@outerlayer/cli 0.1.0

package/dist/config-POF7DEQW.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+export { RunnerConfigError, checkHooks, defaultRunnerConfigPath, loadRunnerConfig } from './chunk-WQ6VGRGZ.js';
+import './chunk-VNVZDWO3.js';
+import './chunk-Z5GEFMRW.js';
+
+createRequire(import.meta.url);

package/dist/context-materialize-J6CRQ7O7.js

@@ -0,0 +1,589 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { readPin, pinExists, writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, SOURCE_CACHE_TTL_SUCCESS_MS, readContextManifest, isLastCheckFresh, manifestFilesPresent, readDegraded, touchLastCheck, clearDegraded, writeContextManifest, writePinIfChanged, readSourceCache, isSourceCacheFresh } from './chunk-A3WLZX2F.js';
+import { parseGoverns, normalizeRepoName, CONTEXT_SOURCE_CONFIG_PATH } from './chunk-KFYJV2ZG.js';
+import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
+import { ensureContextExcludes, ensurePreCommitGuardHook } from './chunk-IWIUYLDR.js';
+import { readCloudConfig } from './chunk-TFUIDMOB.js';
+import { homeFromEnv } from './chunk-VNVZDWO3.js';
+import './chunk-Z5GEFMRW.js';
+import { execFileSync } from 'child_process';
+import { existsSync, mkdirSync, writeFileSync, chmodSync, unlinkSync, readdirSync, rmSync, lstatSync } from 'fs';
+import { isAbsolute, join, dirname, relative } from 'path';
+
+createRequire(import.meta.url);
+var defaultGitRunner = (args, opts) => {
+  try {
+    const stdout = execFileSync("git", args, {
+      cwd: opts.cwd,
+      timeout: opts.timeoutMs,
+      input: opts.input,
+      // Control-plane trees are small config/doc surfaces (AGENTS.md,
+      // .claude/**, .outerlayer/**) — generous but bounded so a runaway
+      // cat-file stream can't exhaust memory.
+      maxBuffer: 64 * 1024 * 1024,
+      stdio: ["pipe", "pipe", "pipe"],
+      env: {
+        ...process.env,
+        // classifyGitFailure greps English stderr substrings
+        // ("Authentication failed", "Permission denied", …) — a git running
+        // under a non-English locale would translate those and silently
+        // misclassify every failure as "unreachable" instead of "no-access".
+        LC_ALL: "C",
+        // A bare https:// remote with no cached credential answer otherwise
+        // blocks on an interactive username/password prompt with no
+        // terminal to read from here, hanging until OUR OWN timeout instead
+        // of failing fast with a classifiable stderr message.
+        GIT_TERMINAL_PROMPT: "0"
+      }
+    });
+    return { ok: true, stdout: Buffer.isBuffer(stdout) ? stdout : Buffer.from(stdout), stderr: "" };
+  } catch (err) {
+    const e = err;
+    return {
+      ok: false,
+      stdout: e.stdout ? Buffer.from(e.stdout) : Buffer.alloc(0),
+      stderr: e.stderr ? Buffer.from(e.stderr).toString("utf8") : e.message ?? String(err)
+    };
+  }
+};
+function gitText(git, cwd, args, timeoutMs) {
+  const result = git(args, { cwd, timeoutMs });
+  return result.ok ? result.stdout.toString("utf8").trim() : void 0;
+}
+var NOT_GOVERNED_MESSAGE = "this repository's control plane no longer governs it";
+var ADOPTION_MESSAGE = "committed context files shadow the control plane \u2014 remove them in a commit";
+var CANNOT_IDENTIFY_MESSAGE = "this repository is governed, but the control plane cannot be identified \u2014 check OuterLayer connectivity/config";
+var DESIGNATION_AUTH_REJECTED_MESSAGE = "the OuterLayer API key was rejected (401/403) \u2014 check apiKey in ~/.outerlayer/config.json";
