+ D#j\ 8 Rt^RIHt^RIt^RIt^RIt^RIt^RIt^RIt^RI t ^RI t ^RI t ^RI t ^RI t ^RIHt^RIHt]P$!4R, R, t]P$!4R, R, R, tR t] R 2tR tR tR tRtRtRt]!R04tR]P>!R43R]P>!R43R]P>!R43R]P>!R43R]P>!R43R]P>!R43R]P>!R43R]P>!R433t ]!R R!04t!]P>!R"4t"^ t#R#t$R$t%R%t&R&t'R't(R(t)R)t*^Pt+^Qt,^Rt-^Tt.^t/^ t0^ t1^ t2^ t3^t4]!]/]0]1]2]3]404t5]!R*R+7!R,R-44t6!R.R/]74t8R0R1lt9R2R3lt:R4R5lt;]3R6R7llt<]]33R8R9llt=]3R:R;llt>R<R=lt?RR>R?llt@R@RAltARBRCltB] P3RDRElltDRFRGltERHRIltFRJRKltGRLRMltH]!RNRO44tIRPRQltJRRRSltKRTRUltL]DR3RVRWlltMRXRYltNRRZR[lltORtPR\R]ltQR^R_ltRR`RaltSRbRcltTRdReltURfRgltVRRhRilltWRjRkltXRRlRmlltYRnRoltZRpRqlt[RrRslt\] P3RtRullt]RvRwlt^RRxRyllt_RRzR{llt`R|R}ltaR~RltbR] P/RRlltc]!R*R+7!RR44td] P3RRllteRRltf] P3RRlltgRRlthRRltiRRltj] P3RRlltkRRltl] R2tmRtn] P3RRlltoRRltpRRltqRRltrRRltsRRlttRRltuRRltvRRltwRtx^2ty]P>!R4tzRRlt{R] P3RRllt|RRlt}] P3RRllt~] P3RRllt] P3RRlltRRltRRltRRltRRRllt]!RR44tR] P/RRlltR]R] P]DR3RRlltR]R] P]DR3RRlltR]R] P]DR3RRlltR#)uRun an agent CLI on a cluster node instead of the workstation. Host choice is by measured load average penalised by this workstation's in-flight placement claims: load average lags a freshly started run by tens of seconds, so probes alone put every concurrent dispatch on the same node. The checkout travels by `git push`, not by copying files: a commit snapshotting HEAD plus every tracked change and untracked, non-ignored file is pushed (delta-only) to a bare mirror on the node, then checked out into a real, working git repository at the node's workspace — this holds for a linked worktree exactly as for a plain checkout, since `git push` already resolves a linked worktree's gitdir locally. Results travel home the same way: the node snapshots its post-run state, pushes it to the same bare mirror, and the workstation fetches and applies it as an uncommitted change against the pushed commit — a delta, never a tree copy. If the local checkout changed while the dispatch was running, the result is left on a fetched ref rather than silently overwriting it. This removes two limitations of an earlier tree-mirror transport: a node-side commit's sha, parent, and message are no longer dropped — the underlying commit object crosses the wire and is fetched home, even though it still surfaces as an uncommitted change by design; and a linked worktree's gitdir no longer needs separate mirroring or remote pointer rewriting, since only ordinary git objects and refs move. One limitation remains: an out-of-tree `core.hooksPath` does not resolve on the node, so hooks do not run there. A checkout with no `HEAD` yet (freshly `git init`ed, nothing committed) falls back to a tree-copy transport, since there is nothing to push a delta against. A caller that needs no repo files — a pure-inference research or review prompt — can set `OD_DISPATCH_NO_WORKSPACE=1` to skip the transport entirely: the node gets an empty scratch directory as its working directory, nothing is pushed, nothing is pulled back. Host selection, placement claims, and containment recording are unchanged; only the transfer is skipped. `-C`/`--cd` is refused in this mode — there is no mirrored checkout to point at. ) annotationsN) dataclass)Pathz.claudezbuildbox-hosts.jsonbinz agent-sandbox cdx-offloadz /git-commonzsandbox/workspacesz/sandbox/workspacesz agent-seat tailscale_ipz%modules/harness/seat/credentials.jsonz!environment file (.env or .env.*)z(^|/)\.env(?:\..*)?$z1private key/certificate (*.pem/*.key/*.p12/*.pfx)z(?i)\.(?:pem|key|p12|pfx)$z7SSH private key (id_rsa*/id_ed25519*/id_ecdsa*/id_dsa*)z'(^|/)id_(?:rsa|ed25519|ecdsa|dsa)[^/]*$zsecret directory (.secrets/**)z(^|/)\.secrets(?:/|$)zsecret file (*.secret)z (?i)\.secret$zAWS credentialsz"(^|/)\.aws/(?:credentials|config)$zGCP credentialszV(?i)(^|/)(?:application_default_credentials\.json|service[-_]?account(?:[^/]*)\.json)$zSSH credential filez3(^|/)\.ssh/(?:id_[^/]+|[^/]+\.(?:pem|key|p12|pfx))$z.npmrcz.pypirczM(?im)(?:_auth(?:token)?|password|username|token|//[^\s=]+/:_authToken)\s*[=:]iOD_PLACEMENT_CLAIM_DIROD_DISPATCH_NO_WORKSPACEOD_DISPATCH_K3Sz&.local/state/overdeck/placement-claimsz.claimg?T)frozenc6]tRt^ut$R]R&R]R&R]R&RtR#) Credentialstrruntime str | NoneslugrpathN)__name__ __module__ __qualname____firstlineno____annotations____static_attributes__r`/home/user/overdeck-private-tests/subrouter-s5-systray-latest/modules/systray/remote_dispatch.pyr r us L  Jrr c8a]tRt^|tRt]3RV3RllltRtV;t#)OffloadUnavailablez"No cluster node can take this run.c$V^8dQhRRRRRR/#)messagercodeintreturnNoner)formats"r __annotate__OffloadUnavailable.