       if (signal?.aborted)
         return reject(new ToolError("grep: aborted"));
       if (truncated)
-        return resolve4(out + `
+        return resolve5(out + `
 [output truncated at ${GREP_OUTPUT_LIMIT} bytes]`);
       if (code === 0)
-        return resolve4(out);
+        return resolve5(out);
       if (code === 1)
-        return resolve4("no matches");
+        return resolve5("no matches");
       reject(new ToolError(`grep: rg failed: ${errOut || `exit ${code}`}`));
     });
     proc.on("error", (e) => {
@@ -17840,8 +17840,8 @@ var init_node = __esm({
 `;
         __classPrivateFieldGet(this, _BashSession_proc, "f").stdin.write(wrapped);
         if (__classPrivateFieldGet(this, _BashSession_buf, "f").indexOf(sentinel2) < 0) {
-          const { promise: sentinelSeen, resolve: resolve4 } = promiseWithResolvers();
-          __classPrivateFieldSet(this, _BashSession_waiting, { sentinel: sentinel2, resolve: resolve4 }, "f");
+          const { promise: sentinelSeen, resolve: resolve5 } = promiseWithResolvers();
+          __classPrivateFieldSet(this, _BashSession_waiting, { sentinel: sentinel2, resolve: resolve5 }, "f");
           let timer;
           let onAbort;
           try {
@@ -19596,12 +19596,12 @@ var init_BetaMessageStream = __esm({
           }
           return this._emit("error", new AnthropicError(String(error)));
         });
-        __classPrivateFieldSet(this, _BetaMessageStream_connectedPromise, new Promise((resolve4, reject) => {
-          __classPrivateFieldSet(this, _BetaMessageStream_resolveConnectedPromise, resolve4, "f");
+        __classPrivateFieldSet(this, _BetaMessageStream_connectedPromise, new Promise((resolve5, reject) => {
+          __classPrivateFieldSet(this, _BetaMessageStream_resolveConnectedPromise, resolve5, "f");
           __classPrivateFieldSet(this, _BetaMessageStream_rejectConnectedPromise, reject, "f");
         }), "f");
-        __classPrivateFieldSet(this, _BetaMessageStream_endPromise, new Promise((resolve4, reject) => {
-          __classPrivateFieldSet(this, _BetaMessageStream_resolveEndPromise, resolve4, "f");
+        __classPrivateFieldSet(this, _BetaMessageStream_endPromise, new Promise((resolve5, reject) => {
+          __classPrivateFieldSet(this, _BetaMessageStream_resolveEndPromise, resolve5, "f");
           __classPrivateFieldSet(this, _BetaMessageStream_rejectEndPromise, reject, "f");
         }), "f");
         __classPrivateFieldGet(this, _BetaMessageStream_connectedPromise, "f").catch(() => {
@@ -19771,11 +19771,11 @@ var init_BetaMessageStream = __esm({
        *   const message = await stream.emitted('message') // rejects if the stream errors
        */
       emitted(event) {
-        return new Promise((resolve4, reject) => {
+        return new Promise((resolve5, reject) => {
           __classPrivateFieldSet(this, _BetaMessageStream_catchingPromiseCreated, true, "f");
           if (event !== "error")
             this.once("error", reject);
-          this.once(event, resolve4);
+          this.once(event, resolve5);
         });
       }
       async done() {
@@ -20137,7 +20137,7 @@ var init_BetaMessageStream = __esm({
               if (done) {
                 return { value: void 0, done: true };
               }
-              return new Promise((resolve4, reject) => readQueue.push({ resolve: resolve4, reject })).then((chunk2) => chunk2 ? { value: chunk2, done: false } : { value: void 0, done: true });
+              return new Promise((resolve5, reject) => readQueue.push({ resolve: resolve5, reject })).then((chunk2) => chunk2 ? { value: chunk2, done: false } : { value: void 0, done: true });
             }
             const chunk = pushQueue.shift();
             return { value: chunk, done: false };
@@ -22375,12 +22375,12 @@ var init_MessageStream = __esm({
           }
           return this._emit("error", new AnthropicError(String(error)));
         });
-        __classPrivateFieldSet(this, _MessageStream_connectedPromise, new Promise((resolve4, reject) => {
-          __classPrivateFieldSet(this, _MessageStream_resolveConnectedPromise, resolve4, "f");
+        __classPrivateFieldSet(this, _MessageStream_connectedPromise, new Promise((resolve5, reject) => {
+          __classPrivateFieldSet(this, _MessageStream_resolveConnectedPromise, resolve5, "f");
           __classPrivateFieldSet(this, _MessageStream_rejectConnectedPromise, reject, "f");
         }), "f");
-        __classPrivateFieldSet(this, _MessageStream_endPromise, new Promise((resolve4, reject) => {
-          __classPrivateFieldSet(this, _MessageStream_resolveEndPromise, resolve4, "f");
+        __classPrivateFieldSet(this, _MessageStream_endPromise, new Promise((resolve5, reject) => {
+          __classPrivateFieldSet(this, _MessageStream_resolveEndPromise, resolve5, "f");
           __classPrivateFieldSet(this, _MessageStream_rejectEndPromise, reject, "f");
         }), "f");
         __classPrivateFieldGet(this, _MessageStream_connectedPromise, "f").catch(() => {
@@ -22550,11 +22550,11 @@ var init_MessageStream = __esm({
        *   const message = await stream.emitted('message') // rejects if the stream errors
        */
       emitted(event) {
-        return new Promise((resolve4, reject) => {
+        return new Promise((resolve5, reject) => {
           __classPrivateFieldSet(this, _MessageStream_catchingPromiseCreated, true, "f");
           if (event !== "error")
             this.once("error", reject);
-          this.once(event, resolve4);
+          this.once(event, resolve5);
         });
       }
       async done() {
@@ -22875,7 +22875,7 @@ var init_MessageStream = __esm({
               if (done) {
                 return { value: void 0, done: true };
               }
-              return new Promise((resolve4, reject) => readQueue.push({ resolve: resolve4, reject })).then((chunk2) => chunk2 ? { value: chunk2, done: false } : { value: void 0, done: true });
+              return new Promise((resolve5, reject) => readQueue.push({ resolve: resolve5, reject })).then((chunk2) => chunk2 ? { value: chunk2, done: false } : { value: void 0, done: true });
             }
             const chunk = pushQueue.shift();
             return { value: chunk, done: false };
@@ -25973,7 +25973,7 @@ function splitProgressChunk(chunk) {
 }
 function shStream(cmd, args, opts = {}) {
   const cap = opts.maxStderrBytes ?? 64 * 1024;
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     void (async () => {
       const spawn6 = opts.spawnFn ?? (await import("child_process")).spawn;
       const child = spawn6(cmd, args, { shell: false, stdio: ["ignore", "pipe", "pipe"] });
@@ -25991,7 +25991,7 @@ function shStream(cmd, args, opts = {}) {
       child.on("error", (err) => reject(err));
       child.on("close", (code, signal) => {
         if (code === 0) {
-          resolve4({ stdout: stdout.trim(), stderr });
+          resolve5({ stdout: stdout.trim(), stderr });
           return;
         }
         const err = new Error(
@@ -26058,6 +26058,20 @@ function isCommandUnavailable(facts, countsRead) {
     return false;
   return facts.stdout.trim().length === 0 && EXEC_FAILURE.test(facts.stderr);
 }
+function isMissingSystemDependency(facts, countsRead) {
+  if (countsRead)
+    return null;
+  if (facts.exitCode === 0 || facts.exitCode === null)
+    return null;
+  const out = `${facts.stdout}
+${facts.stderr}`;
+  for (const pattern of MISSING_SYSTEM_DEPENDENCY) {
+    const hit = pattern.exec(out);
+    if (hit)
+      return hit[0];
+  }
+  return null;
+}
 function isOfflineBuildGap(facts, counts) {
   if (facts.runtime !== "jvm")
     return null;
@@ -26098,6 +26112,14 @@ function classifyVerification(facts) {
       reason: `the test command could not be invoked (exit ${String(facts.exitCode)}). This is an environment failure on our side \u2014 a missing interpreter, a binary outside PATH, or a dependency installed somewhere the command cannot see it. The repo has not been judged.`
     };
   }
+  const missing = isMissingSystemDependency(facts, counts !== null);
+  if (missing !== null) {
+    return {
+      outcome: "test-command-unavailable",
+      counts,
+      reason: `the build needs a system library or header our image does not carry (${missing}). This is a gap in our environment, not a failure in the repo. The repo has not been judged.`
+    };
+  }
   const gap = isOfflineBuildGap(facts, counts);
   if (gap !== null) {
     return {
@@ -26158,9 +26180,9 @@ function isGreen(outcome) {
   return outcome === "completed";
 }
 function isOurFault(outcome) {
-  return outcome === "test-command-unavailable" || outcome === "counts-unparsed";
+  return OUR_FAULT[outcome];
 }
-var VERIFICATION_OUTCOMES, int, withSuiteFailures, READERS, SUPPORTED_RUNNERS, COVERAGE_TABLE, EXEC_FAILURE, SUITE_REPORTED_FAILURE, OFFLINE_BUILD_GAP;
+var VERIFICATION_OUTCOMES, int, withSuiteFailures, READERS, SUPPORTED_RUNNERS, COVERAGE_TABLE, EXEC_FAILURE, SUITE_REPORTED_FAILURE, MISSING_SYSTEM_DEPENDENCY, OFFLINE_BUILD_GAP, OUR_FAULT;
 var init_classify2 = __esm({
   "../../packages/envrun/dist/classify.js"() {
     "use strict";
@@ -26317,6 +26339,23 @@ var init_classify2 = __esm({
           };
         }
       },
+      {
+        // CTest's closing summary: `50% tests passed, 1 tests failed out of 2`. Measured
+        // on cmake 3.25 in the cpp image (TERM-1123); the singular `1 test failed` is
+        // CTest's own form for one. Anchored at line start, so a log line quoting it
+        // is not read as the summary. Meson and a bare `make test` print no summary we
+        // can trust and stay unparsed.
