@outerlayer/cli 0.16.1 → 0.17.0

package/dist/{chunk-JJEGKEFV.js → chunk-YU3VKZ5F.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { autoConnect } from './chunk-NPQWKGUA.js';
+import { autoConnect } from './chunk-6Y5RUTHO.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
 import { resolveRepoIdentity } from './chunk-JXYVA45C.js';
 import { C } from './chunk-YRYMNBGQ.js';

package/dist/{chunk-JEHRUE3F.js → chunk-YZ5F4PIS.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { readPin, pinExists, readBuildHold, readContextManifest, manifestFilesPresent, writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, SOURCE_CACHE_TTL_SUCCESS_MS, isLastCheckFresh, readDegraded, touchLastCheck, clearDegraded, writeContextManifest, writePinIfChanged, readSourceCache, isSourceCacheFresh } from './chunk-WTE3MQML.js';
+import { readPin, pinExists, readBuildHold, readContextManifest, manifestFilesPresent, writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, SOURCE_CACHE_TTL_SUCCESS_MS, touchLastCheck, isLastCheckFresh, readDegraded, clearDegraded, writeContextManifest, writePinIfChanged, readSourceCache, isSourceCacheFresh } from './chunk-WTE3MQML.js';
 import { removeRetiredSkills } from './chunk-C5Y5ZJJZ.js';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
 import { defaultFetch } from './chunk-YO4PSLVB.js';
@@ -209,6 +209,7 @@ async function materializeContext(deps) {
   let repository;
   let ref;
   let unverifiedIdentity;
+  let storedSha;
   let preFetched;
   let unreadableCandidates = [];
   if (designation.status === "candidates") {
@@ -273,9 +274,10 @@ async function materializeContext(deps) {
     repository = designation.repository;
     ref = designation.ref;
     unverifiedIdentity = designation.unverifiedIdentity;
+    storedSha = designation.sha;
   }
   const manifest = readContextManifest(gitCommonDir);
-  const evidenced = hasGovernedEvidence(hasPin, manifest);
+  const evidenced = hasGovernedEvidence(hasPin, manifest) || storedSha !== void 0 && !unverifiedIdentity;
   const clearOrFlagIdentity = () => {
     if (unverifiedIdentity) {
       writeDegraded(gitCommonDir, {
@@ -295,7 +297,30 @@ async function materializeContext(deps) {
     sha = preFetched.sha;
     cacheRepoDir = preFetched.cacheRepoDir;
   } else {
-    if (isLastCheckFresh(gitCommonDir, now()) && manifest !== void 0 && pin?.sha === manifest.sha && manifestFilesPresent(repoRoot, manifest)) {
+    if (storedSha !== void 0 && manifest !== void 0 && manifest.sha === storedSha && pin?.sha === storedSha && manifestFilesPresent(repoRoot, manifest)) {
+      touchLastCheck(gitCommonDir, now());
+      clearOrFlagIdentity();
+      ensureContextExcludes(gitCommonDir);
+      recordMaintainedOverlay(repoRoot, gitCommonDir, manifest);
+      const guardMessage2 = guardNotInstalledMessage(ensurePreCommitGuardHook(repoRoot, gitCommonDir));
+      writeSourceCache(gitCommonDir, {
+        checkedAt: new Date(now()).toISOString(),
+        status: "governed",
+        repository,
+        ref,
+        sha: storedSha,
+        ttlMs: SOURCE_CACHE_TTL_SUCCESS_MS
+      });
+      const verification = unverifiedIdentity ? "unverified" : "verified";
+      record(storedSha, verification, repository, ref);
+      return {
+        status: "debounced",
+        sha: storedSha,
+        verification,
+        ...guardMessage2 ? { message: guardMessage2 } : {}
+      };
+    }
+    if (storedSha === void 0 && isLastCheckFresh(gitCommonDir, now()) && manifest !== void 0 && pin?.sha === manifest.sha && manifestFilesPresent(repoRoot, manifest)) {
       const degraded = readDegraded(gitCommonDir);
       const verification = degraded ? "unverified" : "verified";
       ensureContextExcludes(gitCommonDir);
@@ -321,8 +346,8 @@ async function materializeContext(deps) {
     }
     const remoteUrl = deps.resolveControlPlaneUrl ? deps.resolveControlPlaneUrl(repository, ref, repoRoot) : buildControlPlaneUrl(git, repoRoot, repository);
     const cacheHost = parseRemoteHost(remoteUrl).host || "unknown-host";
-    const lsRemote = git(["ls-remote", remoteUrl, ref], { cwd: repoRoot, timeoutMs: 2e3 });
-    if (lsRemote.ok) {
+    const lsRemote = storedSha === void 0 ? git(["ls-remote", remoteUrl, ref], { cwd: repoRoot, timeoutMs: 2e3 }) : void 0;