+var PARTIAL_WRITE_MESSAGE = "control-plane content could not be fully written \u2014 running on previous context";
+var COMMIT_GUARD_FOREIGN_NOT_INSTALLED_MESSAGE = "the materialized-context commit guard is NOT installed \u2014 a pre-commit hook this clone did not write occupies that slot \u2014 resolve the conflict or run `outerlayer hooks install-git`";
+var COMMIT_GUARD_HOOKSPATH_NOT_INSTALLED_MESSAGE = "the materialized-context commit guard is NOT installed \u2014 hooks are managed via core.hooksPath, which this clone never writes to automatically \u2014 adopt it yourself: `outerlayer hooks install-git --print`";
+function guardNotInstalledMessage(guard) {
+  if (guard.adopted) return void 0;
+  if (guard.status === "skipped-foreign") return COMMIT_GUARD_FOREIGN_NOT_INSTALLED_MESSAGE;
+  if (guard.status === "skipped-custom-hooks-path") return COMMIT_GUARD_HOOKSPATH_NOT_INSTALLED_MESSAGE;
+  return void 0;
+}
+var FAILURE_DEBOUNCE_MS = 2 * 60 * 1e3;
+function hasGovernedEvidence(hasPin, manifest) {
+  return hasPin || manifest !== void 0;
+}
+function hasSymlinkComponent(root, relPath) {
+  let current = root;
+  for (const segment of relPath.split("/")) {
+    current = join(current, segment);
+    let st;
+    try {
+      st = lstatSync(current);
+    } catch {
+      return false;
+    }
+    if (st.isSymbolicLink()) return true;
+  }
+  return false;
+}
+function unreachableMessage(lastGoodSha) {
+  return lastGoodSha ? `could not verify the control plane \u2014 running on previously materialized context at \`${lastGoodSha.slice(0, 7)}\` (it may have moved)` : "this repository is governed but its context has never been materialized and the control plane is unreachable \u2014 running without governed context";
+}
+function noAccessMessage(lastGoodSha) {
+  const base = "you do not have access to the control plane";
+  const remedy = " \u2014 check your git credentials (SSH key or token) and org/SSO access, then retry";
+  return lastGoodSha ? `${base}; running on previously materialized context at \`${lastGoodSha.slice(0, 7)}\`${remedy}` : `${base}; running with repository defaults${remedy}`;
+}
+function classifyGitFailure(stderr) {
+  if (/authentication failed|permission denied \(publickey\)|\b403\b|saml sso|access denied/i.test(stderr)) {
+    return "no-access";
+  }
+  return "unreachable";
+}
+async function materializeContext(deps) {
+  const home = deps.home ?? homeFromEnv();
+  const now = deps.now ?? Date.now;
+  const git = deps.git ?? defaultGitRunner;
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const repoRoot = gitText(git, deps.cwd, ["rev-parse", "--show-toplevel"], 2e3);
+  if (repoRoot === void 0) {
+    return { status: "not-a-repo", sha: null, verification: "none" };
+  }
+  const gitCommonDir = resolveGitCommonDir(git, repoRoot);
+  if (gitCommonDir === void 0) {
+    return { status: "not-a-repo", sha: null, verification: "none" };
+  }
+  const pin = readPin(repoRoot);
+  const hasPin = pin !== void 0 || pinExists(repoRoot);
+  const record = (sha2, verification, repository2, ref2) => {
+    appendContextProvenance(
+      { t: new Date(now()).toISOString(), sessionId: deps.sessionId, repoRoot, repository: repository2, ref: ref2, sha: sha2, verification },
+      home
+    );
+  };
+  const selfOutcome = () => {
+    if (hasPin) {
+      writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind: "not-governed", message: NOT_GOVERNED_MESSAGE });
+      return { status: "not-governed", message: NOT_GOVERNED_MESSAGE, sha: null, verification: "none" };