+        runner: "ctest",
+        read: (out) => {
+          if (/^No tests were found!!!$/m.test(out))
+            return { tests_passed: 0, tests_failed: 0 };
+          const m = /^\d+% tests passed, (\d+) tests? failed out of (\d+)$/m.exec(out);
+          if (!m)
+            return null;
+          const failed = Number(m[1]);
+          return { tests_passed: Number(m[2]) - failed, tests_failed: failed };
+        }
+      },
       {
         // mocha: `  440 passing (1s)` and `  2 failing`
         runner: "mocha",
@@ -26445,6 +26484,11 @@ var init_classify2 = __esm({
       "\\d+\\s+examples?,\\s+(?!0\\b)\\d+\\s+failures?"
       // rspec's summary line
     ].join("|"), "m");
+    MISSING_SYSTEM_DEPENDENCY = [
+      /^(?:\S*\/)?ld(?:\.\w+)?: cannot find -l[\w.+-]+/m,
+      /^\S+:\d+(?::\d+)?: fatal error: [\w./+-]+\.(?:h|hh|hpp|hxx): No such file or directory$/m,
+      /^\S+: error while loading shared libraries: lib[\w.+-]*: cannot open shared object file/m
+    ];
     OFFLINE_BUILD_GAP = [
       // Maven, `-o`: `Cannot access central (…) in offline mode and the artifact … has
       // not been downloaded from it before.`
@@ -26460,6 +26504,15 @@ var init_classify2 = __esm({
       /No matching toolchains found for requested specification/,
       /Cannot find a Java installation on your machine matching/
     ];
+    OUR_FAULT = {
+      completed: false,
+      "tests-failed": false,
+      "no-tests-observed": false,
+      "budget-exceeded": false,
+      "counts-unparsed": true,
+      "test-command-unavailable": true,
+      "environment-exhausted": true
+    };
   }
 });
 
@@ -26493,7 +26546,8 @@ function scrubEnv(source, opts) {
   if (!tmpDir.startsWith("/")) {
     throw new SandboxEnvError(`tmpDir must be an absolute path, got ${JSON.stringify(tmpDir)}`);
   }
-  for (const realHome of realHomeCandidates(source)) {
+  const homesToCompare = opts.jailHomeNamespace === "guest" ? [] : realHomeCandidates(source);
+  for (const realHome of homesToCompare) {
     if (jailHome === realHome || jailHome === `${realHome}/`) {
       throw new SandboxEnvError("jailHome is the real HOME \u2014 the sandbox would read the user profile");
     }
@@ -26582,8 +26636,8 @@ var init_reap = __esm({
 
 // ../../packages/containment/dist/fence.js
 import { spawn as spawn3, spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync9, mkdirSync as mkdirSync3, realpathSync, writeFileSync as writeFileSync10 } from "fs";
-import { dirname as dirname6, isAbsolute as isAbsolute3, join as join19, posix as posix2 } from "path";
+import { existsSync as existsSync9, lchownSync, lstatSync as lstatSync3, mkdirSync as mkdirSync3, readdirSync as readdirSync2, realpathSync, statSync as statSync3, writeFileSync as writeFileSync10 } from "fs";
+import { basename as basename4, dirname as dirname6, isAbsolute as isAbsolute3, join as join19, posix as posix2, resolve as resolve4, sep as sep5 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function canonical(path5, label) {
   if (!isAbsolute3(path5)) {
@@ -26610,7 +26664,7 @@ function resolverFor(domain) {
 function pathDomainOf(spec) {
   return spec.pathDomain ?? "local";
 }
-function jailPasswd(uid = idOrNull("getuid"), gid = idOrNull("getgid")) {
+function jailPasswd(uid = localGuestUser()?.uid ?? null, gid = localGuestUser()?.gid ?? null) {
   const rows = ["root:x:0:0:root:/root:/usr/sbin/nologin"];
   if (uid !== null && gid !== null && uid !== 0) {
     rows.push(`${FENCE_USER}:x:${uid}:${gid}:fenced build user:${GUEST_JAIL}:/usr/sbin/nologin`);
@@ -26619,7 +26673,7 @@ function jailPasswd(uid = idOrNull("getuid"), gid = idOrNull("getgid")) {
   return `${rows.join("\n")}
 `;
 }
-function jailGroup(gid = idOrNull("getgid")) {
+function jailGroup(gid = localGuestUser()?.gid ?? null) {
   const rows = ["root:x:0:"];
   if (gid !== null && gid !== 0)
     rows.push(`${FENCE_USER}:x:${gid}:`);
@@ -26631,19 +26685,139 @@ function idOrNull(fn) {
   const f = process[fn];
   return typeof f === "function" ? f.call(process) : null;
 }
-function buildJail(root, guestUser) {
+function hostIds() {
+  const uid = idOrNull("getuid");
+  const gid = idOrNull("getgid");
+  return uid === null || gid === null ? null : { uid, gid };
+}
+function localGuestUser(ids2 = hostIds()) {
+  if (ids2 === null)
+    return null;
+  return ids2.uid === 0 ? REMAPPED_GUEST_USER : ids2;
+}
+function chownTree(dir, user) {
+  const stack = [dir];
+  for (let p = stack.pop(); p !== void 0; p = stack.pop()) {
+    lchownSync(p, user.uid, user.gid);
+    if (lstatSync3(p).isDirectory()) {
+      for (const entry of readdirSync2(p))
+        stack.push(join19(p, entry));
+    }
+  }
+}
+function canonicalPath(p) {
+  let head = resolve4(p);
+  const tail2 = [];
+  for (; ; ) {
+    try {
+      return join19(realpathSync.native(head), ...tail2.reverse());
+    } catch {
+      const up = dirname6(head);
+      if (up === head)
+        return resolve4(p);
+      tail2.push(basename4(head));
+      head = up;
+    }
+  }
+}
+function statOrAbsent(p, fn) {
+  try {
+    return fn();
+  } catch (err) {
+    const code = err.code;
+    if (code === "ENOENT" || code === "ENOTDIR")
+      return void 0;
+    throw new FenceError(`cannot stat ${JSON.stringify(p)}: ${err.message}`, {
+      cause: err
+    });
+  }
+}
+function fileIdentity(p) {
+  const st = statOrAbsent(p, () => statSync3(p, { bigint: true }));
+  return st === void 0 ? null : { dev: st.dev, ino: st.ino };
+}
+function isOrContains(outer, inner) {
+  const fold = process.platform === "win32" ? (s) => s.toLowerCase() : (s) => s;
+  const o = fold(canonicalPath(outer));
+  const i = fold(canonicalPath(inner));
+  const prefix = o.endsWith(sep5) ? o : o + sep5;
+  if (i === o || i.startsWith(prefix))
+    return true;
+  const target = fileIdentity(outer);
+  if (target === null || target.ino === 0n)
+    return false;
+  for (const start of physicalSpellings(canonicalPath(inner))) {
+    for (let a = start; ; a = dirname6(a)) {
+      const id = fileIdentity(a);
+      if (id !== null && id.ino !== 0n && id.dev === target.dev && id.ino === target.ino) {
+        return true;
+      }
+      if (dirname6(a) === a)
+        break;
+    }
+  }
+  return false;
+}
+function physicalSpellings(p) {
+  if (process.platform !== "darwin" || p.startsWith(DARWIN_DATA_VOLUME + sep5))
+    return [p];
+  const onData = DARWIN_DATA_VOLUME + p;
+  const logical = fileIdentity(p);
+  const physical = fileIdentity(onData);
+  const same = logical !== null && physical !== null && logical.dev === physical.dev && logical.ino === physical.ino;
+  return same ? [p, onData] : [p];
+}
+function realHomes(who) {
+  try {
+    return realHomeCandidates(process.env);
+  } catch (err) {
+    throw new FenceError(`${who}: ${err.message}`, { cause: err });
+  }
+}
+function assertHoldsNoRealHome(path5, what, who) {
+  for (const home of realHomes(who)) {
+    if (isOrContains(path5, home)) {
+      throw new FenceError(`${who}: ${what} ${JSON.stringify(path5)} is or contains the real home ${JSON.stringify(home)} \u2014 the jail would expose the developer's profile`);
+    }
+  }
+}
+function assertNoForeignLinks(paths) {
+  for (const p of paths) {
+    const st = statOrAbsent(p, () => lstatSync3(p));
+    if (st?.isSymbolicLink() === true) {
+      throw new FenceError(`buildJail: ${JSON.stringify(p)} is a pre-existing symlink \u2014 buildJail would write through it, and a jail directory is never a link`);
+    }
+    if (st?.isFile() === true && st.nlink > 1) {
+      throw new FenceError(`buildJail: ${JSON.stringify(p)} is a pre-existing file with ${String(st.nlink)} hard links \u2014 buildJail would overwrite an inode another path shares`);
+    }
+  }
+}
+function buildJail(root, guestUser, io = {}) {
+  const ids2 = io.ids === void 0 ? hostIds() : io.ids;
+  const guest = guestUser ?? localGuestUser(ids2);
   const jail = join19(root, JAIL_SEGMENT);
   const tmp = join19(root, JAIL_TMP_SEGMENT);
-  for (const dir of [jail, tmp, join19(jail, ".config"), join19(jail, ".cache"), join19(jail, ".npm")]) {
+  const dirs = [jail, tmp, join19(jail, ".config"), join19(jail, ".cache"), join19(jail, ".npm")];
+  const files = [".npmrc", JAIL_PASSWD_FILE, JAIL_GROUP_FILE, ".gitconfig"].map((f) => join19(jail, f));
+  assertHoldsNoRealHome(root, "the jail root", "buildJail");
+  assertNoForeignLinks([...dirs, ...files]);
+  assertHoldsNoRealHome(jail, "the jail directory", "buildJail");
+  assertHoldsNoRealHome(tmp, "the jail tmp directory", "buildJail");
+  for (const dir of dirs) {
     mkdirSync3(dir, { recursive: true });
   }
   writeFileSync10(join19(jail, ".npmrc"), "", "utf8");
-  writeFileSync10(join19(jail, JAIL_PASSWD_FILE), guestUser ? jailPasswd(guestUser.uid, guestUser.gid) : jailPasswd(), "utf8");
-  writeFileSync10(join19(jail, JAIL_GROUP_FILE), guestUser ? jailGroup(guestUser.gid) : jailGroup(), "utf8");