__annotate__s!3$rc 2<\SV`V4W nR#N)super__init__r!)selfr r! __class__s&&&rr+OffloadUnavailable.__init__s ! rr!) rrrr__doc__ EXIT_NO_NODEr+r __classcell__)r-s@rrr|s,1=rrcV^8dQhRR/#rr#boolr)r%s"rr&r&s^^d^rc\;QJd0R\R4\R434F 'gK R# R#!R\R4\R4344#)uMachine-local evidence, not env: an env marker is agent-settable. /proc/self/cgroup is deliberately not consulted — measured inside a rootless podman container it names neither libpod nor docker, so it would answer "not contained" and re-dispatch forever.c3@"TFqP4xK R#5ir))exists).0probes& r in_container..s]+\%||~~+\z/run/.containerenvz /.dockerenvTF)anyrrrr in_containerr?sM 3]D1E,F]H[+\]33]3]3]D1E,F]H[+\] ]]rcV^8dQhRR/#r4r)r%s"rr&r&src \4'*#r))r?rrrshould_offloadrBs ~ rcV^8dQhRR/#r4r)r%s"rr&r&s222rcZ\\PP\44#r))r5osenvirongetNO_WORKSPACE_ENVrrrno_workspace_requestedrIs  /0 11rc V^8dQhRRRR/#)rrrr#dictr)r%s"rr&r&src\P!\V4PRR74# \\ 3dp\ RT RT 2\R7ThRp?ii;i)utf-8)encodingz buildbox registry unreadable at : r/N)jsonloadsr read_textOSError ValueErrorrr1)rexcs& r load_registryrVs_zz$t*...@AA Z  .tfBse <<  s.1AAAc$V^8dQhRRRRRR/#)rregistryrKrolestuple[str, ...]r# list[dict]r)r%s"rr&r&s"d?[erc BVPR.4Uu.uFQpVPR4R8XgK\V4\VPR4;'g.48:gKOVNKS ppV'g%\RRPV4 R2\R7hV#uupi) zReachable hosts carrying every role in `roles`. A host in any other state is never contacted, and one without the sandbox image provisioned is never a candidate: an unprovisioned node fails with command-not-found, and no failure returns the run here.hostsstate reachablerYzno reachable host with roles z, z in the registryr/)rGsetrjoinr1)rXrYhostr]s&& rcandidate_hostsrcs LL"- -D 88G  + 03E c$((7BSBYBYWY>Z0Z -    +DIIe,<+==M N   L sB&BB&Bc$V^8dQhRRRRRR/#)rrbrKdoorrr#r)r%s"rr&r&s!TrcVPR4;'g/PV4pV'dVPR4'g'\VPR4 RV R2\R7hV#)accessrbnamez : no usable z access doorr/)rGrr1)rbrergs&& r access_forrisdhhx &&B + +D 1F F++ xx TF, ?l   Mrc$V^8dQhRRRRRR/#)rrbrKrgr#rr)r%s"rr&r&s!..T.4.C.rcFVPR4;'g VR,#)rhrbrG)rbrgs&&r _host_namerms 88F  - -vf~-rc$V^8dQhRRRRRR/#)rrgrKextrarZr# list[str]r)r%s"rr&r&s!T/9rc RRRRRRRRR\ 2. pVPR4'd0VR \PP VR,4., pVPR 4'dVR \ VR ,4., pV\ V4, pVPVPR R 4 R VR, 24V#)zN`-F /dev/null` keeps a sandboxed or agent-poisoned ssh_config out of the path.sshz-Fz /dev/nullz-oz BatchMode=yesz StrictHostKeyChecking=accept-newzConnectTimeout= identity_filez-iport-puser@rb)PROBE_TIMEOUT_SECrGrEr expanduserrlistappend)rgroargvs&& rssh_argvr}s    * +,- Dzz/"" rww))&*ABCC zz& s6&>*++DKDKK6::ff-.av/?@A Krc V^8dQhRRRR/#)rrgrKr#rr)r%s"rr&r&s----rcF\P!\V4RR4#)N)shlexrar}rgs&r rsync_shellrs ::hv&s+ ,,rc V^8dQhRRRR/#)rstdoutrr# float | Noner)r%s"rr&r&s#,rc~\VP4^,4# \\\3dR#i;i)N)floatsplitAttributeError IndexErrorrT)rs&r parse_loadavgrs6V\\^A&'' J 3s "<<c V^8dQhRRRR/#)rrgrKr#rr)r%s"rr&r&s & &t &L &rcV!.\V4ORNRR\R7pTP ^8wdR#\ TP4# \\P3dR#i;i)zcat /proc/loadavgTcapture_outputtexttimeoutN)r}rxrS subprocessSubprocessError returncoderr)rgrundones&& r probe_loadrsl 4hv 4 3 4%   !  %% Z// 0sAA&%A&cV^8dQhRR/#)rr#rr)r%s"rr&r&s3343rc\PP\4pV'd\ V4P 4#\P !4\, #r))rErFrG CLAIM_DIR_ENVrryhomeDEFAULT_CLAIM_DIR_RELPATH)overrides r claim_dirrs<zz~~m,HH~((** 99;2 22rc V^8dQhRRRR/#)rvaluerr#r)r%s"rr&r&s????rcF\P!RRV4;'gR#)z[^A-Za-z0-9._-]_unnamed)resub)rs&r _claim_tokenrs 66$c5 1 > >Y>rc V^8dQhRRRR/#)rpidr"r#rr)r%s"rr&r&s  c j rc\RV R24PRRR7pYPR4^,RP 4^,# \dR#i;i \ \ 3dR#i;i)zWField 22 of /proc//stat, read after the last ')' so a spaced comm cannot shift it./proc/z/statrMreplacerNerrorsN))rrRrSrindexrrTr)rstats& r_process_start_ticksrsfSE'(22GI2VKK$q(*+113B77   #s" A.A$ A! A!$A98A9c$V^8dQhRRRRRR/#)rrr" start_ticksrr#r5r)r%s"rr&r&s!)))#)$)rcn\V4pVe VR8wdW!8H#\RV 24P4#)zVLiveness by process identity, never by elapsed time: a killed dispatch frees its host.0r)rrr8)rrcurrents&& r_owner_is_livers<"3'G{c1%% &  & & ((rc<]tRtRt$RtR]R&R]R&RRltR tR #) PlacementClaimi zWOne in-flight dispatch, recorded so a concurrent selection can see it before load does.r host_namerrcV^8dQhRR/#rr#r$r)r%s"rr&PlacementClaim.