+    }
+    clearDegraded(gitCommonDir);
+    return { status: "self", sha: null, verification: "none" };
+  };
+  const ownRepoName = deriveOwnRepoName(git, repoRoot);
+  if (ownRepoName === void 0) {
+    return selfOutcome();
+  }
+  const designation = await resolveDesignation({ git, fetchImpl, home, now, gitCommonDir, ownRepoName });
+  if (designation.status === "self") {
+    return selfOutcome();
+  }
+  if (designation.status === "unknown") {
+    const message = designation.authRejected ? DESIGNATION_AUTH_REJECTED_MESSAGE : CANNOT_IDENTIFY_MESSAGE;
+    if (hasPin) {
+      writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind: "designation-unverified", message });
+      record(null, "none");
+      return { status: "designation-unverified", message, sha: null, verification: "none" };
+    }
+    if (designation.authRejected) {
+      writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind: "designation-unverified", message });
+    }
+    writeSourceCache(gitCommonDir, { checkedAt: new Date(now()).toISOString(), status: "self", ttlMs: SOURCE_CACHE_TTL_RETRY_MS });
+    return { status: "self", sha: null, verification: "none" };
+  }
+  let repository;
+  let ref;
+  let unverifiedIdentity;
+  let preFetched;
+  if (designation.status === "candidates") {
+    const sortedCandidates = [...designation.candidates].sort((a, b) => a.repository.localeCompare(b.repository));
+    const claimants = [];
+    for (const candidate of sortedCandidates) {
+      const candidateUrl = deps.resolveControlPlaneUrl ? deps.resolveControlPlaneUrl(candidate.repository, candidate.ref, repoRoot) : buildControlPlaneUrl(git, repoRoot, candidate.repository);
+      const candidateHost = parseRemoteHost(candidateUrl).host || "unknown-host";
+      const candidateCacheDir = ensureBareCache(git, home, candidate.repository, candidateHost);
+      const candidateLocalRef = `refs/outerlayer/${sanitizeRefName(candidate.ref)}`;
+      const candidateFetch = git(["fetch", "--depth", "1", candidateUrl, `+${candidate.ref}:${candidateLocalRef}`], {
+        cwd: candidateCacheDir,
+        timeoutMs: 1e4
+      });
+      if (!candidateFetch.ok) continue;
+      const candidateSha = gitText(git, candidateCacheDir, ["rev-parse", candidateLocalRef], 2e3);
+      if (candidateSha === void 0) continue;
+      const candidateConfig = readBlobAtPath(git, candidateCacheDir, candidateSha, CONTEXT_SOURCE_CONFIG_PATH);
+      const candidateGoverns = candidateConfig === void 0 ? { governs: [] } : parseGoverns(candidateConfig);
+      const candidateGovernsList = "error" in candidateGoverns ? [] : candidateGoverns.governs;
+      if (candidateGovernsList.some((r) => normalizeRepoName(r) === normalizeRepoName(ownRepoName))) {
+        claimants.push({ repository: candidate.repository, ref: candidate.ref, sha: candidateSha, cacheRepoDir: candidateCacheDir });
+      }
+    }
+    if (claimants.length === 0) {
+      writeSourceCache(gitCommonDir, { checkedAt: new Date(now()).toISOString(), status: "self", ttlMs: SOURCE_CACHE_TTL_SUCCESS_MS });
+      return selfOutcome();
+    }
+    if (claimants.length > 1) {
+      const names = claimants.map((c) => c.repository).sort();
+      const message = `${names.join(" and ")} both claim to govern this repository \u2014 resolve the designation before context can materialize`;
+      writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind: "conflict", message });
+      const manifestForConflict = readContextManifest(gitCommonDir);