+  writeFileSync10(join19(jail, JAIL_PASSWD_FILE), guest ? jailPasswd(guest.uid, guest.gid) : jailPasswd(null, null), "utf8");
+  writeFileSync10(join19(jail, JAIL_GROUP_FILE), guest ? jailGroup(guest.gid) : jailGroup(null), "utf8");
   writeFileSync10(join19(jail, ".gitconfig"), '[user]\n	name = sandbox\n	email = sandbox@localhost\n[safe]\n	directory = *\n[url "https://github.com/"]\n	insteadOf = ssh://git@github.com/\n	insteadOf = git@github.com:\n', "utf8");
+  if (ids2?.uid === 0 && guest && guest.uid !== 0) {
+    const chown = io.chown ?? chownTree;
+    chown(jail, guest);
+    chown(tmp, guest);
+  }
   return { jail, tmp };
 }
-var FenceError, ContainmentError, ContainmentRefusalError, JAIL_PASSWD_FILE, JAIL_GROUP_FILE, GUEST_JAIL, FENCE_USER, JAIL_SEGMENT, JAIL_TMP_SEGMENT;
+var FenceError, ContainmentError, ContainmentRefusalError, JAIL_PASSWD_FILE, JAIL_GROUP_FILE, GUEST_JAIL, FENCE_USER, REMAPPED_GUEST_USER, JAIL_SEGMENT, JAIL_TMP_SEGMENT, DARWIN_DATA_VOLUME;
 var init_fence = __esm({
   "../../packages/containment/dist/fence.js"() {
     "use strict";
@@ -26664,8 +26838,10 @@ var init_fence = __esm({
     JAIL_GROUP_FILE = ".fence-group";
     GUEST_JAIL = "/fenced/jail";
     FENCE_USER = "fenced";
+    REMAPPED_GUEST_USER = { uid: 1e3, gid: 1e3 };
     JAIL_SEGMENT = "jail";
     JAIL_TMP_SEGMENT = "tmp";
+    DARWIN_DATA_VOLUME = "/System/Volumes/Data";
   }
 });
 
@@ -26818,7 +26994,27 @@ var init_dockerClient = __esm({
 // ../../packages/containment/dist/egressProxy.js
 import net from "net";
 import http from "http";
-var DEFAULT_INSTALL_ALLOWLIST;
+function parseDeniedHosts(output) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const line of output.split(/\r?\n/)) {
+    if (!line.startsWith(DENIAL_PREFIX))
+      continue;
+    let parsed;
+    try {
+      parsed = JSON.parse(line.slice(DENIAL_PREFIX.length));
+    } catch {
+      continue;
+    }
+    const host = parsed?.host;
+    if (typeof host !== "string")
+      continue;
+    const h = host.toLowerCase().replace(/\.$/, "");
+    if (HOSTNAME.test(h))
+      seen.add(h);
+  }
+  return [...seen];
+}
+var DEFAULT_INSTALL_ALLOWLIST, DENIAL_PREFIX, HOSTNAME;
 var init_egressProxy = __esm({
   "../../packages/containment/dist/egressProxy.js"() {
     "use strict";
@@ -26867,24 +27063,47 @@ var init_egressProxy = __esm({
       // allowlist than breadth.
       //
       // What it does NOT grant: `githubusercontent.com` is a DIFFERENT domain, so
-      // release assets and raw blobs stay denied. If a real install needs them,
-      // that should arrive as a measured egress denial, not a pre-emptive guess.
+      // raw blobs and `objects.githubusercontent.com` stay denied; only
+      // `release-assets.githubusercontent.com` is listed, above, for the Gradle
+      // wrapper. If a real install needs more, that should arrive as a measured
+      // egress denial, not a pre-emptive guess.
       //
-      // Proportionality: install already runs with `--ignore-scripts`, and the
-      // fenced environment carries no GitHub token, so the added capability is
-      // "fetch a public tarball or ref", not "act as us".
+      // WHO RUNS INSTALL SCRIPTS THROUGH THIS GRANT (TERM-1157). This comment used
+      // to say install "already runs with `--ignore-scripts`". That is true of
+      // `apps/merge-agent` (`src/sandbox/plan.ts` adds the flag on every branch)
+      // and false of `th run`: `packages/envspec/src/manifest.ts` derives a plain
+      // `npm ci`, so there every dependency's `preinstall`/`install`/`postinstall`
+      // executes behind this proxy. TERM-1157 chose to keep them running.
+      //
+      // For `th run`, then, the grant reaches code the repo's dependencies chose,
+      // not only the package manager. What bounds it:
+      //   - no credential of ours is in the fence: `auditEnv` (`env.ts`) refuses to
+      //     spawn when a variable's name or a GitHub-token-shaped value says
+      //     otherwise, so a script cannot act on GitHub as us;
+      //   - the fence holds the repo's tree and its dependencies, nothing else of
+      //     ours;
+      //   - every step after install runs with no network at all.
+      // What it does NOT bound: a script can download and run any public GitHub
+      // content, and one that brings its author's own token can push what the
+      // fence holds to its author's account. `registry.npmjs.org` above gives the
+      // same script the same reach (download anything, publish with its own
+      // token), so this entry adds a second address for a capability the install
+      // already has rather than a new one. That is the case for keeping it; it is
+      // not a claim that GitHub is read-only from here.
       "github.com"
     ];
+    DENIAL_PREFIX = "proxy-denied ";
+    HOSTNAME = /^[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?$/;
   }
 });
 
 // ../../packages/containment/dist/container.js
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { dirname as dirname7, join as join20 } from "path";
-import { chmodSync as chmodSync2, copyFileSync as copyFileSync2, existsSync as existsSync10, mkdtempSync, rmSync as rmSync6 } from "fs";
+import { chmodSync as chmodSync2, copyFileSync as copyFileSync2, existsSync as existsSync10, mkdtempSync, rmSync as rmSync6, statSync as statSync4 } from "fs";
 import { tmpdir } from "os";
 function scrubEnvPathsFor(containmentKind, host) {
-  return containmentKind === "container" ? { jailHome: GUEST.jail, tmpDir: GUEST.tmp } : { jailHome: host.jail, tmpDir: host.tmp };
+  return containmentKind === "container" ? { jailHome: GUEST.jail, tmpDir: GUEST.tmp, jailHomeNamespace: "guest" } : { jailHome: host.jail, tmpDir: host.tmp, jailHomeNamespace: "host" };
 }
 function buildTranslation(spec) {
   const roots = [
@@ -26892,11 +27111,11 @@ function buildTranslation(spec) {
     { raw: spec.jail, guest: GUEST.jail, label: "jail" },
     { raw: spec.tmp, guest: GUEST.tmp, label: "tmp" }
   ];
-  const resolve4 = resolverFor(pathDomainOf(spec));
+  const resolve5 = resolverFor(pathDomainOf(spec));
   const pairs = [];
   const seen = /* @__PURE__ */ new Set();
   for (const { raw, guest, label } of roots) {
-    for (const host of [raw, resolve4(raw, label)]) {
+    for (const host of [raw, resolve5(raw, label)]) {
       if (seen.has(host))
         continue;
       seen.add(host);
@@ -26979,21 +27198,36 @@ function labelArgs(labels) {
   }
   return out;
 }
-function hostUserFlag() {
-  const uid = typeof process.getuid === "function" ? process.getuid() : null;
-  const gid = typeof process.getgid === "function" ? process.getgid() : null;
-  if (uid === null || gid === null)
+function hostUserFlag(ids2 = hostIds()) {
+  const guest = localGuestUser(ids2);
+  if (guest === null)
     return [];
-  return [`--user=${uid}:${gid}`];
+  return [`--user=${String(guest.uid)}:${String(guest.gid)}`];
 }
-function guestUserFlag(spec) {
+function guestUserFlag(spec, ids2 = hostIds()) {
   const declared = spec.guestUser;
   if (declared)
     return [`--user=${declared.uid}:${declared.gid}`];
   if (pathDomainOf(spec) === "venue") {
     throw new FenceError("a venue-domain spec must declare guestUser: the tree is owned by the account that staged it on the venue, and this process\u2019s uid is a fact about a different machine. Handing the guest the local id gives it no write access to its own clone, and that EACCES reaches the classifier as the developer\u2019s suite failing.");
   }
-  return hostUserFlag();
+  return hostUserFlag(ids2);
+}
+function assertTreeHandedToGuest(spec, ids2 = hostIds(), ownerOf2 = (path5) => statSync4(path5).uid) {
+  if (pathDomainOf(spec) !== "local" || ids2?.uid !== 0)
+    return;
+  const guest = spec.guestUser ?? localGuestUser(ids2);
+  if (guest === null || guest.uid === 0)
+    return;
+  for (const [label, path5] of [
+    ["clone", spec.clone],
+    ["jail", spec.jail]
+  ]) {
+    const owner = ownerOf2(path5);
+    if (owner !== guest.uid) {
+      throw new FenceError(`refusing to run: this process is root, so the guest runs as uid ${String(guest.uid)}, but the ${label} at ${path5} is owned by uid ${String(owner)}. The guest could not write its own tree and the EACCES would read as the developer\u2019s suite failing. Hand it over first (chownTree, or buildJail for the jail).`);
+    }
+  }
 }
 function validateVolumeName(name, label) {
   if (!VOLUME_NAME.test(name) || name.length > VOLUME_NAME_MAX) {
@@ -27003,14 +27237,17 @@ function validateVolumeName(name, label) {
 }
 function stageMounts(spec) {
   const domain = pathDomainOf(spec);
-  const resolve4 = resolverFor(domain);
+  const resolve5 = resolverFor(domain);
   const volumes = spec.stageVolumes;
   if (domain === "venue") {
+    if (spec.cloneVolume !== void 0) {