__annotate__src `VPP4R# \dR#i;ir))runlinkrSr,s&rreleasePlacementClaim.releases)  II      s  --rN)rrrrr0rrrrrrrr saN Jrrc V^8dQhRRRR/#)rrhrr#ztuple[str, int, str] | Noner)r%s"rr&r&s  s : rcVP\4'gR#VR\\4)PR^4p\V4^8wdR#Vwr#rEV\ V4V3# \ dR#i;i)N__)endswith CLAIM_SUFFIXlenrsplitr"rT)rhpartsrbrr_uniques& r _parse_claimrsv == & & %C %% & - -dA 6E 5zQ&+#D{SX{** s A'' A65A6c V^8dQhRRRR/#)r directoryrr#zdict[str, int]r)r%s"rr&r&$s.rcX/p\VP44pTFbp\TP4pTfKTwrVp\ Yg4'dTP T^4^,Y&KQTP4Kd T# \dTu#i;i \dKi;i)zLIn-flight claims per host token, unlinking any whose owning process is gone.)rziterdirrSrrhrrGr)rcountsentriesentryparsedrbrrs& rlive_claim_countsr$sFy((*+ejj) > !'; # + +!::dA.2FL   LLN M     s#B1B BB B)(B)c$V^8dQhRRRRRR/#)rrrrrr#PlacementClaim | Noner)r%s"rr&r&:s" : :S :T :6K :rc\P!4p\V4 RT R\V4;'gR R\P !4P \ 2pW, pVPRRR7\P!\P!V\P\P,\P,R44\YR7# \dR#i;i)zSAtomic O_EXCL create of a uniquely named empty file. None means bookkeeping is off.rrT)parentsexist_okiN)rr)rEgetpidrruuiduuid4hexrmkdircloseopenO_CREATO_EXCLO_WRONLYrSr)rrrrhrs&& r acquire_claimr:s ))+C  " #2cU"-A#-F-M-M#,N TZZ\   |n .   Dt4 rzzBII5 CUKL I 99 s+A7C.. C=<C=c$V^8dQhRRRRRR/#)rr]r[claims Path | Noner#z(tuple[dict, dict, PlacementClaim | None]r)r%s"rr&r&Js$;4;4 ;41<;4-;4rcVf \4M \V4p.p.pVFSp\V4pT!T4p T f&TP TP R4 R24K@TP YgT 34KU V'g+\RPV4;'gR\R7hRp Rp ^p \^\V4,^,4EFIp \V4pV e;\V P4p\^VP V^4^, 4W&\V4UUUU u.uFAwpwrgp V \ VP \\#Wg44^4,,V3NKC ppppp \%RV44pVUUu.uFwppVVR,8:gKVNK ppp\&P(!V4p V e V V9dMJV eV P+4Rp Rp WL,wrgp\-\#Wg4V4pVfWgR3u#TT rEKL V fT MT pVV,^,VV,^,V 3# \d'pTP \ T44Rp?EKTRp?ii;iuup pppiuuppi) aoLeast-loaded reachable node, penalised by this workstation's in-flight claims. Load average lags a newly started run, so probes alone stack concurrent dispatches on one node. The claim held by every live dispatch is what fans them out; equal scores are broken at random so simultaneous callers do not walk the same branch. The returned claim is live until released. Nrhz": unreachable or load probe failedz; zno candidate node answeredr/c3*"TF wrVxK R#5ir)r)r9score_indexs& rr;select_host..vs;F=5Fsg& .>)rrrirr{rrGrar1rangerrrrmax enumerateCLAIM_LOAD_PENALTYrmminrandomchoicerr)r]r:rrprobedfailuresrbrgrUloadheld held_index best_indexrrtokenindexscored best_scorertied_loadclaims&&& r select_hostrJsm &~ 4**A~!e45 FA !D~~aj))As3t9q=?34" Q Lrc(V^8dQhRRRRRRRR/#)rrrprztuple[int, int, str]rrr#r)r%s"rr&r&s1TTIT6JTSVT[dTrclVwr4pV^8Xd\^,V.MRV 2.p.VRVOVOWV,RO#)rz--cd=N)r)rrrrspanr replacements&&& rrewrite_workdirr!sPNE/3qy=#U+ug>OK S^FU # Sk SN4<>4R SSrc V^8dQhRRRR/#rr rr#rr)r%s"rr&r&s##T#c#rc6\P!\V4PR44P 4R,p\ P !RRVPP44PR4;'gRpVR, RV 2#)a(Stable per-source-path identity: two worktrees never share a remote mirror. sandbox-run enforces ^[a-z0-9][a-z0-9._-]{0,63}$, so the name part is folded to that alphabet (a capital letter in the checkout dir killed the whole dispatch); identity still comes from the digest of the unmodified path.rMN Nz [^a-z0-9._-]-z._-repo:N0N) hashlibsha256rencode hexdigestrrrhlowerlstrip)r digestrhs& r sandbox_idr1st ^^CI,,W5 6 @ @ B3 GF 66/3 (9 : A A% H R RFD3i[& ""rc V^8dQhRRRR/#r#r)r%s"rr&r&s888#8rc*\ R\V4 2#/)NODE_WORKSPACES_ROOTr1r s&rremote_rel_dirr8s" #1Z%5$6 77rc V^8dQhRRRR/#r#r)r%s"rr&r&s))T)c)rc\V4 R2#)uThe `--id` a no-workspace dispatch gives agent-sandbox — distinct from `sandbox_id` for the same `root` so the container's workspace (which agent-sandbox derives from `--id`, not from `rel_dir`) can never collide with — and never run inside — a real mirror's workspace.z-scratch)r1r7s&rscratch_sandbox_idr;s  x ((rc V^8dQhRRRR/#r#r)r%s"rr&r&s@@T@c@rc*\ R\V4 2#r4)r6r;r7s&rremote_scratch_dirr>s" #1%7%=$> ??rc(V^8dQhRRRRRRRR/#)rr rr namespacerr#r)r%s"rr&r&s(111D1S1#1rc\P!V RVP4 2PR44P 4R,p\ RV RV 2#)z;A host-local mirror location for data outside the checkout.:rM:NNr5)r*r+resolver,r- REMOTE_ROOT)r rr@r0s&&& r extra_rel_dirrFsS ^^tfAdlln%56==gF G Q Q STW XF]!I;ax 00rc V^8dQhRRRR/#r#r)r%s"rr&r&s==d=s=rc*\ R\V4 2#r4)CONTAINER_WORKSPACES_ROOTr1r7s&rcontainer_workspacerJs' (*T*:); <.s ?%$K+>C#+>#%c3:"TFpRV3Fq"xK K R#5irPrrRs& rr;rSs F,$;2E3#2E#,rTz--filterz :- .gitignore)z/.envz/.env.*z.envz.env.*z*.pemz*.keyz*.p12z*.pfxzid_rsa*z id_ed25519*z id_ecdsa*zid_dsa*z.secretsz*.secretz.awsz.sshz$application_default_credentials.jsonz*service-account*.jsonz*service_account*.json) SYNC_EXCLUDES)rLnames secret_ruless& r _exclude_argsrYsU)4 %m %W %-EL   ?