+      const lastGood = manifestForConflict?.sha ?? null;
+      const verification = manifestForConflict ? "unverified" : "none";
+      record(lastGood, verification);
+      return { status: "conflict", message, sha: lastGood, verification };
+    }
+    const winner = claimants[0];
+    writeSourceCache(gitCommonDir, {
+      checkedAt: new Date(now()).toISOString(),
+      status: "governed",
+      repository: winner.repository,
+      ref: winner.ref,
+      ttlMs: SOURCE_CACHE_TTL_SUCCESS_MS
+    });
+    repository = winner.repository;
+    ref = winner.ref;
+    preFetched = { sha: winner.sha, cacheRepoDir: winner.cacheRepoDir };
+  } else {
+    repository = designation.repository;
+    ref = designation.ref;
+    unverifiedIdentity = designation.unverifiedIdentity;
+  }
+  const manifest = readContextManifest(gitCommonDir);
+  const evidenced = hasGovernedEvidence(hasPin, manifest);
+  const clearOrFlagIdentity = () => {
+    if (unverifiedIdentity) {
+      writeDegraded(gitCommonDir, {
+        at: new Date(now()).toISOString(),
+        kind: "designation-unverified",
+        message: CANNOT_IDENTIFY_MESSAGE,
+        repository,
+        ref
+      });
+    } else {
+      clearDegraded(gitCommonDir);
+    }
+  };
+  let sha;
+  let cacheRepoDir;
+  if (preFetched) {
+    sha = preFetched.sha;
+    cacheRepoDir = preFetched.cacheRepoDir;
+  } else {
+    if (isLastCheckFresh(gitCommonDir, now()) && manifest !== void 0 && pin?.sha === manifest.sha && manifestFilesPresent(repoRoot, manifest)) {
+      const degraded = readDegraded(gitCommonDir);
+      const verification = degraded ? "unverified" : "verified";
+      ensureContextExcludes(gitCommonDir);
+      const guardMessage2 = guardNotInstalledMessage(ensurePreCommitGuardHook(repoRoot, gitCommonDir));
+      record(manifest.sha, verification, repository, ref);
+      return {
+        status: "debounced",
+        sha: manifest.sha,
+        verification,
+        ...guardMessage2 ? { message: guardMessage2 } : {}
+      };
+    }
+    const recentFailure = readDegraded(gitCommonDir);
+    if (recentFailure && (recentFailure.kind === "unreachable" || recentFailure.kind === "no-access") && recentFailure.repository === repository && recentFailure.ref === ref && now() - Date.parse(recentFailure.at) < FAILURE_DEBOUNCE_MS) {
+      const lastGood = manifest?.sha ?? null;
+      const verification = lastGood ? "unverified" : "none";
+      if (evidenced) {
+        record(lastGood, verification, repository, ref);
+        return { status: recentFailure.kind, message: recentFailure.message, sha: lastGood, verification };
+      }
+      return { status: recentFailure.kind, sha: null, verification: "none" };
+    }
+    const remoteUrl = deps.resolveControlPlaneUrl ? deps.resolveControlPlaneUrl(repository, ref, repoRoot) : buildControlPlaneUrl(git, repoRoot, repository);
+    const cacheHost = parseRemoteHost(remoteUrl).host || "unknown-host";
+    const lsRemote = git(["ls-remote", remoteUrl, ref], { cwd: repoRoot, timeoutMs: 2e3 });
+    if (lsRemote.ok) {
+      const remoteSha = parseLsRemoteSha(lsRemote.stdout.toString("utf8"));
+      if (remoteSha && manifest !== void 0 && manifest.sha === remoteSha && pin?.sha === remoteSha && manifestFilesPresent(repoRoot, manifest)) {
+        touchLastCheck(gitCommonDir, now());
+        clearOrFlagIdentity();
+        ensureContextExcludes(gitCommonDir);
+        const guardMessage2 = guardNotInstalledMessage(ensurePreCommitGuardHook(repoRoot, gitCommonDir));