+    if (lsRemote?.ok) {
       const remoteSha = parseLsRemoteSha(lsRemote.stdout.toString("utf8"));
       if (remoteSha && manifest !== void 0 && manifest.sha === remoteSha && pin?.sha === remoteSha && manifestFilesPresent(repoRoot, manifest)) {
         touchLastCheck(gitCommonDir, now());
@@ -341,13 +366,21 @@ async function materializeContext(deps) {
       }
     }
     cacheRepoDir = ensureBareCache(git, home, repository, cacheHost);
-    const localRef = `refs/outerlayer/${sanitizeRefName(ref)}`;
-    const fetchResult = git(["fetch", "--depth", "1", remoteUrl, `+${ref}:${localRef}`], { cwd: cacheRepoDir, timeoutMs: 1e4 });
+    const localRef = storedSha === void 0 ? `refs/outerlayer/${sanitizeRefName(ref)}` : `refs/outerlayer/sha-${sanitizeRefName(storedSha)}`;
+    const wanted = storedSha === void 0 ? `+${ref}:${localRef}` : `+${storedSha}:${localRef}`;
+    const access = storedSha === void 0 ? void 0 : await deps.controlPlaneAccess?.([{ repository, ref }]);
+    const token = access !== void 0 && normalizeRepoName(access.repository) === normalizeRepoName(repository) ? access.token : void 0;
+    const fetchResult = git(["fetch", "--depth", "1", remoteUrl, wanted], {
+      cwd: cacheRepoDir,
+      timeoutMs: 1e4,
+      ...token === void 0 ? {} : { env: (base) => withTokenHeader(base, remoteUrl, token) }
+    });
+    const commitNote = (message) => storedSha === void 0 ? message : `could not fetch commit \`${storedSha.slice(0, 7)}\` of ${repository}; ${message}`;
     if (!fetchResult.ok) {
       const kind = classifyGitFailure(fetchResult.stderr);
       const lastGood = manifest?.sha ?? null;
       const verification = lastGood ? "unverified" : "none";
-      const doctorMessage = kind === "no-access" ? noAccessMessage(lastGood) : unreachableMessage(lastGood);
+      const doctorMessage = commitNote(kind === "no-access" ? noAccessMessage(lastGood) : unreachableMessage(lastGood));
       writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind, message: doctorMessage, repository, ref, lastGoodSha: lastGood ?? void 0 });
       if (evidenced) {
         record(lastGood, verification, repository, ref);
@@ -356,10 +389,10 @@ async function materializeContext(deps) {
       return { status: kind, sha: null, verification: "none" };
     }
     const fetchedSha = gitText(git, cacheRepoDir, ["rev-parse", localRef], 2e3);
-    if (fetchedSha === void 0) {
+    if (fetchedSha === void 0 || storedSha !== void 0 && fetchedSha !== storedSha) {
       const lastGood = manifest?.sha ?? null;
       const verification = lastGood ? "unverified" : "none";
-      const doctorMessage = unreachableMessage(lastGood);
+      const doctorMessage = commitNote(unreachableMessage(lastGood));
       writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind: "unreachable", message: doctorMessage, repository, ref, lastGoodSha: lastGood ?? void 0 });
       if (evidenced) {
         record(lastGood, verification, repository, ref);
@@ -368,10 +401,12 @@ async function materializeContext(deps) {
       return { status: "unreachable", sha: null, verification: "none" };
     }
     sha = fetchedSha;
-    const configContent = readBlobAtPath(git, cacheRepoDir, sha, CONTEXT_SOURCE_CONFIG_PATH);
-    const parsedGoverns = configContent === void 0 ? { governs: [] } : parseGoverns(configContent);
-    const governsList = "error" in parsedGoverns ? [] : parsedGoverns.governs;
-    const governed = governsList.some((r) => normalizeRepoName(r) === normalizeRepoName(ownRepoName));
+    const governed = storedSha !== void 0 || (() => {
+      const configContent = readBlobAtPath(git, cacheRepoDir, sha, CONTEXT_SOURCE_CONFIG_PATH);
+      const parsedGoverns = configContent === void 0 ? { governs: [] } : parseGoverns(configContent);
+      const governsList = "error" in parsedGoverns ? [] : parsedGoverns.governs;
+      return governsList.some((r) => normalizeRepoName(r) === normalizeRepoName(ownRepoName));
+    })();
     if (!governed) {
       writeSourceCache(gitCommonDir, { checkedAt: new Date(now()).toISOString(), status: "self", ttlMs: SOURCE_CACHE_TTL_SUCCESS_MS });
       if (hasPin) {
@@ -449,7 +484,14 @@ async function materializeContext(deps) {