% ?  F, F      rc V^8dQhRRRR/#)rr rr#dict[str, str]r)r%s"rr&r&sD^rc/pVPR4pVEFpVPV4P4pVR8Xg#VPR4'g V\9dKNVP 4'gVP 4'gK|\F#wrVVPV4'gKWQV&K VP\9gKVPRRR7p\PV4'gKRVP 2W&EK V# \dp\RT R T 2\R 7ThR p?ii;i) zSecret-shaped workspace files mapped to the rule that denied dispatch. Traversal errors abort the dispatch: an unreadable tree cannot be certified clean. The one repository-owned credential manifest is data, not a live credential. *.gitz.git/rMrrzauthenticated zcould not inspect z for secret files: r/N)rglob relative_toas_posixrSECRET_ALLOWLISTis_file is_symlinkSECRET_PATH_PATTERNSsearchrhAUTH_CONFIG_NAMESrRAUTH_CONFIG_RErSr EXIT_MIRROR) r excludedpathsrrellabelpatterncontentrUs & rsecret_exclusionsrps "H 3D""4(113Cf}w 7 73BR;R<<>>$//*;*;"6>>#&&$)SM#7 99 11"nnginPG%,,W55*8 (D & O   &9# ?k  s<AD"D;D!D7D+DD E*EEc V^8dQhRRRR/#)rrjr[r#r$r)r%s"rr&r&sffNftfrc\VP44F(wr\RV: RV R2\PR7K* R#)z)cdx offload: excluded secret-shaped file z (matched r)fileN)sorteditemsprintsysstderr)rjrrules& rlog_secret_exclusionsrzs<X^^-.  9$D6QRSZ]ZdZde/rc$V^8dQhRRRRRR/#)rr rselectedbytesr#r)r%s"rr&r&s!7777%7rcB\V4p\V4V'gV#V'd!VPR4PR4M.pVUu.uFqDP RR4V9gKVNK ppRP V4V'd R,#R,#uupi)rMsurrogateescaper)rprzrstriprdecodera)r r|rjrkrkepts&& rfiltered_mirror_filesrs &H(# 3;HOOE " ( ( /E" ^UTkk';L&MU]&]DDUD ^ ::d u 66# 66 _s B,Bc V^8dQhRRRR/#)rr rr#r}r)r%s"rr&r&!s11411rcV!RR\V4RRR.R\R7pTP^8wdE\TP;'gR 4P4p\ RT R T 2\ R 7h\TP\4'dTPP4M TPp\Y4# \\P3dp\ RT R T 2\ R 7ThR p?ii;i) zTracked files, NUL-delimited for rsync. The regular rsync pass carries untracked, non-ignored files. This pass exists only to restore tracked paths excluded by nested ignore rules. rr zls-files--cachedz-zTrrz%could not determine mirror files for rOr/N)rrxrSrrrrirrxr  isinstancerr,r)r rrrUdetailr|s&& rgit_mirror_filesr!s  T3t9j*d K%  !T[[&&B'--/ 3D6F8 D;  (2$++s'C'Ct{{!!#H  00 Z// 0 3D6C5 A   sCC>!C99C>c$V^8dQhRRRRRR/#)rsourcer destinationr#rpr)r%s"rr&r&:s!  c   rcRRRRRVV.#)zGSync Git-selected paths only; stdin is the NUL-delimited Git file list.rsync-azz--from0z--files-from=-z--delete-missing-argsr)rrs&&rtracked_sync_argvr:s#   rc ,V^8dQhRRRRRRRRR R /# rrgrKr rrel_dirrrLr5r#rpr)r%s"rr&r&G0  d $  4 T] rc\V4p\V4.RO\V4ORV4ORN\V4NV R2NVP RR4 RVR, RV R2N#) rc3@"TFpRRV 23Fq"xK K R#5irQr5Nrr9rrs& rr;push_argv..O$ H(${avJ.Gs#.G#(r=-er5rvrwrbrBrr--deleterprzrYrrGrgr rrLrjs&&&& r push_argvrGs &H(#  { #  I( H   F  &   ::ff % &av'7q C  rc ,V^8dQhRRRRRRRRR R /#rr)r%s"rr&r&Wrrc\V4p\V4.RO\V4ORV4ORN\V4NVP RR4 RVR, RV R2NV R2N#) rc3@"TFpRRV 23Fq"xK K R#5irrrs& rr;pull_argv.._rr=rrvrwrbrBr5rrrs&&&& r pull_argvrWs &H(#  { #  I( H   F  ::ff % &av'7q C  &   rc(V^8dQhRRRRRRRR/# rrgrKr rrrr#rpr)r%s"rr&r&g(??d?$???rc \V R2VPRR4 RVR, RV R24p.VRRORN\V4NVRRO#)r5rvrwrbrBNrrrGrrgr rargss&&& rpush_tracked_argvrgsh  & vzz&&12!F6N3C1WIQO D ?T#2Y > >k&1 >DI >>rc(V^8dQhRRRRRRRR/#rr)r%s"rr&r&nrrc\VPRR4 RVR, RV R2V R24p.VRRORN\V4NVRRO#)rvrwrbrBr5Nrrrrs&&& rpull_tracked_argvrnsh  ::ff % &av'7q CvQZ D ?T#2Y > >k&1 >DI >>rrc ,V^8dQhRRRRRRRRR R /#) rrgrK local_dirrrrpullr5r#rr)r%s"rr&r&us0  4 D 3  *4 rcTV'd \WV4M \WV4pV!VRR\R7pTP 'd+RT'dRMR RTPP4 2#R# \\P 3dpRT'dRMR RT 2uRp?#Rp?ii;i)zERound-trip an out-of-tree directory with the normal mirror transport.Trz extra mirror rpush failed: N) rrSYNC_TIMEOUT_SECrSrrrrxr )rgrrrrr|rrUs&&&$$ rsync_extra_dirrus599V 0i[b>cDJ44AQR v6:)DKKDUDUDWCXYY  Z// 0Jv6:)C5IIJsA00B' B"B'"B'cD]tRtRt$RtR]R&R]R&R]R&R]R&R tR #) GitMirrorizEWhere a linked worktree's git plumbing lives locally and on the node.rgit_dir common_dirr remote_commonremote_git_dirrN)rrrrr0rrrrrrrsO Mrrc V^8dQhRRRR/#)rr rr#ztuple[Path, Path] | Noner)r%s"rr&r&s//4/0H/rcV!RR\V4RRR.RR\R7pTP ^8wdR#TP P4p\T4^8wg;T^,P4'dT^,P4'gR#\T^,P44p\T^,P44pTP4'g\T4T, pTP4TP43# \\P3dR#i;i) zS(gitdir, common dir) for `root`, both absolute. None when `root` is not a checkout.rr r z--absolute-git-dir--git-common-dirTrN) rrxrSrrrr splitlinesrr r is_absoluterD)r rrlinesrcommons&& rgit_dirsrs T3t9k;OQc d%   ! KK " " $E 5zQeAhnn..eAhnn6F6F58>>#$G %(.." #F     df$ ?? fnn. .. Z// 0sD""EEc V^8dQhRRRR/#rrrr#rr)r%s"rr&r&s88$838rc\P!