@ai-outfitter/outfitter 1.0.3 → 1.1.0

package/dist/sources/PrivateCatalogGate.js

@@ -0,0 +1,23 @@
+// Loads the enterprise-licensed private-catalog policy boundary for CLI source synchronization.
+import { createRequire } from 'node:module';
+import { resolveRepositoryCodeAsset } from '../paths/RepositoryAssets.js';
+import { createRemoteRepositoryCachePath, formatRemoteSourceDisplay } from './SourceCache.js';
+const loadEnterpriseGateModule = () => createRequire(import.meta.url)(resolveRepositoryCodeAsset('enterprise/cli/privateCatalogGate.cjs'));
+export const createEnterprisePrivateCatalogGate = (input) => {
+    const enterprise = loadEnterpriseGateModule();
+    const { homeDirectory } = input;
+    const gate = enterprise.createPrivateCatalogGate({
+        homeDirectory,
+        classifier: input.classifier ?? enterprise.createGitHubRepositoryVisibilityClassifier(),
+        prompt: input.prompt,
+    });
+    return {
+        filter(sources, cacheDirectory) {
+            return enterprise.gatePrivateCatalogSources(sources, gate, {
+                formatDisplayUri: formatRemoteSourceDisplay,
+                resolveCachePath: (source) => createRemoteRepositoryCachePath(homeDirectory, source, cacheDirectory),
+            });
+        },
+    };
+};
+//# sourceMappingURL=PrivateCatalogGate.js.map

package/dist/sources/PrivateCatalogGate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PrivateCatalogGate.js","sourceRoot":"","sources":["../../src/sources/PrivateCatalogGate.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAE1E,OAAO,EAAE,+BAA+B,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AA6C9F,MAAM,wBAAwB,GAAG,GAAyB,EAAE,CAC1D,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAC5B,0BAA0B,CAAC,uCAAuC,CAAC,CAC5C,CAAC;AAE5B,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,KAIlD,EAA4B,EAAE;IAC7B,MAAM,UAAU,GAAG,wBAAwB,EAAE,CAAC;IAC9C,MAAM,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;IAChC,MAAM,IAAI,GAAG,UAAU,CAAC,wBAAwB,CAAC;QAC/C,aAAa;QACb,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,UAAU,CAAC,0CAA0C,EAAE;QACvF,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC,CAAC;IAEH,OAAO;QACL,MAAM,CACJ,OAAqB,EACrB,cAAuB;YAEvB,OAAO,UAAU,CAAC,yBAAyB,CAAC,OAAO,EAAE,IAAI,EAAE;gBACzD,gBAAgB,EAAE,yBAAyB;gBAC3C,gBAAgB,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,+BAA+B,CAAC,aAAa,EAAE,MAAM,EAAE,cAAc,CAAC;aACrG,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/sources/SourceCache.d.ts

@@ -10,10 +10,20 @@ export type RemoteSourceReference = {
     readonly ref?: string;
     readonly path?: string;
 };
+/** Distinguishes remote (`uri`/`github`) sources from local `path` sources. */
+export declare const isRemoteSource: <T extends {
+    readonly uri?: string;
+    readonly github?: string;
+}>(source: T) => source is T & RemoteSourceReference;
 export declare const normalizeGitUri: (uri: string) => string;
 export declare const normalizeRemoteSourceUri: (source: RemoteSourceReference) => string;
+export declare const formatRemoteSourceDisplay: (source: RemoteSourceReference) => string;
 export declare const redactSourceUriCredentials: (uri: string) => string;
+/** Redacts credentials from every URI embedded in arbitrary command or stderr text. */
+export declare const redactEmbeddedSourceCredentials: (value: string) => string;
 export declare const encodeSourceUri: (uri: string) => string;
 export declare const encodeRemoteSource: (source: RemoteSourceReference) => string;
-export declare const createRemoteRepositoryCachePath: (homeDirectory: string, source: RemoteSourceReference) => string;
+/** Resolves the one cache root used by sync, settings, layer discovery, and setup bootstrap. */
+export declare const resolveRemoteRepositoryCacheRoot: (homeDirectory: string, cacheDirectory?: string) => string;
+export declare const createRemoteRepositoryCachePath: (homeDirectory: string, source: RemoteSourceReference, cacheDirectory?: string) => string;
 export declare const resolveRemoteRepositorySubpath: (repositoryPath: string, subpath?: string) => string;

