@outerlayer/cli 0.1.1 → 0.4.0

package/dist/chunk-7YIOOFVJ.js

@@ -0,0 +1,71 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { isPlaceholderCommand } from './chunk-CBZB6XY6.js';
+import { describeCallFailure } from './chunk-7A6RVXPZ.js';
+import { WorkCommandError, getJson } from './chunk-5DLBAXY5.js';
+import { sanitizeTerminal } from './chunk-6Y63SXFO.js';
+import { builtinKind } from './chunk-5Y3QQRUH.js';
+import { claudeCredential, CLAUDE_CREDENTIAL_VARIABLES } from './chunk-AUFG23AA.js';
+import { signerFor } from './chunk-M5POMKKW.js';
+
+createRequire(import.meta.url);
+
+// src/runner/host-setup.ts
+function placeholderQueues(config) {
+  return config.queues.filter((queue) => {
+    const command = config.commands[queue];
+    return command !== void 0 && isPlaceholderCommand(command);
+  });
+}
+function placeholderProblem(queues) {
+  const keys = queues.map((queue) => `runner.commands.${queue}`).join(", ");
+  return `${keys} ${queues.length === 1 ? "is" : "are"} still the placeholder \`runner init\` wrote, which fails every item. Edit ${queues.length === 1 ? "it" : "them"} to start your agent on item $OUTERLAYER_WORK`;
+}
+function needsClaudeCredential(hooks) {
+  return builtinKind(hooks.provision) !== "own";
+}
+var CREDENTIAL_FIX = "Run `claude setup-token`, then start the runner with CLAUDE_CODE_OAUTH_TOKEN set to the token it prints (or ANTHROPIC_API_KEY set to an API key), for example with EnvironmentFile= in the runner's systemd unit";
+function claudeCredentialCheck(env, options = {}) {
+  const name = "Claude credential";
+  const held = claudeCredential(env);
+  if (held === void 0) {
+    return {
+      name,
+      status: "fail",
+      detail: `neither ${CLAUDE_CREDENTIAL_VARIABLES.slice(0, 2).join(" nor ")} is set, so every build fails at provision as agent_credential_missing`,
+      fix: `${CREDENTIAL_FIX}.`
+    };
+  }
+  const sameVariables = options.shell === true ? "; the runner must be started with the same variable" : "";
+  return { name, status: "pass", detail: `${held.variable} is set${sameVariables}` };
+}
+function missingPermissionOf(err) {
+  if (!(err instanceof WorkCommandError) || err.status !== 403) return void 0;
+  const permission = /missing required permission '([^']+)'/i.exec(err.message)?.[1];
+  return permission === void 0 ? void 0 : sanitizeTerminal(permission);
+}
+function missingPermissionFix(permission) {
+  return `use a key that holds ${permission}: create one with the Runner preset on the factory's API keys page, then run \`outerlayer login\` with it`;
+}
+async function claimPermissionProblem(config, fetchImpl = fetch) {
+  const unverified = (what, err) => ({
+    status: "unverified",
+    reason: sanitizeTerminal(`${what}: ${err instanceof Error ? describeCallFailure(err) : String(err)}`)
+  });
+  let signer;
+  try {
+    signer = await signerFor(config.configPath);
+  } catch (err) {
+    return unverified("this host's key could not be read, so whether the runner key can claim work was not checked", err);
+  }
+  try {
+    await getJson(config.url, "/v1/runner/host-key", config.apiKey, config.appId, fetchImpl, signer);
+    return { status: "ok" };
+  } catch (err) {
+    const permission = missingPermissionOf(err);
+    if (permission === void 0) return unverified("the host-key call did not say whether the runner key can claim work", err);
+    return { status: "lacks", problem: `the runner key lacks ${permission}, which a runner needs to claim work: ${missingPermissionFix(permission)}` };
+  }
+}
+
+export { claimPermissionProblem, claudeCredentialCheck, missingPermissionFix, missingPermissionOf, needsClaudeCredential, placeholderProblem, placeholderQueues };