\V4PR44P 4R,pVP P ;'g VP p\ RV RV 2#)zROne mirror per repository: every worktree of a repo shares these objects and refs.rMr%r5r')r*r+rr,r-parentrhREMOTE_GIT_COMMON_ROOT)rr0rms& rremote_git_commonrsb ^^C O227; < F F H MF    " " 5 5jooE$ %QugQvh 77rc V^8dQhRRRR/#)rr rr#zGitMirror | Noner)r%s"rr&r&sT2Brc\WR7pVfR#Vwr4W48XdR#\V4p\VVVV RVP 2R7#)zPNone for a plain checkout, whose `.git` directory rides along in the tree rsync.rNz /worktrees/)rrrr)rrrrh)r rdirsrrrs&& r git_mirrorrsW D "D |G%j1M #' GLL>B  rc$V^8dQhRRRRRR/#rrgrKmirrorrr#rpr)r%s"rr&r&s!   y Y rc RRRRR\V4VP R2VPRR4 RVR , R VP R2.#) zMNo --delete: a concurrent dispatch's remote commit must not lose its objects.rrrQz /worktreesrr5rvrwrbrB)rrrGrrgrs&&rgit_common_push_argvrsd   F    Q ::ff % &av'7q9M9M8NaP  rc$V^8dQhRRRRRR/#rr)r%s"rr&r&s!  d I ) rc RRRR\V4VP R2VPRR4 RVR, RVP R2.#) rrrrr5rvrwrbrB)rrrGrrs&&rgit_dir_push_argvrs]  F >> ! ::ff % &av'7q9N9N8OqQ rc(V^8dQhRRRRRRRR/#)rrr container_dirrrr#r)r%s"rr&r&s),,,S,),PS,rc R\P!V4 R\P!VP4 R\P!VR,4 R2pR\P!V4 2#)a7$HOME is resolved on the node: the rsync targets are relative to the remote home. The gitdir the worktree points at is mounted into the container at its node-absolute path, so that pointer is valid on both sides; the worktree itself is not, so its back-pointer names the container path, where git actually runs.zset -eu d="$HOME"/z g="$HOME"/z6 printf "gitdir: %s\n" "$g" > "$d/.git" printf "%s\n" rNzh > "$g/gitdir" printf "%s\n" "../.." > "$g/commondir" git -C "$d" rev-parse --show-toplevel > /dev/null bash -lc )rquoter)rrrinners&&& rgit_pointer_commandrsr  [[)*+[[!6!6789++mg&=>?@>  > u{{5)* ++rc 0V^8dQhRRRRRRRRRRR R /#) rrgrKrrrrrrr#rr)r%s"rr&r&sD    rc 8R\P!VPVP.4 2pR.\ V4OVN\ 3R\ W4\3R\W4\3R.\ V4O\W#V4N\ 3.pVFPwrp V!V RRV R7p T P^8wgK&\TRT R T PP!4 24u# R # \\P3dp \TRT R T 24uR p ? u#R p ? ii;i) zMake git work in the node's mirror. Returns a warning on failure, and never raises: a run with no git is still useful, a run refused over git is not. mkdir -p zmirror directorieszobjects and refszworktree gitdirzgitdir pointersTrz mirroring rN)rrarrr}rxrrrrrSrrgit_warning_textrrxr ) rgrrrrr mkdir_commandstepswhatr|rrrUs &&&&&& rprepare_remote_gitrs/  F,@,@&BWBW+X YZ[M A&!1A=ACTU 1&ACST -f=?OP  Thv T 3GF S T  /E %G RtDtWMD ??a #ID64;;K\K\K^J_/`a a %  334 R#ID63%/PQ Q Rs C  D;D DDc$V^8dQhRRRRRR/#)rrrrr#r)r%s"rr&r&s!SSrcRV RV R2#)z'!!! GIT IS NOT USABLE IN THE MIRROR ON rOu. The run continues, but git status/add/commit/log and anything shelling out to git WILL FAIL on the node — do not expect to commit there.r)rrs&&rrrs! 1)BvhGC Crz/reposzrefs/cdxc V^8dQhRRRR/#)rr rr#rr)r%s"rr&r&skrcxV!RR\V4RR.RR\R7pTP ^8wdR#TP P4pT'gR#\T4pTP4'g\T4T, pTP4# \\P3dR#i;i)zJAbsolute git common dir for `root`, or None when `root` is not a checkout.rr r rTrN) rrxrSrrrrr rrrD)r rrdir_strrs&& rgit_common_dirrs T3t9k;M N%   !kk!G  ']F     df$ >>  Z// 0sBB98B9c V^8dQhRRRR/#rr)r%s"rr&r&'s#rcVPR8XdVPPM VPp\P!\ V4P R44P 4R,pV RV 2#)zCOne bare mirror per repository: every worktree of a repo shares it.r^rMr%r')rhrr*r+rr,r-)rrhr0s& rrepo_keyr's`%/__%>:   ! !JOOD ^^C O227; < F F H MFV1VH rc V^8dQhRRRR/#)rkeyrr#r)r%s"rr&r&.s////rc\ RV R2#)r5r^)REMOTE_GIT_BARE_ROOT)rs&rremote_bare_dirr.s" #1SE ..rc$V^8dQhRRRRRR/#)rrgrKbare_absrr#r)r%s"rr&r&2s&TTTTTrcVPR4pV'dRV 2MRpRVPRR4 RVR, V V 2#)rtrBrzssh://rvrwrbrl)rgrrtsuffixs&& r bare_ssh_urlr2sK ::f DqZRF FJJvv./q0@ SSrc V^8dQhRRRR/#)rrgrKr#r[r)r%s"rr&r&8sBBBBrc@/\PCR\V4/C#)zV`git push`/`fetch` need their own transport string, not the mirror's `-e` rsync shell.GIT_SSH_COMMAND)rErFrrs&r git_ssh_envr8s Abjj A+[-@ AArc V^8dQhRRRR/#)rbare_relrr#r)r%s"rr&r&=s , , , ,rcR\P!\4 R\P!\ R24 R\P!V4 R2pR\P!V4 2#)zset -eu mkdir -p "$HOME"/z exec 9>"$HOME"/z/.lockz flock -w 600 9 b="$HOME"/z^ [ -d "$b/objects" ] || git init -q --bare "$b" git -C "$b" config receive.shallowUpdate true r)rrr)rrs& rbare_mirror_ensure_scriptr=sq !KK(<=>?++)=(>f&EFGH[[*+,:  : u{{5)* ++rcV^8dQhRR/#)rr#rr)r%s"rr&r&Js444rc\\P!44 R\P!4P 2#)zUnique per invocation, collision-impossible across concurrent sessions on any buildbox, and self-describing an age for `gc_dispatch_refs` without fetching objects.r')r"timerrrrrrnew_dispatch_idr Js.