package/dist/sources/SourceCache.js

@@ -1,5 +1,7 @@
 // Encodes remote `.agents` source cache paths and normalizes remote source references.
 import { isAbsolute, join, relative, resolve } from 'node:path';
+/** Distinguishes remote (`uri`/`github`) sources from local `path` sources. */
+export const isRemoteSource = (source) => source.uri !== undefined || source.github !== undefined;
 export const normalizeGitUri = (uri) => (uri.startsWith('git+') ? uri.slice('git+'.length) : uri);
 export const normalizeRemoteSourceUri = (source) => {
     if (source.uri !== undefined) {
@@ -7,6 +9,9 @@ export const normalizeRemoteSourceUri = (source) => {
     }
     return `git+https://github.com/${source.github}.git`;
 };
+export const formatRemoteSourceDisplay = (source) => source.github === undefined
+    ? redactSourceUriCredentials(source.uri)
+    : `github:${source.github}${source.ref === undefined ? '' : `#${source.ref}`}`;
 export const redactSourceUriCredentials = (uri) => {
     const prefix = uri.startsWith('git+') ? 'git+' : '';
     const normalizedUri = normalizeGitUri(uri);
@@ -20,12 +25,16 @@ export const redactSourceUriCredentials = (uri) => {
         return `${prefix}${parsedUri.toString()}`;
     }
     catch {
-        return uri.replace(/\/\/[^/@\s]+@/u, '//REDACTED@');
+        return uri.replace(/\/\/[^/@\s]+@/gu, '//REDACTED@');
     }
 };
+/** Redacts credentials from every URI embedded in arbitrary command or stderr text. */
+export const redactEmbeddedSourceCredentials = (value) => value.replace(/((?:git\+)?[A-Za-z][A-Za-z0-9+.-]*:\/\/)[^/@\s]+@/gu, '$1REDACTED@');
 export const encodeSourceUri = (uri) => Buffer.from(redactSourceUriCredentials(uri), 'utf8').toString('base64url');
 export const encodeRemoteSource = (source) => encodeSourceUri(`${normalizeRemoteSourceUri(source)}#${source.ref ?? ''}`);
-export const createRemoteRepositoryCachePath = (homeDirectory, source) => join(homeDirectory, '.agents', 'cache', 'repos', encodeRemoteSource(source));
+/** Resolves the one cache root used by sync, settings, layer discovery, and setup bootstrap. */
+export const resolveRemoteRepositoryCacheRoot = (homeDirectory, cacheDirectory) => cacheDirectory ?? join(homeDirectory, '.agents', 'cache');
+export const createRemoteRepositoryCachePath = (homeDirectory, source, cacheDirectory) => join(resolveRemoteRepositoryCacheRoot(homeDirectory, cacheDirectory), 'repos', encodeRemoteSource(source));
 export const resolveRemoteRepositorySubpath = (repositoryPath, subpath = '') => {
     if (isAbsolute(subpath)) {
         throw new Error(`Remote repository path '${subpath}' must be relative.`);

package/dist/sources/SourceCache.js.map

@@ -1 +1 @@
-{"version":3,"file":"SourceCache.js","sourceRoot":"","sources":["../../src/sources/SourceCache.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAOhE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAElH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,MAA6B,EAAU,EAAE;IAChF,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC,GAAG,CAAC;IACpB,CAAC;IAED,OAAO,0BAA0B,MAAM,CAAC,MAAM,MAAM,CAAC;AACvD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,GAAW,EAAU,EAAE;IAChE,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,MAAM,aAAa,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAE3C,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;QAEzC,IAAI,SAAS,CAAC,QAAQ,KAAK,EAAE,IAAI,SAAS,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;YAC3D,OAAO,GAAG,CAAC;QACb,CAAC;QAED,SAAS,CAAC,QAAQ,GAAG,UAAU,CAAC;QAChC,SAAS,CAAC,QAAQ,GAAG,EAAE,CAAC;QACxB,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;IACtD,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAW,EAAU,EAAE,CACrD,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAE7E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAA6B,EAAU,EAAE,CAC1E,eAAe,CAAC,GAAG,wBAAwB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC;AAE7E,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,aAAqB,EAAE,MAA6B,EAAU,EAAE,CAC9G,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;AAE/E,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,cAAsB,EAAE,OAAO,GAAG,EAAE,EAAU,EAAE;IAC7F,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,qBAAqB,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,QAAQ,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;IAE5D,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,oCAAoC,CAAC,CAAC;IAC1F,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC,CAAC"}
+{"version":3,"file":"SourceCache.js","sourceRoot":"","sources":["../../src/sources/SourceCache.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAOhE,+EAA+E;AAC/E,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,MAAS,EAC4B,EAAE,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC;AAElG,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAElH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,MAA6B,EAAU,EAAE;IAChF,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC,GAAG,CAAC;IACpB,CAAC;IAED,OAAO,0BAA0B,MAAM,CAAC,MAAM,MAAM,CAAC;AACvD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,MAA6B,EAAU,EAAE,CACjF,MAAM,CAAC,MAAM,KAAK,SAAS;IACzB,CAAC,CAAC,0BAA0B,CAAC,MAAM,CAAC,GAAG,CAAC;IACxC,CAAC,CAAC,UAAU,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC;AAEnF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,GAAW,EAAU,EAAE;IAChE,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,MAAM,aAAa,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAE3C,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;QAEzC,IAAI,SAAS,CAAC,QAAQ,KAAK,EAAE,IAAI,SAAS,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;YAC3D,OAAO,GAAG,CAAC;QACb,CAAC;QAED,SAAS,CAAC,QAAQ,GAAG,UAAU,CAAC;QAChC,SAAS,CAAC,QAAQ,GAAG,EAAE,CAAC;QACxB,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;IACvD,CAAC;AACH,CAAC,CAAC;AAEF,uFAAuF;AACvF,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,KAAa,EAAU,EAAE,CACvE,KAAK,CAAC,OAAO,CAAC,qDAAqD,EAAE,aAAa,CAAC,CAAC;AAEtF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAW,EAAU,EAAE,CACrD,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAE7E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAA6B,EAAU,EAAE,CAC1E,eAAe,CAAC,GAAG,wBAAwB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC;AAE7E,gGAAgG;AAChG,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,aAAqB,EAAE,cAAuB,EAAU,EAAE,CACzG,cAAc,IAAI,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAE5D,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAC7C,aAAqB,EACrB,MAA6B,EAC7B,cAAuB,EACf,EAAE,CAAC,IAAI,CAAC,gCAAgC,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,OAAO,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;AAExH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,cAAsB,EAAE,OAAO,GAAG,EAAE,EAAU,EAAE;IAC7F,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,qBAAqB,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,QAAQ,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;IAE5D,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,oCAAoC,CAAC,CAAC;IAC1F,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC,CAAC"}