+        writeSourceCache(gitCommonDir, { checkedAt: new Date(now()).toISOString(), status: "governed", repository, ref, ttlMs: SOURCE_CACHE_TTL_SUCCESS_MS });
+        record(remoteSha, "verified", repository, ref);
+        return {
+          status: "debounced",
+          sha: remoteSha,
+          verification: "verified",
+          ...guardMessage2 ? { message: guardMessage2 } : {}
+        };
+      }
+    }
+    cacheRepoDir = ensureBareCache(git, home, repository, cacheHost);
+    const localRef = `refs/outerlayer/${sanitizeRefName(ref)}`;
+    const fetchResult = git(["fetch", "--depth", "1", remoteUrl, `+${ref}:${localRef}`], { cwd: cacheRepoDir, timeoutMs: 1e4 });
+    if (!fetchResult.ok) {
+      const kind = classifyGitFailure(fetchResult.stderr);
+      const lastGood = manifest?.sha ?? null;
+      const verification = lastGood ? "unverified" : "none";
+      const doctorMessage = kind === "no-access" ? noAccessMessage(lastGood) : unreachableMessage(lastGood);
+      writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind, message: doctorMessage, repository, ref, lastGoodSha: lastGood ?? void 0 });
+      if (evidenced) {
+        record(lastGood, verification, repository, ref);
+        return { status: kind, message: doctorMessage, sha: lastGood, verification };
+      }
+      return { status: kind, sha: null, verification: "none" };
+    }
+    const fetchedSha = gitText(git, cacheRepoDir, ["rev-parse", localRef], 2e3);
+    if (fetchedSha === void 0) {
+      const lastGood = manifest?.sha ?? null;
+      const verification = lastGood ? "unverified" : "none";
+      const doctorMessage = unreachableMessage(lastGood);
+      writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind: "unreachable", message: doctorMessage, repository, ref, lastGoodSha: lastGood ?? void 0 });
+      if (evidenced) {
+        record(lastGood, verification, repository, ref);
+        return { status: "unreachable", message: doctorMessage, sha: lastGood, verification };
+      }
+      return { status: "unreachable", sha: null, verification: "none" };
+    }
+    sha = fetchedSha;
+    const configContent = readBlobAtPath(git, cacheRepoDir, sha, CONTEXT_SOURCE_CONFIG_PATH);
+    const parsedGoverns = configContent === void 0 ? { governs: [] } : parseGoverns(configContent);
+    const governsList = "error" in parsedGoverns ? [] : parsedGoverns.governs;
+    const governed = governsList.some((r) => normalizeRepoName(r) === normalizeRepoName(ownRepoName));
+    if (!governed) {
+      writeSourceCache(gitCommonDir, { checkedAt: new Date(now()).toISOString(), status: "self", ttlMs: SOURCE_CACHE_TTL_SUCCESS_MS });
+      if (hasPin) {
+        writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind: "not-governed", message: NOT_GOVERNED_MESSAGE });
+        return { status: "not-governed", message: NOT_GOVERNED_MESSAGE, sha: pin?.sha ?? null, verification: "none" };
+      }
+      clearDegraded(gitCommonDir);
+      return { status: "self", sha: null, verification: "none" };
+    }
+  }
+  const tracked = git(["ls-files", "-z", "--", "AGENTS.md", ".claude", ".outerlayer"], { cwd: repoRoot, timeoutMs: 2e3 });
+  if (tracked.ok && tracked.stdout.length > 0) {
+    writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind: "adoption-conflict", message: ADOPTION_MESSAGE, repository, ref });
+    const lastGood = manifest?.sha ?? null;
+    record(lastGood, lastGood ? "unverified" : "none", repository, ref);
+    return { status: "adoption-conflict", message: ADOPTION_MESSAGE, sha: lastGood, verification: lastGood ? "unverified" : "none" };