$))+ q!1!1 2 33rc$V^8dQhRRRRRR/#)rsbox_idr dispatch_idr#r)r%s"rr&r&Ps!;;#;C;C;rc \ RV RV R2#)zOne inbox ref per dispatch, not per sandbox: a stale or racing tip from another session can never block this push, since nothing else ever targets this exact ref.r5z/inPUSH_REF_PREFIX)rrs&&r dispatch_refrPs ay+c ::rc V^8dQhRRRR/#)rrrr#r)r%s"rr&r&Vs....rc\ RV R2#)r5z/outr)rs&r result_refrVs ay --rz^(\d+)-[0-9a-f]{32}$c$V^8dQhRRRRRR/#)rrefrnowrr#rr)r%s"rr&r&_s! % %s % %< %rcVPR^4p\V4^8wgVR,R8wdR#\PVR,4pV'gR#V\ VP ^44, #)uAge of a `dispatch_ref`'s embedded epoch, read from the ref name alone — no fetch. None for anything not shaped like `.../-/in`: an unrecognized ref (a future naming change, a hand-pushed one) is left alone rather than guessed at.r5inNrr)rr_DISPATCH_ID_REmatchr"group)rrrrs&& r_dispatch_ref_age_secr_s_ JJsA E 5zQ%)t+  ! !%) ,E  U[[^$ $$rzthe nodec4V^8dQhRRRRRRRRRRR RR R /#) rr rurlrrkeep_refenvr[rr#rr)r%s"rr&r&lsN66 6 66 6  6  66rc $V!RR\V4RV\ RV R2.VRR\R7pTP ^8wdRT R 2#\P!4p.p TPP4Fup T P^R 7p \T 4^8wdK'T ^,P4p Y8XdKF\Y4p T fKWT \8gKdT PT 4Kw T 'gR #T R \ p T!RR\T4R R RT.RT 4OTRR\"R7pTP ^8wdRT R 2#R # \\P 3d RT R 2u#i;i \\P 3d RT R 2u#i;i)aBest-effort cleanup of this sandbox's dispatch refs older than `DISPATCH_REF_TTL_SEC`, run once after a successful push. Never raises and never fails the dispatch: a listing or delete failure just means the next dispatch's GC gets another chance. Returns a plain, owner-safe warning string (no internal names, no URLs) to surface non-fatally on failure, None when there was nothing to report.rr z ls-remoter5z/*/inTr#rrrz0old dispatch records could not be cleaned up on z; the run is unaffected.)maxsplitNr-q --no-verifyc3,"TF pRV 2xK R#5i)rBNr)r9rs& rr;#gc_dispatch_refs..s*ES3%yEs)rrrxrSrrrr rrrrr rDISPATCH_REF_TTL_SECr{DISPATCH_REF_GC_MAX_DELETEr)r r!rr"r#rrlistedrstalelinefieldsragedeleteds&&&&&&& rgc_dispatch_refsr3ls f T3t9k3?BSSTU\T]]b@c d%  AA)Ldee ))+C E ((*Q' v;!  Qioo ? #C- ?s&:: LL +  -- .E f T3t9fdM3 ,*E* ,$  QA)Ldee A Z// 0fA)Ldeef8 Z// 0fA)Ldeefs#*E*E+!E('E(+!FFc(V^8dQhRRRRRRRR/#) rcmdrpsteprr rr#zsubprocess.CompletedProcessr)r%s"rr&r&s/__)_3_d_Fa_rc V!V3RRRR/VB# \\P3d p\T RT RT 2\R7ThRp?ii;i)uEvery local git probe/snapshot call goes through this: an `OSError` or timeout is a transport failure, converted to the same `OffloadUnavailable` the rest of the module raises on one — never a raw exception leaking out of `open_session`/`pull_back`.rTrz on rr/N)rSrrrri)r5r6r rkwargsrUs&&&&, r_run_gitr9s`_3AtA$A&AA Z// 0_ D6dV9SE!BU[^^_s A AA c$V^8dQhRRRRRR/#)rr r commit_ishrr#rr)r%s"rr&r&s&AA$ACA Arc\RR\V4RV R2.RW\R7pVP^8XdVPP 4#R#)rr r z^{tree}rN)r9rrxrrr )r r;rrs&&& rtree_ofr>sR  s4y+*Y7OPT(9 D#'//Q"64;;   @D@rc V^8dQhRRRR/#)rr rr#ztuple[str, bool]r)r%s"rr&r&s6666F6rc \RR\V4RR.RW\R7pVP^8wd0\ RV RVP P 4 2\R7h\V4p\V4VPP 4'g%V'g\VR VR 7pT;'gR R 3#\\P!44R \P !4 R\"P$!4P& 2, p/\P(CR\V4/CpRRR\V4RR .3RRR\V4RRR.33F[wrx\WWV\*R7p V P^8wgK+\ RV RV RV P P 4 2\R7h V'dh\RR\V4RRRRR.VORWV\*R7p V P^8wd0\ RV RV P P 4 2\R7h\RR\V4R.RWV\R7p V P^8wd0\ RV R V P P 4 2\R7hV PP 4R!3VP-4# \.d#i;i TP-4i \.dii;i;i)"z(tree sha, is_dirty) for `root`'s current state, never touching HEAD or the real index: a throwaway `GIT_INDEX_FILE` does the read-tree/add/write-tree dance.rr statusz --porcelainr=z*could not read the working tree status of rOr/HEADrrFzcdx-offload-index-r'GIT_INDEX_FILEz read-treeaddz-Az--ignore-errorsr#r snapshotting z failed at rmr'rz--ignore-unmatchrz secret filterzsecret filtering rz write-treez failed at write-tree: T)r9rrxrrrxr rirprzrr>rtempfile gettempdirrErrrrrFrrrS) r rdirtyrj head_tree index_pathr#r6r5rremovedtrees && r_snapshot_treerOs  s4y(MB$%6 E 1 8bASASAU@V W  !&H(# <<    D&c2 B%%h))+,1CBIIK=PQRVR\R\R^RbRbQc/ddJ ;RZZ ;)3z? ;C" >4TKP Q ^T3t9eTCTU V IDCtcCSTD!#(#D6TF"T[[=N=N=P.s!Lmd#ekk$/01ms&(set -eu w="$HOME"/ b=aC mkdir -p "$w/.git" exec 9>"$w/.git/cdx-offload.lock" flock -w 600 9 [ -e "$w/.git/HEAD" ] || git init -q "$w" git -C "$w" remote add origin "$b" 2>/dev/null || git -C "$w" remote set-url origin "$b" mkdir -p "$w/.git/objects/info" printf "%s\n" "$b/objects" > "$w/.git/objects/info/alternates" git -C "$w" fetch -q origin +z :refs/cdx/inz git -C "$w" checkout -qf z git -C "$w" clean -qffd  r)rarVrr)rrrr\excludesrs&&&& rremote_checkout_scriptrjsxxLmLLH [[)*+ [[ " # $'(-{{Qse<3H'I&JK$$)KK$4#56##+*B 0 $u{{5)* ++rc(V^8dQhRRRRRRRR/#)rrrrrr#r)r%s"rr&r&3s(,,#,,3,3,rcR\P!V4 R\P!V4 RV R2pR\P!V4 2#)uSnapshot the node's post-run state the same way `snapshot_commit` does locally, push