package/docs/documentation/catalogs.md

@@ -101,11 +101,19 @@ Remote settings are cached locally and merged at lower precedence than your proj
 
 `outfitter sync` synchronizes every remote source into the local cache:
 
-1. Remote settings repositories are cloned or updated first, then reloaded.
+1. Local settings are validated. Remote settings repositories are cloned or updated first, then
+   merged settings are reloaded.
 2. Remote sources (including any added by remote settings) are cloned or updated.
 3. Each synced source is validated; sync reports `updated`, `unchanged`, `skipped`, or `failed` per source.
 
-Pinned (`ref:`) sources stay on their pinned ref until you change it; unpinned sources fast-forward on every sync.
+All repositories live under `<cache_directory>/repos/<encoded-uri-and-ref>/` (default
+`~/.agents/cache`). Pinned (`ref:`) sources stay on their selected ref until you change it; unpinned
+sources resolve the remote's current default branch on every sync.
+
+Fetch and validation happen in a temporary sibling directory. Outfitter swaps a valid checkout into
+place atomically, so a failed fetch or invalid update preserves the last working cache. A required
+source failure makes sync exit nonzero. `outfitter run` remains offline with respect to source
+synchronization; run sync explicitly when you want network updates.
 
 ## Private repositories
 

package/docs/documentation/cli.md

@@ -1,7 +1,5 @@
 # CLI reference
 
-> **Status: RFC [#165](https://github.com/ai-outfitter/outfitter/issues/165) target.** This reference describes the dotagents end-state command surface. The currently released CLI still implements the legacy profile commands; implementation PRs replace them incrementally.
-
 Global options:
 
 | Option          | Description                  |
@@ -41,7 +39,17 @@ fallback.
 
 ## `outfitter sync`
 
-Synchronize remote sources and remote settings into the local cache. Reports a per-source status of `updated`, `unchanged`, `skipped`, or `failed`, and validates synced sources.
+Synchronize remote sources and remote settings into the local cache. Sync validates local settings,
+updates `remote_settings`, reloads the merged settings, and then updates the remote `sources` that
+result. Each repository reports `updated`, `unchanged`, `skipped`, or `failed`.
+
+Fetched content is validated in a temporary checkout before an atomic cache swap, so a failed fetch
+or invalid update leaves the last valid cache available. Required-source failures and invalid
+settings exit nonzero. Credentials embedded in URIs are redacted from status, errors, cache paths,
+and Git output.
+
+Sync is explicit: `outfitter run` never initiates network access. If a configured cache is absent,
+resolution tells you to run `outfitter sync`.
 
 ## `outfitter list [kind]`
 

package/docs/documentation/settings.md

@@ -39,13 +39,15 @@ remote_settings:
     path: .agents/settings.yml
     ref: 9c47d1e2b8a05f36c4d7e90a12b3f8c5d6e71a04
 
-cache_directory: ~/.agents/cache
+cache_directory: ./cache # optional; relative to this settings file
 ```
 
 - `default_agent` / `default_harness` — which agent plain `outfitter` runs, and the harness it launches in.
 - `sources` — ordered list of remote or local `.agents` payloads. Remote entries (`github:` / `uri:`) accept `ref:` pinning and an optional `path:` to the payload inside the repository; see [Catalogs](./catalogs.md) for conventions and trust guidance.
 - `remote_settings` — shared settings a repository distributes; cached locally and merged below your project and user settings, so anything you set locally wins.
-- `cache_directory` — where remote sources are cached (`outfitter sync` updates them).
+- `cache_directory` — the repository cache root used consistently by sync, remote settings, remote
+  source resolution, and default-catalog setup. It defaults to `~/.agents/cache`; repositories live
+  below its `repos/` directory.
 
 ## Precedence
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-outfitter/outfitter",
-  "version": "1.0.3",
+  "version": "1.1.0",
   "description": "Profile-oriented wrapper for launching pi, Claude Code, and future agent CLIs with reproducible configuration.",
   "type": "module",
   "repository": {