+  }
+  const files = listMaterializedFiles(git, cacheRepoDir, sha);
+  const writeResult = writeFilesVerbatim(git, cacheRepoDir, files, repoRoot);
+  const partialWrite = () => {
+    const lastGood = manifest?.sha ?? null;
+    const verification = lastGood ? "unverified" : "none";
+    writeDegraded(gitCommonDir, {
+      at: new Date(now()).toISOString(),
+      kind: "unreachable",
+      message: PARTIAL_WRITE_MESSAGE,
+      repository,
+      ref,
+      lastGoodSha: lastGood ?? void 0
+    });
+    if (!evidenced) return { status: "unreachable", sha: null, verification: "none" };
+    record(lastGood, verification, repository, ref);
+    return { status: "unreachable", message: PARTIAL_WRITE_MESSAGE, sha: lastGood, verification };
+  };
+  if (!writeResult.ok) {
+    return partialWrite();
+  }
+  const deleteResult = manifest ? deleteRemovedFiles(repoRoot, manifest.files, writeResult.writtenPaths) : { skipped: [] };
+  if (deleteResult.skipped.length > 0) {
+    return partialWrite();
+  }
+  const newManifest = {
+    schemaVersion: 1,
+    sha,
+    files: writeResult.writtenPaths,
+    materializedAt: new Date(now()).toISOString()
+  };
+  writeContextManifest(gitCommonDir, newManifest);
+  ensureContextExcludes(gitCommonDir);
+  const guardMessage = guardNotInstalledMessage(ensurePreCommitGuardHook(repoRoot, gitCommonDir));
+  writePinIfChanged(repoRoot, sha);
+  touchLastCheck(gitCommonDir, now());
+  clearOrFlagIdentity();
+  writeSourceCache(gitCommonDir, { checkedAt: new Date(now()).toISOString(), status: "governed", repository, ref, ttlMs: SOURCE_CACHE_TTL_SUCCESS_MS });
+  record(sha, "verified", repository, ref);
+  return {
+    status: "materialized",
+    sha,
+    verification: "verified",
+    ...guardMessage ? { message: guardMessage } : {}
+  };
+}
+async function resolveDesignation(ctx) {
+  const cache = readSourceCache(ctx.gitCommonDir);
+  if (cache && isSourceCacheFresh(cache, ctx.now())) {
+    return cache.status === "governed" && cache.repository && cache.ref ? { status: "governed", repository: cache.repository, ref: cache.ref } : { status: "self" };
+  }
+  let authRejected = false;
+  const config = readCloudConfig(ctx.home);
+  if (config.url && config.apiKey && config.appId) {
+    const sources = await fetchContextSource(
+      config,
+      ctx.ownRepoName,
+      ctx.fetchImpl,
+      () => {
+        authRejected = true;
+      }
+    );
+    if (sources !== void 0) {
+      if (sources.length === 0) {
+        writeSourceCache(ctx.gitCommonDir, {
+          checkedAt: new Date(ctx.now()).toISOString(),
+          status: "self",
+          ttlMs: SOURCE_CACHE_TTL_SUCCESS_MS
+        });
+        return { status: "self" };
+      }
+      return { status: "candidates", candidates: sources };
+    }
+  }
+  if (cache) {
+    return cache.status === "governed" && cache.repository && cache.ref ? { status: "governed", repository: cache.repository, ref: cache.ref, unverifiedIdentity: true } : { status: "self" };
+  }
+  return { status: "unknown", authRejected };
+}
+async function fetchContextSource(config, ownRepoName, fetchImpl, onAuthRejected) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), 2e3);
+  try {
+    const url = `${config.url.replace(/\/$/, "")}/v1/context/source?repo=${encodeURIComponent(ownRepoName)}`;
+    const res = await fetchImpl(url, {
+      headers: { Authorization: `Bearer ${config.apiKey}`, "x-outerlayer-app-id": config.appId },