it to the bare mirror under `ref`, and print its sha — the delta the workstation fetches back. Shares `remote_checkout_script`'s lock so the two never race on one workspace.rerfa exec 9>"$w/.git/cdx-offload.lock" flock -w 600 9 cd "$w" idx="$w/.git/cdx-offload-result-index" export GIT_INDEX_FILE="$idx" git read-tree HEAD git add -A --ignore-errors tree=$(git write-tree) rm -f "$idx" base=$(git rev-parse HEAD) if [ "$tree" = "$(git rev-parse HEAD^{tree})" ]; then sha="$base" else sha=$(GIT_AUTHOR_NAME=cdx-offload GIT_AUTHOR_EMAIL=cdx-offload@local GIT_COMMITTER_NAME=cdx-offload GIT_COMMITTER_EMAIL=cdx-offload@local git commit-tree "$tree" -p "$base" -m "cdx-offload result") fi git push -q --force "$b" "$sha:z" printf "%s\n" "$sha" rrc)rrrrs&&& rremote_result_scriptrm3s^  [[)*+ [[ " #$**+./"/ " 6u{{5)* ++rc<V^8dQhRRRRRRRRRRR R R R R R RR/ #)rrr credentialr exec_namerrpr1 git_commonrr egress_hostsrZr#r)r%s"rr&r&Usb55555 5  5  55"55rc\\4RVRVRVP.pV'dVPRV.4V'dVPRV.4VFp VPRV .4K .VORNVNVO#)a`--git-common`/`--git-dir` each independently bind-mount their node-absolute path at the same path inside the container (agent-sandbox's own contract). A linked worktree's dispatch needs both; the git-push transport's bare mirror needs only `--git-common`.z--hostz--idz --runtimez --git-commonz --git-dirz --egress-hostr)rAGENT_SANDBOX_BINrextend) rrorprr1rqrrrr| allowed_hosts &&&&&&&& r launcher_argvrwUs  D ^Z01 ['*+$  _l34% 4T 44 4 4^ 44rcf]tRtRt$R]R&R]R&R]R&R]R&R ]R &R tR]R &R tR]R &R*tR]R&RtR]R&Rt R]R&Rt R]R&Rt R]R&Rt R]R&Rt R]R&RtR]R&RtR]R&RtR]R &RtR]R!&RtR]R"&R#R$lt]P*3R%R&llt]P*3R'R(lltR)tR#)+SessionitrrrKrgrr rrpr|r node_home workspacerZmountsNCredential | Noneror git_warningFr5rLrr} mirror_filesrrr1 no_workspacegit_pushrbare_urlpre_shacV^8dQhRR/#rr)r%s"rr&Session.__annotate__src hVPe$VPP4RVnR#R#)zMDrop the placement claim so the node stops looking busy to the next dispatch.N)rrrs&rrSession.releases( :: ! JJ   DJ "rcV^8dQhRR/#rr#rr)r%s"rr&rszrc  VP'dR#VP'dVPVR7#V!\VPVP VP 4VPR\R7pVP^8wd+RVP RVPP4 2#V!\VPVP VP VPR7RR\R7pTP^8wd+RTP RTPP4 2#R# \\ P"3dpRTP RT 2uRp?#Rp?ii;i) zLBring the node's post-run state home. Returns an error string, never raises.NrTinputrrzresult sync from rrLr)rr_pull_back_gitrrgr rrrrrrxr rrLrSrr)r,rtrackedrrUs&& r pull_backSession.pull_backs<     ===&&3&/ / F!$++tyy$,,G''#( G !!Q&*4>>*:)GNNDXDXDZC[\\$++tyy$,,DL\L\]#( D ??a &t~~&6i @Q@Q@S?TU U 334 F&t~~&6iuE E Fs%A=D:8AD::E1E,&E1,E1cV^8dQhRR/#rr)r%s"rr&rs  J rc  VPeVPeVPfQh\VP;'gR4p\ VP VPV4pV!.\VP4OVNRR\R7pTP^8wd+RTP RTPP!4 2#TP"P%4Uu.uF*qfP!4'gKTP!4NK, ppT'gRTP R2#TR ,p\'TP(TPTPTPTPTP;'gRTR7# \\P3dpRTP RT 2uRp?#Rp?ii;iuupi) uSnapshot the node, push the result to the bare mirror, fetch it home (delta only), and apply it as an uncommitted change against the local `pre_sha`. Refuses — never overwrites — if the local checkout moved since the push; the result stays safe on the fetched ref either way.NrTrzresult snapshot on rz produced no commit)r rgrrrsandboxrr)rrrrr1rmrr}rgrrSrrrrrxr rrpull_back_git_deltar ) r,rrscriptgotrUr/ node_linesnode_shas && rrSession._pull_back_gits }}(T]]-F4<>Q ((8 #**BRBRBTAUV V/2zz/D/D/FW/Ft**,ldjjl/F W((88KL Lb>";;nn]]LLOO))r  334 H((8 #G G HXs*.'F,GGG2G G G)rr)rrrrrrzr{r|ror~rLrrr1rrrrrrrrrrrrrrryrytsN L J L OIsIs FO $(J!("K"KL%#'E '!J !L$HdHjHjGZ 'NN6",  rryc4V^8dQhRRRRRRRRRRR RR R /#) rr rrgrKrrrrrr#rr)r%s"rr&r&sP55 5 5 5  5  555rc \V4pRV 2pT!RR\V4RRVRV RV 2.V'd \V4MRR R \R 7p T P^8wd!R T R T PP4 2#\YR 7wr\YTR 7p Y8wd RT RT RT R2#T!RR\T4RRYH.R \R7pTP^8wd!RT RTPP4 2#T!RR\T4RRR.TPR \R7pTP^8wd!RT RTPP4 2#R# \\ P 3dp R T R T 2uRp ? #Rp ? ii;i \dp RT R T 2uRp ? #Rp ? ii;i \\ P 3dp RT RT 2uRp ? #Rp ? ii;i)zOFetch a dispatched result and apply its delta with Session's refusal semantics.zrefs/cdx-fetch/rr fetchr'rgrBNTr%zresult fetch from rrzchecking the local checkout of zlocal checkout z changed during the u8 dispatch; not overwriting it — the result is safe at z in this repositorydiffz--binaryrzpreparing the z result failed: applyr'rz applying the )rrrrrSrrrrxr rOr>rr)r rgrrrrrr fetch_reffetchedrU current_treer expected_treedeltaapplieds$$$$$$$ rrrs$ W C!'+I > T3t9gtX3%qQZP[G\ ]'- F#4$  Q#I;i8L8L8N7OPPF(7 37 $dV#7 {C<u||?Q?Q?S>TU U T3t9gz3 G,,t=M  Qyk)9'..:N:N:P9QRR = Z// 0>#I;iu==> F0iuEEF& Z// 0@yk)9#??