+      throw new FenceError("a venue-domain spec must not declare cloneVolume: the venue names both of its volumes in stageVolumes, and a second name for the clone would leave two answers to which one is mounted.");
+    }
     if (volumes === void 0) {
       throw new FenceError("a venue-domain spec must declare stageVolumes: every writable host path on the venue is mounted noexec, so a bind mount of the staged clone cannot run the binaries an install step downloads (esbuild, swc, sharp, node-gyp \u2014 EACCES). The venue that staged the tree names the volumes it populated; a spec without them would reproduce that EACCES and report it as the developer\u2019s suite failing.");
     }
-    resolve4(spec.clone, "clone");
-    resolve4(spec.jail, "jail");
+    resolve5(spec.clone, "clone");
+    resolve5(spec.jail, "jail");
     return [
       `--volume=${validateVolumeName(volumes.clone, "the clone volume")}:${GUEST.clone}:rw`,
       `--volume=${validateVolumeName(volumes.jail, "the jail volume")}:${GUEST.jail}:rw`
@@ -27019,20 +27256,24 @@ function stageMounts(spec) {
   if (volumes !== void 0) {
     throw new FenceError("a local-domain spec must not declare stageVolumes: the paths are on this machine and ARE the mount sources, and nothing on the local path populates a volume \u2014 honouring the field would mount an empty clone. Volumes exist for the venue\u2019s noexec host only.");
   }
+  const clone = resolve5(spec.clone, "clone");
+  const cloneSource = spec.cloneVolume === void 0 ? clone : validateVolumeName(spec.cloneVolume, "the clone volume");
+  const jail = resolve5(spec.jail, "jail");
+  assertHoldsNoRealHome(jail, "the jail bind source", "stageMounts");
   return [
-    `--volume=${resolve4(spec.clone, "clone")}:${GUEST.clone}:rw`,
-    `--volume=${resolve4(spec.jail, "jail")}:${GUEST.jail}:rw`
+    `--volume=${cloneSource}:${GUEST.clone}:rw`,
+    `--volume=${jail}:${GUEST.jail}:rw`
   ];
 }
 function guestIdentityMounts(spec) {
   if (guestUserFlag(spec).length === 0)
     return [];
   const domain = pathDomainOf(spec);
-  const resolve4 = resolverFor(domain);
+  const resolve5 = resolverFor(domain);
   const under = domain === "venue" ? venueJoin : join20;
-  const jail = resolve4(spec.jail, "jail");
-  const passwd = resolve4(under(jail, JAIL_PASSWD_FILE), "the jail passwd file");
-  const group = resolve4(under(jail, JAIL_GROUP_FILE), "the jail group file");
+  const jail = resolve5(spec.jail, "jail");
+  const passwd = resolve5(under(jail, JAIL_PASSWD_FILE), "the jail passwd file");
+  const group = resolve5(under(jail, JAIL_GROUP_FILE), "the jail group file");
   return [`--volume=${passwd}:/etc/passwd:ro`, `--volume=${group}:/etc/group:ro`];
 }
 function containerArgs(spec, env, opts) {
@@ -27365,7 +27606,14 @@ async function startProxySidecar(d, allow, idBase, staged, labels) {
     await waitForProxyReady(d, proxyName);
     return {
       net: { network: netInt, proxyHost: proxyName, proxyPort: SIDECAR_PROXY_PORT },
-      teardown
+      teardown,
+      // A `docker logs` that fails yields no hosts. That loses the hint and
+      // changes nothing else: the list only ever adds words to a reason.
+      deniedHosts: () => {
+        const logs = dockerSync(d, ["logs", proxyName]);
+        return logs.ok ? parseDeniedHosts(`${logs.stdout}
+${logs.stderr}`) : [];
+      }
     };
   } catch (err) {
     teardown();
@@ -27431,6 +27679,7 @@ async function runContainedOn(d, spec, env, opts = {}) {
   assertDomainDeclared(d, spec);
   assertNotAmbientlySteered(d, spec);
   assertProxyStagedForVenue(spec, opts.proxyCode);
+  assertTreeHandedToGuest(spec);
   const leaks = auditEnv(env);
   if (leaks.length > 0) {
     throw new FenceError(`refusing to spawn: environment carries credential material (${leaks.join(", ")})`);
@@ -27451,7 +27700,8 @@ async function runContainedOn(d, spec, env, opts = {}) {
       net: sidecar?.net,
       labels: opts.labels
     });
-    return await spawnWorkload(d, idBase, argv, opts.timeoutMs ?? 9e5);
+    const result = await spawnWorkload(d, idBase, argv, opts.timeoutMs ?? 9e5);
+    return sidecar ? { ...result, egressDenied: sidecar.deniedHosts() } : result;
   } finally {
     sidecar?.teardown();
   }
@@ -27532,6 +27782,9 @@ var init_dist = __esm({
 });
 
 // ../../packages/envrun/dist/labels.js
+function runLabels(runId, callerLabels) {
+  return { ...callerLabels ?? {}, [RUN_ID_LABEL_KEY]: runId, [RUN_LABEL_KEY]: "term-350" };
+}
 function censusTotal(c) {
   return c.containers.length + c.volumes.length + c.networks.length;
 }
@@ -27615,12 +27868,13 @@ function judgeLeaks(peak, after, observation) {
     note
   };
 }
-var RUN_LABEL_KEY, LabelWatch, LEAK_STATES;
+var RUN_LABEL_KEY, RUN_ID_LABEL_KEY, LabelWatch, LEAK_STATES;
 var init_labels = __esm({
   "../../packages/envrun/dist/labels.js"() {
     "use strict";
     init_dist();
     RUN_LABEL_KEY = "supergoal.run";
+    RUN_ID_LABEL_KEY = "supergoal.run-id";
     LabelWatch = class {
       label;
       docker;
@@ -27971,6 +28225,7 @@ http
 });
 
 // ../../packages/envrun/dist/venue.js
+import { randomBytes as randomBytes8 } from "crypto";
 import { join as join22 } from "path";
 function localJailPaths(scratchRoot) {
   return {
@@ -28066,11 +28321,62 @@ function coerceToString(thrown) {
     return UNCOERCIBLE_THROWN;
   }
 }
+function localTreeOwner(ids2 = hostIds()) {
+  if (ids2?.uid !== 0)
+    return void 0;
+  return localGuestUser(ids2) ?? void 0;
+}
+function handLocalTreeToGuest(local, owner, chown = chownTree) {
+  if (owner === void 0)
+    return;
+  chown(local.cloneDir, owner);
+  chown(local.scratchRoot, owner);
+}
+function localCloneVolumeName(runId, suffix = randomBytes8(4).toString("hex")) {
+  const tail2 = `-${suffix}`;
+  const safe = runId.replace(/[^a-zA-Z0-9_.-]/g, "-");
+  const head = `th-clone-${safe}`.slice(0, VOLUME_NAME_MAX2 - tail2.length);
+  return validateVolumeName(`${head}${tail2}`, "the local clone volume");
+}
+function localCloneFillArgv(from, volume, owner) {
+  const chown = owner === null ? "" : ` && chown -R ${String(owner.uid)}:${String(owner.gid)} /dst`;
+  return [
+    "run",
+    "--rm",
+    "--network=none",
+    `--volume=${from}:/src:ro`,
+    `--volume=${validateVolumeName(volume, "the local clone volume")}:/dst:rw`,
+    "--",
+    STAGE_HELPER_IMAGE,
+    "sh",
+    "-c",
+    `cp -a /src/. /dst/${chown}`
+  ];
+}
 function acquireLocalLease(runId) {
   const docker3 = localDockerClient();
   const containment = selectContainment([containerContainmentOn(docker3)]);
   let released = false;
   const stagedProxies = [];
+  const owner = localTreeOwner();
+  let cloneVolume;
+  const createdVolumes = [];
+  const fillCloneVolume = (cloneDir) => {
+    const name = localCloneVolumeName(runId);
+    const created = docker3.sync(["volume", "create", `--label=${STAGE_VOLUME_LABEL_KEY}=${runId}`, "--", name], { timeoutMs: LOCAL_VOLUME_CREATE_TIMEOUT_MS });
+    if (created.error || created.status !== 0) {
+      throw new ContainmentRefusalError(`could not create the clone volume ${name} on the local daemon: ${(created.error?.message ?? created.stderr).trim().slice(0, 300)}`);
+    }
+    createdVolumes.push(name);
+    const from = resolverFor("local")(cloneDir, "clone");
+    const filled = docker3.sync(localCloneFillArgv(from, name, localGuestUser()), {
+      timeoutMs: LOCAL_CLONE_FILL_TIMEOUT_MS
+    });
+    if (filled.error || filled.status !== 0) {
+      throw new ContainmentRefusalError(`could not copy the clone into its volume ${name}: ${(filled.error?.message ?? filled.stderr).trim().slice(0, 300)}`);
+    }
+    return name;
+  };
   const lease = {
     kind: "local",
     runId,
@@ -28080,28 +28386,32 @@ function acquireLocalLease(runId) {
     // the paths are on this machine AND `canonical()` is what should resolve
     // them, which is the behaviour every local run has always had.
     pathDomain: "local",
+    // Spread rather than `guestUser: owner`, so a non-root lease has no such key
+    // at all — the same object every local run has always had.
+    ...owner === void 0 ? {} : { guestUser: owner },
     get released() {
       return released;
     },
-    stage: (local) => (
-      // The local venue IS the developer's machine, so staging is the identity
-      // and the paths are already canonical here. This is not a stub: it is the
-      // one venue for which the answer is "nothing to copy", and having it go
-      // through the same method as a hosted venue is what stops `thrun.ts` from
-      // ever holding a path it did not get from a venue.
-      //
-      // `jail` and `tmp` are DERIVED here rather than carried in on `LocalTree`,
-      // because the join differs by side and the venue owns the spelling of its
-      // own paths: the host's `join` here, `venueJoin` on a hosted venue. The
-      // segments are one constant in `fence.ts`, so the tree `buildJail` wrote
-      // and the tree a venue mounts cannot drift apart.