+      signal: controller.signal
+    });
+    if (res.status === 401 || res.status === 403) {
+      onAuthRejected();
+      return void 0;
+    }
+    if (!res.ok) return void 0;
+    const body = await res.json();
+    return body.data?.sources;
+  } catch {
+    return void 0;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function resolveGitCommonDir(git, repoRoot) {
+  const abs = gitText(git, repoRoot, ["rev-parse", "--path-format=absolute", "--git-common-dir"], 2e3);
+  if (abs !== void 0) return abs;
+  const rel = gitText(git, repoRoot, ["rev-parse", "--git-common-dir"], 2e3);
+  if (rel === void 0) return void 0;
+  return isAbsolute(rel) ? rel : join(repoRoot, rel);
+}
+function deriveOwnRepoName(git, repoRoot) {
+  const url = gitText(git, repoRoot, ["config", "--get", "remote.origin.url"], 2e3);
+  if (url === void 0) return void 0;
+  return parseOwnerRepo(url);
+}
+function parseOwnerRepo(url) {
+  const stripped = url.replace(/\.git$/, "");
+  const scpMatch = stripped.match(/^[\w.-]+@[\w.-]+:(.+)$/);
+  if (scpMatch) return scpMatch[1];
+  try {
+    const parsed = new URL(stripped);
+    return parsed.pathname.replace(/^\//, "");
+  } catch {
+    return void 0;
+  }
+}
+function parseRemoteHost(url) {
+  const scpMatch = url.match(/^([\w.-]+)@([\w.-]+):/);
+  if (scpMatch) return { scheme: "ssh", host: scpMatch[2] };
+  try {
+    const parsed = new URL(url);
+    return { scheme: parsed.protocol === "https:" ? "https" : "ssh", host: parsed.host };
+  } catch {
+    return { scheme: "https", host: "github.com" };
+  }
+}
+function buildControlPlaneUrl(git, repoRoot, repository) {
+  const ownUrl = gitText(git, repoRoot, ["config", "--get", "remote.origin.url"], 2e3);
+  const { scheme, host } = ownUrl ? parseRemoteHost(ownUrl) : { scheme: "https", host: "github.com" };
+  return scheme === "ssh" ? `git@${host}:${repository}.git` : `https://${host}/${repository}.git`;
+}
+function cacheDirName(repository, host) {
+  const parts = repository.split("/");
+  return [host, ...parts].join("__").replace(/[^a-zA-Z0-9._-]/g, "-");
+}
+function sanitizeRefName(ref) {
+  return ref.replace(/[^a-zA-Z0-9._-]/g, "-");
+}
+function ensureBareCache(git, home, repository, host) {
+  const dir = join(home, ".outerlayer", "control-planes", `${cacheDirName(repository, host)}.git`);
+  if (!existsSync(join(dir, "HEAD"))) {
+    mkdirSync(dirname(dir), { recursive: true });
+    git(["init", "--bare", "-q", dir], { cwd: dirname(dir), timeoutMs: 5e3 });
+  }
+  return dir;
+}
+function parseLsRemoteSha(output) {
+  const lines = output.split("\n").filter((l) => l.trim().length > 0);
+  const peeled = lines.find((l) => l.split(/\s+/)[1]?.endsWith("^{}"));
+  const line = peeled ?? lines[0];
+  return line?.split(/\s+/)[0];
+}
+var MATERIALIZED_ROOTS = ["AGENTS.md", ".claude", ".outerlayer"];
+function listMaterializedFiles(git, cacheRepoDir, sha) {
+  const result = git(["ls-tree", "-r", "-z", sha, "--", ...MATERIALIZED_ROOTS], { cwd: cacheRepoDir, timeoutMs: 1e4 });
+  if (!result.ok) return [];
+  const entries = [];
+  for (const raw of result.stdout.toString("utf8").split("\0")) {
+    if (!raw) continue;
+    const tabIdx = raw.indexOf("	");
+    if (tabIdx === -1) continue;
+    const meta = raw.slice(0, tabIdx).split(" ");
+    const [mode, type, objSha] = meta;
+    const path = raw.slice(tabIdx + 1);
+    if (mode === void 0 || objSha === void 0 || path === void 0) continue;
+    if (mode === "120000") continue;
+    if (type !== "blob") continue;
+    if (path.includes("..") || isAbsolute(path)) continue;