package/dist/chunk-ABIWDUMS.js

@@ -0,0 +1,104 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { spawn } from 'child_process';
+import { existsSync } from 'fs';
+import { join, dirname } from 'path';
+import { createHash } from 'crypto';
+
+createRequire(import.meta.url);
+var REGISTRY_URL = "https://registry.npmjs.org";
+var PACKAGE_NAME = "@outerlayer/cli";
+var PACKAGE_PATH = "@outerlayer%2fcli";
+var SLSA_PREDICATE = "https://slsa.dev/provenance/v1";
+var REQUEST_TIMEOUT_MS = 6e4;
+function get(url, fetchImpl) {
+  return fetchImpl(url, { signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS), headers: { accept: "application/json" } });
+}
+async function fetchVersionMeta(version, fetchImpl) {
+  const response = await get(`${REGISTRY_URL}/${PACKAGE_PATH}/${encodeURIComponent(version)}`, fetchImpl);
+  if (response.status === 404) return { kind: "not_published" };
+  if (!response.ok) throw new Error(`the registry answered HTTP ${response.status} for ${PACKAGE_NAME}@${version}`);
+  const body = await response.json();
+  const { integrity, tarball } = body.dist ?? {};
+  if (typeof integrity !== "string" || typeof tarball !== "string") {
+    throw new Error(`the registry's metadata for ${PACKAGE_NAME}@${version} has no dist.integrity or dist.tarball`);
+  }
+  const nodeRange = body.engines?.node;
+  return typeof nodeRange === "string" ? { kind: "found", integrity, tarball, nodeRange } : { kind: "found", integrity, tarball };
+}
+async function fetchTarballDigest(url, fetchImpl) {
+  if (!url.startsWith(`${REGISTRY_URL}/`)) throw new Error(`the tarball is not served by ${REGISTRY_URL}: ${url}`);
+  const response = await get(url, fetchImpl);
+  if (!response.ok) throw new Error(`the registry answered HTTP ${response.status} for the tarball`);
+  return createHash("sha512").update(Buffer.from(await response.arrayBuffer())).digest("base64");
+}
+async function fetchProvenance(version, fetchImpl) {
+  const response = await get(`${REGISTRY_URL}/-/npm/v1/attestations/${PACKAGE_PATH}@${encodeURIComponent(version)}`, fetchImpl);
+  if (response.status === 404) return void 0;
+  if (!response.ok) throw new Error(`the registry answered HTTP ${response.status} for the attestations of ${PACKAGE_NAME}@${version}`);
+  const body = await response.json();
+  const slsa = (body.attestations ?? []).find((a) => a.predicateType === SLSA_PREDICATE);
+  const payload = slsa?.bundle?.dsseEnvelope?.payload;
+  if (typeof payload !== "string") return void 0;
+  const statement = JSON.parse(Buffer.from(payload, "base64").toString("utf8"));
+  const workflow = statement.predicate?.buildDefinition?.externalParameters?.workflow;
+  const subjectSha512 = statement.subject?.[0]?.digest?.sha512;
+  if (typeof workflow?.repository !== "string" || typeof workflow.path !== "string" || typeof subjectSha512 !== "string") return void 0;
+  return { repository: workflow.repository, workflowPath: workflow.path, subjectSha512 };
+}
+
+// src/runner/update/npm.ts
+function run(file, args, cwd) {
+  const COMMAND_TIMEOUT_MS = 10 * 6e4;
+  return new Promise((resolve) => {
+    const child = spawn(file, args, { cwd, stdio: ["ignore", "pipe", "pipe"], timeout: COMMAND_TIMEOUT_MS });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (chunk) => stdout += chunk.toString());
+    child.stderr.on("data", (chunk) => stderr += chunk.toString());
+    child.on("error", (err) => resolve({ status: 127, stdout, stderr: `${stderr}${err.message}` }));
+    child.on("close", (code) => resolve({ status: code ?? 1, stdout, stderr }));
+  });
+}
+function npmExecutable(nodePath) {
+  const beside = join(dirname(nodePath), "npm");
+  return existsSync(beside) ? beside : "npm";
+}
+function realRunNpm(nodePath) {
+  const npm = npmExecutable(nodePath);
+  return (args, cwd) => run(npm, args, cwd);
+}
+function realRunNode(nodePath) {
+  return (args, cwd) => run(nodePath, args, cwd);
+}
+function npmSupportsProvenance(version) {
+  const match = /^(\d+)\.(\d+)/.exec(version.trim());
+  if (match === null) return false;
+  const major = Number(match[1]);
+  return major > 9 || major === 9 && Number(match[2]) >= 5;
+}
+async function npmVersion(runNpm, cwd) {
+  const result = await runNpm(["--version"], cwd);
+  return result.status === 0 ? result.stdout.trim() : void 0;
+}
+async function installVersion(runNpm, stagingDir, version) {
+  return runNpm(
+    ["install", "--prefix", stagingDir, "--registry", REGISTRY_URL, "--ignore-scripts", "--no-audit", "--no-fund", `@outerlayer/cli@${version}`],
+    stagingDir
+  );
+}
+async function auditSignatures(runNpm, dir) {
+  const result = await runNpm(["audit", "signatures", "--json", "--registry", REGISTRY_URL], dir);
+  try {
+    const report = JSON.parse(result.stdout);
+    if ((report.invalid ?? []).length > 0) return { ok: false, verdict: true, reason: "npm audit signatures reported an invalid signature" };
+    if ((report.missing ?? []).some((entry) => entry.name === "@outerlayer/cli")) {
+      return { ok: false, verdict: true, reason: "npm audit signatures found no signature for @outerlayer/cli" };
+    }
+  } catch {
+  }
+  if (result.status !== 0) return { ok: false, verdict: false, reason: "npm audit signatures failed" };
+  return { ok: true };
+}
+
+export { auditSignatures, fetchProvenance, fetchTarballDigest, fetchVersionMeta, installVersion, npmSupportsProvenance, npmVersion, realRunNode, realRunNpm };