-      Promise.resolve({
+    get cloneVolume() {
+      return cloneVolume;
+    },
+    stage: (local) => {
+      if (released) {
+        return Promise.reject(new LeaseReleasedError("this lease was already released, so a clone volume made now would never be removed."));
+      }
+      try {
+        handLocalTreeToGuest(local, owner);
+        cloneVolume = fillCloneVolume(local.cloneDir);
+      } catch (err) {
+        return Promise.reject(err instanceof Error ? err : new Error(String(err)));
+      }
+      return Promise.resolve({
         cloneDir: local.cloneDir,
         scratchRoot: local.scratchRoot,
         previewDir: local.previewDir,
         ...localJailPaths(local.scratchRoot)
-      })
-    ),
+      });
+    },
     // The containment function verbatim, which is the point of the barrel
     // re-export rather than a copy here: this venue's daemon and this process
     // share a filesystem, so the directory it makes under `tmpdir()` is already
@@ -28171,6 +28481,25 @@ function acquireLocalLease(runId) {
       const staged = stagedProxies.splice(0, stagedProxies.length);
       for (const s of staged)
         s.cleanup();
+      const volumeFailures = [];
+      for (const name of createdVolumes.splice(0, createdVolumes.length)) {
+        const removed = docker3.sync(["volume", "rm", "-f", "--", name], {
+          timeoutMs: LOCAL_VOLUME_CREATE_TIMEOUT_MS
+        });
+        if (removed.error || removed.status !== 0) {
+          volumeFailures.push(`${name}: ${(removed.error?.message ?? removed.stderr).trim().slice(0, 200)}`);
+        }
+      }
+      cloneVolume = void 0;
+      if (volumeFailures.length > 0) {
+        return Promise.resolve({
+          kind: "local",
+          released: true,
+          alreadyReleased: false,
+          error: `could not remove the clone volume: ${volumeFailures.join("; ")}`,
+          detail: `the lease is closed, but a clone volume remains (label ${STAGE_VOLUME_LABEL_KEY})`
+        });
+      }
       return Promise.resolve({
         kind: "local",
         released: true,
@@ -28182,7 +28511,7 @@ function acquireLocalLease(runId) {
   };
   return lease;
 }
-var VenueRollbackError, UNREADABLE_MESSAGE, UNREADABLE_NAME, UNCOERCIBLE_THROWN, UNDESCRIBABLE_THROWN, UNLISTABLE_ROLLBACK_FAILURES, RELEASED_LEASE_CENSUS_REASON, LeaseReleasedError;
+var VenueRollbackError, UNREADABLE_MESSAGE, UNREADABLE_NAME, UNCOERCIBLE_THROWN, UNDESCRIBABLE_THROWN, UNLISTABLE_ROLLBACK_FAILURES, RELEASED_LEASE_CENSUS_REASON, LeaseReleasedError, STAGE_HELPER_IMAGE, STAGE_VOLUME_LABEL_KEY, VOLUME_NAME_MAX2, LOCAL_VOLUME_CREATE_TIMEOUT_MS, LOCAL_CLONE_FILL_TIMEOUT_MS;
 var init_venue = __esm({
   "../../packages/envrun/dist/venue.js"() {
     "use strict";
@@ -28207,6 +28536,11 @@ var init_venue = __esm({
     LeaseReleasedError = class extends Error {
       name = "LeaseReleasedError";
     };
+    STAGE_HELPER_IMAGE = "busybox:1.37.0";
+    STAGE_VOLUME_LABEL_KEY = "terminalhire.stage";
+    VOLUME_NAME_MAX2 = 128;
+    LOCAL_VOLUME_CREATE_TIMEOUT_MS = 3e4;
+    LOCAL_CLONE_FILL_TIMEOUT_MS = 6e5;
   }
 });
 
@@ -28305,7 +28639,7 @@ function imageForRuntime(runtime, override, version, variant) {
   if (!shape) {
     throw new RunRefusalError(`no container image is mapped for runtime ${JSON.stringify(runtime)}. Refusing to run it in the Node image: a bare "command not found" exits 127, which classifyVerification already owns as ours \u2014 but a test script that RUNS and fails inside on the missing tool exits with its own status and prints to stdout, and that falls through to tests-failed \u2014 a false red blamed on the repo.`);
   }
-  if (version === void 0 || version === null)
+  if (version === void 0 || version === null || shape.fixed)
     return unversionedImage(shape);
   if (!TAG_VERSION.test(version)) {
     throw new RunRefusalError(`runtime version ${JSON.stringify(version)} is not a bare version, so no image tag can be built from it. Refusing rather than booting the default: the repo asked for a version, and supplying a different one silently is what TERM-643 fixed.`);
@@ -28333,8 +28667,8 @@ function resolvePublishedImage(image, runtime, version, variant) {
   throw new RunRefusalError(`the repo declares ${runtime} ${version}, and no image is published at ${image}` + (shape && shape.declaredIsFloor ? `. Our default is ${shape.defaultVersion}, which is OLDER than that, so falling back would run the repo under a toolchain it says it cannot use` : `. ${runtime} treats a declared version as an exact pin, not a minimum, so a different one is a different environment`) + ". Refusing rather than booting a version the repo did not ask for \u2014 that substitution is what made this class of failure unattributable (TERM-643). Pass an explicit image to override.");
 }
 function resolveImageForSpec(spec, override) {
-  const declared = spec.runtimeVersion;
   const variant = imageVariantFor(spec);
+  const declared = shapeFor(spec.runtime, variant)?.fixed ? null : spec.runtimeVersion;
   const image = imageForRuntime(spec.runtime, override, declared, variant);
   const constructed = (() => {
     if (declared === null)
@@ -28351,12 +28685,19 @@ function resolveImageForSpec(spec, override) {
   return image;
 }
 function installEnvironmentFailureNote(install, image) {
-  const base = `the install step exited ${String(install.exitCode)}, so the test command was never invoked. The repo has not been judged; this is an environment failure.`;
+  const base = `the install step exited ${String(install.exitCode)}, so the test command was never invoked. The repo has not been judged; this is an environment failure.` + refusedHostsSentence(install.egressDenied ?? []);
   if (!MISSING_IMAGE_SHAPE.test(`${install.stdout}
 ${install.stderr}`))
     return base;
   return `${base} The container image ${image} is not present on this machine \u2014 run \`docker pull ${image}\` and try again.`;
 }
+function refusedHostsSentence(hosts) {
+  if (hosts.length === 0)
+    return "";
+  const named = hosts.slice(0, MAX_NAMED_REFUSED_HOSTS).join(", ");
+  const rest = hosts.length - MAX_NAMED_REFUSED_HOSTS;
+  return ` During install the network proxy refused ${named}` + (rest > 0 ? ` and ${String(rest)} more` : "") + ". Install reaches only the hosts on its allowlist, so a dependency whose install script downloads from any other host cannot get what it asked for.";
+}
 function classifySingleRun(run2) {
   return classifyVerification(run2).outcome;
 }
@@ -28418,6 +28759,8 @@ async function runEnvironmentSpec(req) {
         // TERM-913: the third answer about that machine — which volumes the
         // fence mounts in place of the noexec stage. Undefined on a local lease.
         stageVolumes: req.lease.stageVolumes,
+        // TERM-1106: the local venue's copy of the clone. Undefined on a hosted lease.
+        cloneVolume: req.lease.cloneVolume,
         env,
         image,
         labels,
@@ -28452,6 +28795,8 @@ async function runEnvironmentSpec(req) {
         // TERM-913: the third answer about that machine — which volumes the
         // fence mounts in place of the noexec stage. Undefined on a local lease.
         stageVolumes: req.lease.stageVolumes,
+        // TERM-1106: the local venue's copy of the clone. Undefined on a hosted lease.
+        cloneVolume: req.lease.cloneVolume,
         env,
         image,
         labels,
@@ -28511,6 +28856,7 @@ async function runStep(containment, r) {
     pathDomain: r.pathDomain,
     guestUser: r.guestUser,
     stageVolumes: r.stageVolumes,
+    cloneVolume: r.cloneVolume,
     program: "/bin/sh",
     args: ["-c", withUserScriptPath(r.command)]
   };
@@ -28530,10 +28876,11 @@ async function runStep(containment, r) {
     stdout: res.stdout,
     stderr: res.stderr,
     timedOut: res.timedOut,
-    wallMs: Date.now() - startedAt
+    wallMs: Date.now() - startedAt,
+    ...res.egressDenied && res.egressDenied.length > 0 ? { egressDenied: [...new Set(res.egressDenied)] } : {}
   };
 }
-var EnvRunError, RunRefusalError, MAX_CAUSE_FRAMES, CHAIN_UNREADABLE, CHAIN_TOO_DEEP, RUNTIME_IMAGES, JVM_GRADLE_IMAGE, unversionedImage, TAG_VERSION, dockerManifestProbe, manifestProbe, MISSING_IMAGE_SHAPE;
+var EnvRunError, RunRefusalError, MAX_CAUSE_FRAMES, CHAIN_UNREADABLE, CHAIN_TOO_DEEP, RUNTIME_IMAGES, JVM_GRADLE_IMAGE, unversionedImage, TAG_VERSION, dockerManifestProbe, manifestProbe, MISSING_IMAGE_SHAPE, MAX_NAMED_REFUSED_HOSTS;
 var init_execute = __esm({
   "../../packages/envrun/dist/execute.js"() {
     "use strict";
@@ -28620,6 +28967,26 @@ var init_execute = __esm({
         suffix: "",
         defaultVersion: "21",
         declaredIsFloor: true
+      },
+      /**
+       * TERM-1123. OUR image (`packages/envrun/images/cpp/Dockerfile`): Debian bookworm
+       * with the C/C++ toolchain, CMake, Meson and the common -dev libraries baked in.