+    entries.push({ mode, type: "blob", sha: objSha, path });
+  }
+  return entries;
+}
+function readBlobAtPath(git, cacheRepoDir, sha, path) {
+  const result = git(["show", `${sha}:${path}`], { cwd: cacheRepoDir, timeoutMs: 5e3 });
+  return result.ok ? result.stdout.toString("utf8") : void 0;
+}
+function parseBatchReply(files, stdout) {
+  const parsed = [];
+  let pos = 0;
+  for (const file of files) {
+    const headerEnd = stdout.indexOf(10, pos);
+    if (headerEnd === -1) return void 0;
+    const header = stdout.subarray(pos, headerEnd).toString("utf8");
+    const parts = header.split(" ");
+    if (parts[0] !== file.sha) return void 0;
+    if (parts[1] === "missing") return void 0;
+    const size = parts[1] === "blob" && parts[2] !== void 0 ? Number(parts[2]) : NaN;
+    if (!Number.isFinite(size) || stdout.length < headerEnd + 1 + size + 1) return void 0;
+    const contentStart = headerEnd + 1;
+    parsed.push({ path: file.path, content: stdout.subarray(contentStart, contentStart + size), mode: file.mode });
+    pos = contentStart + size + 1;
+  }
+  return parsed;
+}
+function writeFilesVerbatim(git, cacheRepoDir, files, workpieceRoot) {
+  if (files.length === 0) return { writtenPaths: [], ok: true };
+  const input = files.map((f) => f.sha).join("\n") + "\n";
+  const result = git(["cat-file", "--batch"], { cwd: cacheRepoDir, timeoutMs: 15e3, input });
+  if (!result.ok) return { writtenPaths: [], ok: false };
+  const parsed = parseBatchReply(files, result.stdout);
+  if (parsed === void 0) return { writtenPaths: [], ok: false };
+  const writtenPaths = [];
+  let anySkipped = false;
+  for (const file of parsed) {
+    if (hasSymlinkComponent(workpieceRoot, file.path)) {
+      anySkipped = true;
+      continue;
+    }
+    const dest = join(workpieceRoot, file.path);
+    mkdirSync(dirname(dest), { recursive: true });
+    const mode = file.mode === "100755" ? 493 : 420;
+    writeFileSync(dest, file.content, { mode });
+    chmodSync(dest, mode);
+    writtenPaths.push(file.path);
+  }
+  return { writtenPaths, ok: !anySkipped };
+}
+function isDeletableManifestPath(rel) {
+  if (isAbsolute(rel)) return false;
+  if (rel.split("/").some((segment) => segment === "..")) return false;
+  return rel === "AGENTS.md" || rel.startsWith(".claude/") || rel.startsWith(".outerlayer/");
+}
+function deleteRemovedFiles(workpieceRoot, oldFiles, newFiles) {
+  const keep = new Set(newFiles);
+  const dirsToPrune = /* @__PURE__ */ new Set();
+  const skipped = [];
+  for (const rel of oldFiles) {
+    if (keep.has(rel)) continue;
+    if (!isDeletableManifestPath(rel)) continue;
+    if (hasSymlinkComponent(workpieceRoot, rel)) {
+      skipped.push(rel);
+      continue;
+    }
+    const abs = join(workpieceRoot, rel);
+    try {
+      unlinkSync(abs);
+      dirsToPrune.add(dirname(abs));
+    } catch {
+    }
+  }
+  for (const dir of dirsToPrune) {
+    pruneEmptyDirs(dir, workpieceRoot);
+  }
+  return { skipped };
+}
+function pruneEmptyDirs(dir, stopAt) {
+  let current = dir;
+  while (current !== stopAt && current.startsWith(stopAt) && relative(stopAt, current) !== "") {
+    let entries;
+    try {
+      entries = readdirSync(current);
+    } catch {
+      return;
+    }
+    if (entries.length > 0) return;
+    try {
+      rmSync(current, { recursive: false });
+    } catch {
+      return;
+    }
+    current = dirname(current);
+  }
+}
+
+export { defaultGitRunner, materializeContext, parseOwnerRepo, parseRemoteHost };