@s`:E>F,AF';)F'F2E?9F?F F$FF$F$'GG GGc4V^8dQhRRRRRRRRR R R RR R /#rrprrrprr registry_pathrror}rr#ryr)r%s"rr&r&sW m m m m  m m " m  m  mrc \WW#WEWg4#)zQThe incumbent podman dispatcher. Keep this body stable: flag-off is its contract.)_open_session_impl)rprrrrorr:rs&&&&&&&&r_open_podman_sessionrs iZ^c llrc4V^8dQhRRRRRRRRR R R RR R /#rr)r%s"rr&r&sWoooo o o " o o orcaaaaaaaa\PP\4R8Xd(^RIpVP SSSSSSVVVVVVVV3RlR7#\ SSSSSSSS4#)1Nc (<\SSSSSSSS4#r))r)rrorrprr:rrsropen_session..$s1>3 z3PUW]r)rprrrrorfallback)rErFrGK3S_DISPATCH_ENV k3s_dispatch open_sessionr) rprrrrorr:rrs ffffffff rrrsp zz~~&'3.(()'!)   >3 z[^`egm nnrc4V^8dQhRRRRRRRRR R R RR R /#rr)r%s"rr&r&+sWTTTT T T " T T TrcVf\RV 2\R7hVPP4'd6\P !VP\P 4'gB\VP RVP;'gR RVP 2\R7h\4p\V4p V e9V'd1\\^, RV ^, R\ R2\R7hV eVf\P!4M \V4p \V ^,4P!4p V P#4'dT MW, P%4p V P'4'g*\\^, RV ^, R 2\R7h\)V 4f*\\^, RV ^, R 2\R7hT p\+V4p \-\/V 4WgR 7wrp\1\3V P5R .4Uu0uFtp\7VP5R 4;'g/P5\84;p\:4'gKIVP5R4'gKb\=VR,4kKv up44p\?W4p\AV4pRpRpRpRpRpV'dRp\CV4pRpV.pMV eAX PEV4p\IT4pT\R48wdT RT 2p\KYT4p\MV4p\OVVR7pVfRM \QVVR7pVRJ;'dVRJpV'dRpRpV\R.pM@\UVVR7p\WVVR7pV.pVe VVPXVPZ., pV!.\]V4OR\^P`!V4 R2NRR\bR7p T Pj^8wd/\T RT PlPo4 2\R7hT PpPs4U"u.uF+p"T"Po4'gKT"Po4NK- p#p"T#'g\T R2\R7hT#R7,PuR4p$T$PwR4'g\T RT#R7, 2\R7hT$ RT 2p%Te#T$ RTPX 2T$ RTPZ 23MR8p&T'dRp'EMT'Ed\yT4p(\{4p)\}T4p*\T*4p+T$ RT+ 2p\TT4pT3p&T!.\]T4O\T+4NRR\bR7p,T,Pj^8wd/\T RT,PlPo4 2\R7h\T(T)4p-T!\TTTT-4\T4RR\R7p.T.Pj^8wd/\T RT.PlPo4 2\R7h\TTT(T-\T4TTR7p'T!.\]T4O\TTT-T4NRR\R7p/T/Pj^8wd/\T R T/PlPo4 2\R7hMT!\TTT4TR\R!7p0T0Pj^8wd/\T R"T0PlPo4 2\R7hT!\TTTTRJR#7RR\R7p.T.Pj^8wd/\T R"T.PlPo4 2\R7hTfRM\TTT\IT4TTR7p'T'd \T4M \yT4p1\T&4^8d T&^,MRp2\T&4^8d T&^,MRp3\R8/R$TbR TbR%TbR&TbR'T1bR(T$bR)T%bR*T&bR+TbR,\TTTTT1T2T3TR-7bR.T'bR/TRJbR0TbR1TbR2TbR3TbR4TbR5TbR6Tb#uupi \Fd.\\^, RT ^, RT 2\R7Rhi;i \d\fPh3dp!\T RT! 2\R7T!hRp!?!ii;iuup"i \d\fPh3dp!\T RT! 2\R7T!hRp!?!ii;i \d\fPh3dp!\T RT! 2\R7T!hRp!?!ii;i \d\fPh3dp!\T R T! 2\R7T!hRp!?!ii;i \d\fPh3dp!\T R"T! 2\R7T!hRp!?!ii;i \dTeTP4hi;i)9Nzno credential resolved for r/z credential for z z is not a readable file: raz is not supported with z-=1: there is no mirrored checkout to point atz is not a directoryzD is not inside a git checkout, so there is no bounded tree to mirror)r:rr]rgrbFrz( resolves outside the mirrored checkout .r5rrz && printf '%s\n' "$HOME"Trz: could not prepare mirror: z3: node home is missing from prepare-mirror responsez: node home is not absolute: z%: could not prepare the bare mirror: r%z: git push failed: )rrz: remote checkout failed: rz: mirror push failed: rrr rr1rzr{r|ror|)rrorprr1rqrrrr~rLrrrrrrrrr)QrEXIT_CREDENTIALrrcrErgR_OKrrrIrrrHrirrryrrDis_dirr rVrrctuplertrGrDOORrKrrmrr>r`rTrJr!r8rrZrrrrrr}rrarxrSrrrrxr rrrrr1r rrrrrr^rrr3rjrrr BaseExceptionrr;rryrw)4rprrrrorr:rrworkdirbase requestedrXrbrgritemre mirror_hostsrhr  commondirrrrrrrr remote_dirsinside containermaderUr/rrzr{r|r~sboxrrrensurein_refpushedcheckoutreffective_sandbox_idgit_common_mount git_dir_mounts4&&&&&&&& rrr+s  )) 5O   ?? " " $ $BIIjoorww,O,O !!""2:??3T3Tn2UV''1&7 9   *+L>*G| Q '!*-DEUDVW8 8   [txxzd3i$//1 "+"7"7"9"9Yt?OXXZ !!$ #$Agaj\1DEK   " *$ #$Agaj\2,,   ]+H%oh&?u\D%LL"-!-D  2 8 8b==dCCtd K PTPXPXY_P` DL-!L d #D~~!% "## L(.GF")K" &2248F05 T#Y&#,+Qvh 7I!0)!T$T*G&t5I'/d_Ts5SG ,DD1DH" &(<=  0#> #Dc2&i %F$8$8&:O:O#PPK f% ; 788TU $)D ??a $&4T[[5F5F5H4IJ  +/++*@*@*BS*B$djjl*BS$&KL  "I$$S) ##C(($&5eBi[A  !k7), !+Qv3345+Qv4456    K Xd#D)+K9%C&s+H#AhZ0H#FH5H [F Lhv&L(A((KL#'-   A%(fA&--BUBUBWAXY$"$ 4F g$T8WfE#F+#',   A%(f/ 0C0C0E/FGk+hfk&.ATWZK !&).w&'R$(,""a'(f6x7L7L7N6OPWb(  %fdG<&#',  %%*,& 6w~~7K7K7M6NOVafdGtAST#',   A%(f26==3F3F3H2IJ$>'D'+>t+DfRU 8D-d3TXIY$'K1$4vay$!$V!1F1ItM        (        !)+'!%   ( ) *$&+ ,"- ./ 0"1 23 45 67 89 S!." ,(+,Agaj\9a&"(   L334 $&4SE:  TVZ778 (fA#Gk $Z778 g(D61DSE)JQ\]cff g&Z778 (f6se<; 4Z778 (f23%8{ "    MMO s)/!a $a :a a 4f<5aA#f<* f<7A f<5b:Af<c2cB f<'f<+f<4Af<6&cA f<(&dAf<))e?f<A9f Af<8bf<c 0cc  f<d /dd  f<e)eef<e?#e::e??f<f9f44f99f<rFrJrYrprzrrrrrrrrrrrrrrrrrrrrrrrrrr rrr+r,rrr3r9r>rOrZr^rjrmrwryrrrrrrrrsB#   ! i'*?? IIK)+e3oE '= 4,1     EFG("**5L*MN8"**Eb:cd> Ku@vw%rzz2J'KLrzz*:;< #HIJ #|}~BJJ']^_ x34T( -$D       " #\>f 7&0^^12    ?? !~~  $(^^/.8 *~~"  ,.  >&f-$.>>,/T B ,4 ; .%**45 %& 6r_.8^^A$.>>6r%/NN!D_,:,D5> R R  R j5 5v'$(  m"'$( o<'$( TTr