+       * No official image carries that set. Libraries are baked rather than installed per
+       * run because the install step has network only through the allowlist, and apt is
+       * not on it; a repo needing a library the image lacks gets `test-command-unavailable`
+       * (`isMissingSystemDependency`), never a red.
+       *
+       * `fixed`: a C/C++ repo declares no compiler version envspec can read, so there is
+       * nothing to derive and nothing to probe. The tag moves only when the Dockerfile
+       * does. It lives in a PUBLIC repository, apart from the private venue images, so a
+       * developer's own Docker can pull it with no credential.
+       */
+      cpp: {
+        repository: "us-east1-docker.pkg.dev/terminalhire-pool/runtime-images/cpp",
+        suffix: "",
+        defaultVersion: "1",
+        declaredIsFloor: false,
+        fixed: true
       }
     };
     JVM_GRADLE_IMAGE = {
@@ -28640,6 +29007,7 @@ var init_execute = __esm({
     };
     manifestProbe = dockerManifestProbe;
     MISSING_IMAGE_SHAPE = /Unable to find image ['"][^'"]*['"] locally/i;
+    MAX_NAMED_REFUSED_HOSTS = 5;
   }
 });
 
@@ -28714,7 +29082,7 @@ var init_dsse = __esm({
 });
 
 // ../../packages/attest/dist/sealedbox.js
-import { createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv3, diffieHellman, generateKeyPairSync as generateKeyPairSync2, hkdfSync as hkdfSync2, randomBytes as randomBytes8 } from "crypto";
+import { createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv3, diffieHellman, generateKeyPairSync as generateKeyPairSync2, hkdfSync as hkdfSync2, randomBytes as randomBytes9 } from "crypto";
 var init_sealedbox = __esm({
   "../../packages/attest/dist/sealedbox.js"() {
     "use strict";
@@ -28724,7 +29092,7 @@ var init_sealedbox = __esm({
 });
 
 // ../../packages/attest/dist/aead.js
-import { createCipheriv as createCipheriv4, createDecipheriv as createDecipheriv4, randomBytes as randomBytes9 } from "crypto";
+import { createCipheriv as createCipheriv4, createDecipheriv as createDecipheriv4, randomBytes as randomBytes10 } from "crypto";
 var init_aead = __esm({
   "../../packages/attest/dist/aead.js"() {
     "use strict";
@@ -29444,7 +29812,7 @@ var init_result = __esm({
 });
 
 // ../../packages/envrun/dist/attestation.js
-import { createHash as createHash8, randomBytes as randomBytes10 } from "crypto";
+import { createHash as createHash8, randomBytes as randomBytes11 } from "crypto";
 function contradicts(outcome, counts, exitCode) {
   const budget = OUTCOME_TO_BUDGET[outcome];
   if (budget === null)
@@ -29624,7 +29992,7 @@ function toAcceptancePredicate(pair, opts = {}) {
       // RepoDigest (`repo@sha256:…`) carries the repo name and the content hash, and the
       // tag it drops is the part a registry can re-point (TERM-893).
       enclave_measurement: localMeasurement(patched.containerImageDigest),
-      nonce: opts.nonce ?? randomBytes10(16).toString("hex"),
+      nonce: opts.nonce ?? randomBytes11(16).toString("hex"),
       run_policy: { max_attempts: opts.maxAttempts ?? 1, budget_outcome: budget }
     }
   };
@@ -30602,12 +30970,12 @@ function socketErrorReason(err) {
   return err.name;
 }
 function fetchAttestationOverTls(req) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     let whole;
     const settle = (reading) => {
       if (whole !== void 0)
         clearTimeout(whole);
-      resolve4(reading);
+      resolve5(reading);
     };
     let cert;
     let key;
@@ -31808,7 +32176,7 @@ function makeLease(p) {
     }
   };
 }
-var SSH_READY_BUDGET_MS, SSH_PROBE_INTERVAL_MS, SSH_PROBE_TIMEOUT_MS, TUNNEL_BUDGET_MS, TUNNEL_POLL_INTERVAL_MS, GOOGLE_JWKS_URL, JWKS_FETCH_TIMEOUT_MS, CREDENTIAL_QUERY_PARAM, UNDECODABLE, STAGE_PUSH_TIMEOUT_MS, DISPATCHED_PROBE_TIMEOUT_MS, DISPATCHED_STATUS_ARGV, DISPATCHED_GIT_CANDIDATES, PROXY_CLEANUP_TIMEOUT_MS, OWNER_PROBE_TIMEOUT_MS, BOOT_TIMEOUT_MS, MKDIR_TIMEOUT_MS, DELETE_TIMEOUT_MS, LOCAL_GCLOUD_TIMEOUT_MS, SERVICE_ACCOUNT_ACTIVATE_TIMEOUT_MS, SOCKET_DIR_PREFIX, VENUE_SOCKET_NAME, HostedVenueError, VENUE_GCLOUD_CONFIG, SERVICE_ACCOUNT_SUFFIX, GCLOUD_PRINCIPAL_OVERRIDES, defaultHostedVenueIo, VENUE_SSH_USER, GCE_METADATA_IDENTITY_URL, COMPACT_JWT, STAGE_HELPER_IMAGE, VOLUME_CREATE_TIMEOUT_MS, EXEC_PROBE_TIMEOUT_MS, POPULATE_TIMEOUT_MS, STAGE_VOLUME_LABEL_KEY, STAGE_PROOF_PREFIX, IAP_NOT_READY, IAP_BACKEND_UNREACHABLE, IAP_DENIED, TERMINAL_GCP, INSTANCE_NOT_RUNNING, PREEMPTED, HOST_KEY_MISMATCH, SSH_KEY_NOT_READY, DAEMON_NOT_READY, SSH_NOT_ANSWERING, CS_ATTEST_PORT, CS_DOCKER_PORT, CS_READY_BUDGET_MS, CS_ATTEST_TIMEOUT_MS, CS_PULL_TIMEOUT_MS, CS_ATTEST_INTERVAL_MS, OPENSSL_TIMEOUT_MS, CS_RUN_ARGS, CS_GUEST_USER, CS_STAGE_ROOT, CLIENT_CERT_STAND_IN;
+var SSH_READY_BUDGET_MS, SSH_PROBE_INTERVAL_MS, SSH_PROBE_TIMEOUT_MS, TUNNEL_BUDGET_MS, TUNNEL_POLL_INTERVAL_MS, GOOGLE_JWKS_URL, JWKS_FETCH_TIMEOUT_MS, CREDENTIAL_QUERY_PARAM, UNDECODABLE, STAGE_PUSH_TIMEOUT_MS, DISPATCHED_PROBE_TIMEOUT_MS, DISPATCHED_STATUS_ARGV, DISPATCHED_GIT_CANDIDATES, PROXY_CLEANUP_TIMEOUT_MS, OWNER_PROBE_TIMEOUT_MS, BOOT_TIMEOUT_MS, MKDIR_TIMEOUT_MS, DELETE_TIMEOUT_MS, LOCAL_GCLOUD_TIMEOUT_MS, SERVICE_ACCOUNT_ACTIVATE_TIMEOUT_MS, SOCKET_DIR_PREFIX, VENUE_SOCKET_NAME, HostedVenueError, VENUE_GCLOUD_CONFIG, SERVICE_ACCOUNT_SUFFIX, GCLOUD_PRINCIPAL_OVERRIDES, defaultHostedVenueIo, VENUE_SSH_USER, GCE_METADATA_IDENTITY_URL, COMPACT_JWT, VOLUME_CREATE_TIMEOUT_MS, EXEC_PROBE_TIMEOUT_MS, POPULATE_TIMEOUT_MS, STAGE_PROOF_PREFIX, IAP_NOT_READY, IAP_BACKEND_UNREACHABLE, IAP_DENIED, TERMINAL_GCP, INSTANCE_NOT_RUNNING, PREEMPTED, HOST_KEY_MISMATCH, SSH_KEY_NOT_READY, DAEMON_NOT_READY, SSH_NOT_ANSWERING, CS_ATTEST_PORT, CS_DOCKER_PORT, CS_READY_BUDGET_MS, CS_ATTEST_TIMEOUT_MS, CS_PULL_TIMEOUT_MS, CS_ATTEST_INTERVAL_MS, OPENSSL_TIMEOUT_MS, CS_RUN_ARGS, CS_GUEST_USER, CS_STAGE_ROOT, CLIENT_CERT_STAND_IN;
 var init_hostedVenue = __esm({
   "../../packages/envrun/dist/hostedVenue.js"() {
     "use strict";
@@ -31957,18 +32325,18 @@ var init_hostedVenue = __esm({
           for (let i = 0; i < n; i += 1) {
             const server = createServer();
             servers.push(server);
-            await new Promise((resolve4, reject) => {
+            await new Promise((resolve5, reject) => {
               server.once("error", reject);
               server.listen(0, "localhost", () => {
-                resolve4();
+                resolve5();
               });
             });
           }
           return servers.map((s) => s.address().port);
         } finally {
-          await Promise.all(servers.map((s) => new Promise((resolve4) => {
+          await Promise.all(servers.map((s) => new Promise((resolve5) => {
             s.close(() => {
-              resolve4();
+              resolve5();
             });
           })));
         }
@@ -31982,11 +32350,9 @@ var init_hostedVenue = __esm({
     VENUE_SSH_USER = "th-runner";
     GCE_METADATA_IDENTITY_URL = "http://169.254.169.254/computeMetadata/v1/instance/service-accounts/default/identity";
     COMPACT_JWT = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;
-    STAGE_HELPER_IMAGE = "busybox:1.37.0";
     VOLUME_CREATE_TIMEOUT_MS = 3e4;
     EXEC_PROBE_TIMEOUT_MS = 12e4;
     POPULATE_TIMEOUT_MS = STAGE_PUSH_TIMEOUT_MS;
-    STAGE_VOLUME_LABEL_KEY = "terminalhire.stage";
     STAGE_PROOF_PREFIX = ".th-proven-";
     IAP_NOT_READY = /\b4047\s*[:\]]/;
     IAP_BACKEND_UNREACHABLE = /\b4003\s*[:\]]/;
@@ -32594,6 +32960,9 @@ function detectRuntime(repo) {
   if (candidates.length === 0 && repo.listFiles("").some((f) => f.endsWith(".java"))) {
     candidates.push("jvm");
   }
+  if (!candidates.includes("cpp") && MAKEFILE_NAMES.some((file) => repo.exists(file)) && repo.listFiles("").some((f) => C_FAMILY_SOURCE.test(f))) {
+    candidates.push("cpp");
+  }
   return { runtime: candidates[0] ?? "unknown", candidates };
 }
 function readJsonObject(repo, path5) {
@@ -32746,6 +33115,44 @@ function rehearse(command) {
   const home = '"$R/.terminalhire-rehearsal-home"';
   return `{ R="$HOME"; rm -rf ${copy} ${home}; mkdir -p ${home} && cp -R . ${copy} && (cd ${copy} && HOME=${home} GRADLE_USER_HOME="$R/.gradle" JAVA_TOOL_OPTIONS="$JAVA_TOOL_OPTIONS -Duser.home=$R/.terminalhire-rehearsal-home" ${command}); rm -rf ${copy} ${home}; true; }`;
 }
+function cmakeCode(text) {
+  return text.replace(/#\[(=*)\[[\s\S]*?\]\1\]/g, "").replace(/#.*$/gm, "");
+}
+function makeTargets(text) {
+  const targets = /* @__PURE__ */ new Set();
+  for (const line of text.split("\n")) {
+    if (line.startsWith("	"))
+      continue;
+    const rule = /^([^:=#\t][^:=#]*?)[ \t]*::?(?!:?=)/.exec(line);
+    if (rule)
+      for (const name of rule[1].trim().split(/\s+/))