   writePinIfChanged(repoRoot, sha);
   touchLastCheck(gitCommonDir, now());
   clearOrFlagIdentity();
-  writeSourceCache(gitCommonDir, { checkedAt: new Date(now()).toISOString(), status: "governed", repository, ref, ttlMs: SOURCE_CACHE_TTL_SUCCESS_MS });
+  writeSourceCache(gitCommonDir, {
+    checkedAt: new Date(now()).toISOString(),
+    status: "governed",
+    repository,
+    ref,
+    ...storedSha === void 0 ? {} : { sha: storedSha },
+    ttlMs: SOURCE_CACHE_TTL_SUCCESS_MS
+  });
   record(sha, "verified", repository, ref);
   return {
     status: "materialized",
@@ -476,7 +518,7 @@ function recordMaintainedOverlay(repoRoot, gitCommonDir, manifest) {
 }
 async function resolveDesignation(ctx) {
   const cache = readSourceCache(ctx.gitCommonDir);
-  if (cache && isSourceCacheFresh(cache, ctx.now())) {
+  if (cache && isSourceCacheFresh(cache, ctx.now()) && !(cache.status === "governed" && cache.sha !== void 0)) {
     return cache.status === "governed" && cache.repository && cache.ref ? { status: "governed", repository: cache.repository, ref: cache.ref } : { status: "self" };
   }
   let authRejected;
@@ -497,7 +539,18 @@ async function resolveDesignation(ctx) {
     if (lookup.kind === "rejected") authRejected = designationAuthRejectedMessage(destination.credential);
     if (lookup.kind === "failed") lookupFailure = lookup.failure;
     if (lookup.kind === "answered") {
-      const sources = lookup.sources;
+      if (lookup.source !== void 0) {
+        if (lookup.source === null) {
+          writeSourceCache(ctx.gitCommonDir, {
+            checkedAt: new Date(ctx.now()).toISOString(),
+            status: "self",
+            ttlMs: SOURCE_CACHE_TTL_SUCCESS_MS
+          });
+          return { status: "self" };
+        }
+        return { status: "governed", repository: lookup.source.repository, ref: lookup.source.ref, sha: lookup.source.sha };
+      }
+      const sources = lookup.sources ?? [];
       if (sources.length === 0) {
         writeSourceCache(ctx.gitCommonDir, {
           checkedAt: new Date(ctx.now()).toISOString(),
@@ -510,7 +563,13 @@ async function resolveDesignation(ctx) {
     }
   }
   if (cache) {
-    return cache.status === "governed" && cache.repository && cache.ref ? { status: "governed", repository: cache.repository, ref: cache.ref, unverifiedIdentity: true } : { status: "self" };
+    return cache.status === "governed" && cache.repository && cache.ref ? {
+      status: "governed",
+      repository: cache.repository,
+      ref: cache.ref,
+      unverifiedIdentity: true,
+      ...cache.sha === void 0 ? {} : { sha: cache.sha }
+    } : { status: "self" };
   }
   return { status: "unknown", authRejected, lookupFailure };
 }
@@ -541,8 +600,12 @@ async function askContextSource(url, config, fetchImpl, timeoutMs) {
     }
     if (!res.ok) return { kind: "failed", failure: { kind: "status", status: res.status } };
     const body = await res.json();
-    if (body.data?.sources === void 0) return { kind: "failed", failure: { kind: "network", message: "the answer named no sources" } };
-    return { kind: "answered", sources: body.data.sources };
+    const data = body.data;
+    const source = validSource(data?.source);
+    if (data === void 0 || data === null || source === void 0 && !Array.isArray(data.sources)) {
+      return { kind: "failed", failure: { kind: "network", message: "the answer named no sources" } };
+    }
+    return { kind: "answered", source, sources: data.sources };
   } catch (err) {
     return {
       kind: "failed",
@@ -552,6 +615,14 @@ async function askContextSource(url, config, fetchImpl, timeoutMs) {
     clearTimeout(timer);
   }
 }
+function validSource(source) {
+  if (source === null) return null;
+  const candidate = source;
+  if (typeof candidate?.repository === "string" && typeof candidate.ref === "string" && typeof candidate.sha === "string") {
+    return { repository: candidate.repository, ref: candidate.ref, sha: candidate.sha };
+  }
+  return void 0;
+}
 function resolveGitCommonDir(git, repoRoot) {
   const abs = gitText(git, repoRoot, ["rev-parse", "--path-format=absolute", "--git-common-dir"], 2e3);
   if (abs !== void 0) return abs;