+        targets.add(name);
+  }
+  return targets;
+}
+function cppCommands(repo) {
+  const cmake = repo.readText("CMakeLists.txt");
+  if (cmake !== null) {
+    return CMAKE_DECLARES_TESTS.test(cmakeCode(cmake)) ? {
+      install: "cmake -S . -B build -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTING=ON",
+      test: "cmake --build build --parallel && ctest --test-dir build --output-on-failure"
+    } : { install: null, test: null };
+  }
+  const meson = repo.readText("meson.build");
+  if (meson !== null) {
+    return /\btest\s*\(/.test(meson) ? { install: "meson setup build", test: "meson test -C build" } : { install: null, test: null };
+  }
+  const name = repo.listNames("").find((file) => MAKEFILE_NAMES.includes(file));
+  const makefile = name === void 0 ? null : repo.readText(name);
+  if (makefile !== null) {
+    const targets = makeTargets(makefile);
+    if (targets.has("test"))
+      return { install: null, test: "make test" };
+    if (targets.has("check"))
+      return { install: null, test: "make check" };
+  }
+  return { install: null, test: null };
+}
 function otherRuntimeCommands(repo, runtime) {
   switch (runtime) {
     case "go":
@@ -32789,6 +33196,8 @@ function otherRuntimeCommands(repo, runtime) {
         test: `${wrapper} test --offline --no-build-cache`
       };
     }
+    case "cpp":
+      return cppCommands(repo);
     default:
       return { install: null, test: null };
   }
@@ -32855,7 +33264,7 @@ function matchFirst(text, pattern) {
   const match2 = pattern.exec(text);
   return match2 === null ? null : match2[1];
 }
-var RUNTIME_MANIFESTS, MANIFEST_FILENAMES, JVM_BUILD_FILES, NPM_PLACEHOLDER_TEST, REQUIREMENT_SPECIFIER, EXACT_VERSION;
+var RUNTIME_MANIFESTS, MAKEFILE_NAMES, C_FAMILY_SOURCE, MANIFEST_FILENAMES, JVM_BUILD_FILES, NPM_PLACEHOLDER_TEST, REQUIREMENT_SPECIFIER, CPP_BUILD_FILES, CMAKE_DECLARES_TESTS, EXACT_VERSION;
 var init_manifest2 = __esm({
   "../../packages/envspec/dist/manifest.js"() {
     "use strict";
@@ -32866,12 +33275,19 @@ var init_manifest2 = __esm({
       { runtime: "rust", files: ["Cargo.toml"] },
       { runtime: "jvm", files: ["pom.xml", "build.gradle", "build.gradle.kts"] },
       { runtime: "ruby", files: ["Gemfile"] },
-      { runtime: "dotnet", files: [] }
+      { runtime: "dotnet", files: [] },
+      // Last, so an earlier runtime keeps precedence: a Python package with a C
+      // extension built by CMake is still a Python repo, with cpp recorded second.
+      { runtime: "cpp", files: ["CMakeLists.txt", "meson.build"] }
     ];
-    MANIFEST_FILENAMES = RUNTIME_MANIFESTS.flatMap((m) => m.files).concat(["*.csproj", "*.fsproj", "*.sln"]).sort();
+    MAKEFILE_NAMES = ["GNUmakefile", "Makefile", "makefile"];
+    C_FAMILY_SOURCE = /\.(?:c|cc|cpp|cxx|h|hpp|hh)$/i;
+    MANIFEST_FILENAMES = RUNTIME_MANIFESTS.flatMap((m) => m.files).concat(["*.csproj", "*.fsproj", "*.sln"], MAKEFILE_NAMES).sort();
     JVM_BUILD_FILES = ["build.gradle", "build.gradle.kts", "pom.xml"];
     NPM_PLACEHOLDER_TEST = /^echo\s+["']?Error:\s*no test specified["']?\s*&&\s*exit\s+1$/;
     REQUIREMENT_SPECIFIER = /^[A-Za-z0-9._-]+(\[[A-Za-z0-9._,-]+\])?([<>=!~]=?[A-Za-z0-9._*+-]+(,[<>=!~]=?[A-Za-z0-9._*+-]+)*)?$/;
+    CPP_BUILD_FILES = ["CMakeLists.txt", "meson.build", ...MAKEFILE_NAMES];
+    CMAKE_DECLARES_TESTS = /\benable_testing\s*\(|\binclude\s*\(\s*CTest\s*\)|\badd_test\s*\(/;
     EXACT_VERSION = /^v?(\d+(?:\.\d+){0,2})$/;
   }
 });
@@ -32944,11 +33360,11 @@ var init_references = __esm({
 });
 
 // ../../packages/envspec/dist/repo.js
-import { readdirSync as readdirSync2, readFileSync as readFileSync12, statSync as statSync3 } from "fs";
-import { join as join25, relative as relative2, sep as sep5 } from "path";
+import { readdirSync as readdirSync3, readFileSync as readFileSync12, statSync as statSync5 } from "fs";
+import { join as join25, relative as relative2, sep as sep6 } from "path";
 function createRepoReader(repoPath) {
   const resolveIn = (relativePath) => relativePath === "" ? repoPath : join25(repoPath, relativePath);
-  const toPosix = (absolute) => relative2(repoPath, absolute).split(sep5).join("/");
+  const toPosix = (absolute) => relative2(repoPath, absolute).split(sep6).join("/");
   const readText = (relativePath) => {
     try {
       return readFileSync12(resolveIn(relativePath), "utf8");
@@ -32958,7 +33374,7 @@ function createRepoReader(repoPath) {
   };
   const statOf = (relativePath) => {
     try {
-      return statSync3(resolveIn(relativePath));
+      return statSync5(resolveIn(relativePath));
     } catch {
       return null;
     }
@@ -32970,7 +33386,7 @@ function createRepoReader(repoPath) {
         return;
       let names;
       try {
-        names = readdirSync2(dir);
+        names = readdirSync3(dir);
       } catch {
         return;
       }
@@ -33005,7 +33421,7 @@ function createRepoReader(repoPath) {
       if (st === null || !st.isDirectory())
         return [];
       try {
-        return readdirSync2(resolveIn(relativeDir)).slice().sort();
+        return readdirSync3(resolveIn(relativeDir)).slice().sort();
       } catch {
         return [];
       }
@@ -33330,7 +33746,7 @@ function deriveFromReader(repo) {
     });
   }
   const version = deriveRuntimeVersion(repo, runtime, job);
-  if (version.value === null && runtime !== "unknown") {
+  if (version.value === null && runtime !== "unknown" && runtime !== "cpp") {
     unresolved.push({
       kind: "runtime-version-undeclared",
       runtime,
@@ -33472,6 +33888,8 @@ function testSearchPaths(runtime, workflowFiles) {
     paths.push("Gemfile", "Rakefile");
   if (runtime === "jvm")
     paths.push(...JVM_BUILD_FILES);
+  if (runtime === "cpp")
+    paths.push(...CPP_BUILD_FILES);
   if (runtime === "unknown")
     paths.push(...MANIFEST_FILENAMES);
   return [...new Set(paths)].sort();
@@ -33492,8 +33910,24 @@ function describeTestSearch(repo, runtime, workflowFiles) {
   if (runtime === "jvm" && !JVM_BUILD_FILES.some((file) => repo.exists(file))) {
     return `${ciPart}, and the repo has Java sources but no build file (${JVM_BUILD_FILES.join(", ")}), so there is no build to run tests with. Compiling the sources with \`javac\` alone would run no tests`;
   }
+  if (runtime === "cpp")
+    return `${ciPart}, and ${describeCppSearch(repo)}`;
   return `${ciPart}, and no ${runtime} test convention applies to this tree`;
 }
+function describeCppSearch(repo) {
+  const cmake = repo.readText("CMakeLists.txt");
+  if (cmake !== null && !CMAKE_DECLARES_TESTS.test(cmakeCode(cmake))) {
+    return "`CMakeLists.txt` registers no tests: no `enable_testing()`, `include(CTest)` or `add_test()`";
+  }
+  if (cmake === null && repo.exists("meson.build")) {
+    return "`meson.build` declares no `test()`";
+  }
+  const makefile = repo.listNames("").find((name) => MAKEFILE_NAMES.includes(name));
+  if (cmake === null && makefile !== void 0) {
+    return `\`${makefile}\` has no \`test\` or \`check\` target`;
+  }
+  return `no C/C++ test convention applies to this tree (looked in ${CPP_BUILD_FILES.join(", ")})`;
+}
 function installSearchPaths(runtime, workflowFiles) {
   const paths = [...workflowFiles];
   if (runtime === "node")
@@ -33502,6 +33936,8 @@ function installSearchPaths(runtime, workflowFiles) {
     paths.push("poetry.lock", "pyproject.toml", "requirements.txt", "uv.lock");
   if (runtime === "jvm")
     paths.push(...JVM_BUILD_FILES);
+  if (runtime === "cpp")
+    paths.push(...CPP_BUILD_FILES);
   if (runtime === "unknown")
     paths.push(...MANIFEST_FILENAMES);
   return [...new Set(paths)].sort();
@@ -33583,15 +34019,20 @@ var init_dist3 = __esm({
 // ../../packages/envrun/dist/gradleTestSummary.js
 import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync14 } from "fs";
 import { join as join26 } from "path";
-function stageGradleTestSummary(jailHome) {
+function stageGradleTestSummary(jailHome, guestUser, io = {}) {
   const dir = join26(jailHome, ".gradle", "init.d");
   mkdirSync5(dir, { recursive: true });
   writeFileSync14(join26(dir, "terminalhire-test-summary.gradle"), GRADLE_TEST_SUMMARY_INIT);
+  const ids2 = io.ids === void 0 ? hostIds() : io.ids;
+  if (ids2?.uid === 0 && guestUser && guestUser.uid !== 0) {
+    (io.chown ?? chownTree)(join26(jailHome, ".gradle"), guestUser);
+  }
 }
 var GRADLE_TEST_MARKER, GRADLE_TEST_SUMMARY_INIT;
 var init_gradleTestSummary = __esm({
   "../../packages/envrun/dist/gradleTestSummary.js"() {
     "use strict";
+    init_dist();
     GRADLE_TEST_MARKER = "terminalhire-gradle-tests:";
     GRADLE_TEST_SUMMARY_INIT = `// Written by terminalhire (TERM-1122): prints each Test task's counts, because
 // Gradle prints none when every test passes.
@@ -34179,7 +34620,7 @@ async function verifyWorkingDiff(req) {
 }
 async function runVerification(req, ctx) {
   const { runId, startedAt } = ctx;
-  const labels = { ...req.labels ?? {}, [RUN_LABEL_KEY]: "term-350" };
+  const labels = runLabels(runId, req.labels);
   const progress = req.onProgress ?? (() => {
   });
   const badTarget = unacceptableTarget(req);
@@ -34334,9 +34775,9 @@ async function runVerification(req, ctx) {
   }
   const lease = resolved.lease;
   try {
-    buildJail(scratch);
+    buildJail(scratch, lease.guestUser);
     if (spec.runtime === "jvm")
-      stageGradleTestSummary(localJailPaths(scratch).jail);
+      stageGradleTestSummary(localJailPaths(scratch).jail, lease.guestUser);
     const venuePaths = await lease.stage({
       cloneDir,
       scratchRoot: scratch,
@@ -34600,14 +35041,14 @@ function migrationUnits(runner, migrations) {
       return [...byDir.entries()].sort((a, b) => a[0].localeCompare(b[0])).map(([id, path5]) => ({ id, path: path5 }));
     }
     case "alembic":
-      return migrations.filter((p) => /^alembic\/versions\/[^/]+\.py$/.test(p) && !p.endsWith("/__init__.py")).sort().map((path5) => ({ id: basename4(path5).replace(/\.py$/, ""), path: path5 }));
+      return migrations.filter((p) => /^alembic\/versions\/[^/]+\.py$/.test(p) && !p.endsWith("/__init__.py")).sort().map((path5) => ({ id: basename5(path5).replace(/\.py$/, ""), path: path5 }));
     case "rails":
-      return migrations.filter((p) => /^db\/migrate\/[^/]+\.rb$/.test(p)).sort().map((path5) => ({ id: /^(\d+)/.exec(basename4(path5))?.[1] ?? basename4(path5), path: path5 }));
+      return migrations.filter((p) => /^db\/migrate\/[^/]+\.rb$/.test(p)).sort().map((path5) => ({ id: /^(\d+)/.exec(basename5(path5))?.[1] ?? basename5(path5), path: path5 }));
     case "sql":
       return migrations.filter((p) => p.endsWith(".sql") && !p.startsWith("prisma/migrations/")).sort().map((path5) => ({ id: path5, path: path5 }));
   }
 }
-function basename4(path5) {
+function basename5(path5) {
   const at = path5.lastIndexOf("/");
   return at === -1 ? path5 : path5.slice(at + 1);
 }
@@ -34705,7 +35146,7 @@ var init_dbplan = __esm({
 
 // ../../packages/envrun/dist/dbstack.js
 import { spawnSync as spawnSync7 } from "child_process";
-import { randomBytes as randomBytes11 } from "crypto";
+import { randomBytes as randomBytes12 } from "crypto";
 import { mkdirSync as mkdirSync7 } from "fs";
 function installCommandFor(runner) {
   switch (runner) {
@@ -34741,7 +35182,7 @@ function docker2(args, timeoutMs = DOCKER_TIMEOUT_MS2) {
 function generateCredentials(host) {
   return {
     user: "thverify",
-    password: randomBytes11(24).toString("base64url"),
+    password: randomBytes12(24).toString("base64url"),
     database: "thverify",
     host,
     port: 5432
@@ -35361,6 +35802,7 @@ __export(dist_exports, {
   REDACTED_TARGET_SHA: () => REDACTED_TARGET_SHA,
   RELEASED_LEASE_CENSUS_REASON: () => RELEASED_LEASE_CENSUS_REASON,
   REPO_DIGEST_RE: () => REPO_DIGEST_RE,
+  RUN_ID_LABEL_KEY: () => RUN_ID_LABEL_KEY,
   RUN_IMAGE_SOURCES: () => RUN_IMAGE_SOURCES,
   RUN_LABEL_KEY: () => RUN_LABEL_KEY,
   RUN_RESULT_FIELDS: () => RUN_RESULT_FIELDS,
@@ -35433,6 +35875,7 @@ __export(dist_exports, {
   isBookkeepingTable: () => isBookkeepingTable,
   isCommandUnavailable: () => isCommandUnavailable,
   isGreen: () => isGreen,
+  isMissingSystemDependency: () => isMissingSystemDependency,
   isOurFault: () => isOurFault,
   judgeCompleteness: () => judgeCompleteness,
   judgeLeaks: () => judgeLeaks,
@@ -35464,6 +35907,7 @@ __export(dist_exports, {
   resolveImageForSpec: () => resolveImageForSpec,
   resolveLease: () => resolveLease,
   runEnvironmentSpec: () => runEnvironmentSpec,
+  runLabels: () => runLabels,
   setManifestProbe: () => setManifestProbe,
   sha256Hex: () => sha256Hex,
   signRunStatement: () => signRunStatement,
@@ -35782,10 +36226,10 @@ import {
   mkdtempSync as mkdtempSync5,
   renameSync as renameSync6,
   existsSync as existsSync13,
-  lstatSync as lstatSync3,
+  lstatSync as lstatSync4,
   realpathSync as realpathSync2,
   rmSync as rmSync10,
-  readdirSync as readdirSync3
+  readdirSync as readdirSync4
 } from "fs";
 import { join as join29, dirname as dirname8, isAbsolute as isAbsolute4, resolve as pathResolve } from "path";
 import { createHash as createHash10 } from "crypto";
@@ -36368,7 +36812,7 @@ async function sh(cmd, args, opts = {}) {
 async function confirm(question) {
   const rl = createInterface2({ input: process.stdin, output: process.stdout });
   try {
-    const ans = await new Promise((resolve4) => rl.question(question, resolve4));
+    const ans = await new Promise((resolve5) => rl.question(question, resolve5));
     return /^y(es)?$/i.test(String(ans).trim());
   } finally {
     rl.close();
@@ -36399,7 +36843,7 @@ async function confirmSubmit(flags, question, { unattendedAllowed = true, refusa
 async function ask(question) {
   const rl = createInterface2({ input: process.stdin, output: process.stdout });
   try {
-    const ans = await new Promise((resolve4) => rl.question(question, resolve4));
+    const ans = await new Promise((resolve5) => rl.question(question, resolve5));
     return String(ans).trim();
   } finally {
     rl.close();
@@ -36513,7 +36957,7 @@ function inferSubmitClaim({
   }
   return { candidates: [] };
 }
-function canonicalPath(p) {
+function canonicalPath2(p) {
   if (typeof p !== "string" || p === "") return p;
   const resolved = pathResolve(p);
   try {
@@ -38981,7 +39425,7 @@ function assertNoBooleanPath(dest, flagName) {
 }
 function resolveDeliveryDir(flags, claimLocalId, { existsFn, readdirFn } = {}) {
   const exists = existsFn ?? existsSync13;
-  const readdir3 = readdirFn ?? readdirSync3;
+  const readdir3 = readdirFn ?? readdirSync4;
   let probing = null;
   try {
     const base = flags?.dir ? assertNoBooleanPath(pathResolve(String(flags.dir)), "dir") : sliceWorkDirFor(claimLocalId);
@@ -39129,7 +39573,7 @@ function writeDeliveredBrief(destDir, spec) {
 function ensureExcludedPackDir(destDir) {
   let occupant = null;
   try {
-    occupant = lstatSync3(join29(destDir, BRIEF_DIR));
+    occupant = lstatSync4(join29(destDir, BRIEF_DIR));
   } catch (err) {
     if (err?.code !== "ENOENT") {
       return {
@@ -40085,7 +40529,7 @@ async function cmdSubmit(id, flags = {}) {
       cwdToplevel: cwdToplevel2,
       cwd: pathResolve(dir),
       branch,
-      canonicalize: canonicalPath
+      canonicalize: canonicalPath2
     });
     if (inferred.claim) {
       id = inferred.claim.id;