@outerlayer/cli 0.16.1 → 0.18.0

package/dist/{chunk-6QRMLNH3.js → chunk-KK4VBOH6.js}

@@ -1,20 +1,70 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { autoConnect } from './chunk-NPQWKGUA.js';
+import { autoConnect } from './chunk-WBT5X3NH.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { workPageUrl } from './chunk-YDSMROTB.js';
-import { sanitizeTerminal } from './chunk-WUYTWNMA.js';
-import { resolveRepoIdentity } from './chunk-JXYVA45C.js';
-import { C } from './chunk-YRYMNBGQ.js';
+import { workPageUrl } from './chunk-S76AYB4M.js';
+import { sanitizeTerminal } from './chunk-MQJSXHV7.js';
+import { resolveRepoIdentity } from './chunk-BMYGAGBJ.js';
+import { C } from './chunk-ANPNT6PM.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
-import { defaultFetch } from './chunk-YO4PSLVB.js';
-import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-PLMTLGYH.js';
-import { signRunnerRequest } from './chunk-V7NIVOFD.js';
+import { defaultFetch } from './chunk-ZRL6HKBY.js';
+import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-52NC2FIU.js';
+import { signRunnerRequest } from './chunk-M2ZWWTWZ.js';
 import { readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 
 createRequire(import.meta.url);
 
+// ../trackers/src/descriptor.ts
+var TRACKERS = {
+  github: {
+    label: "GitHub",
+    hasStoredConnection: false,
+    verifiedKeys: false,
+    issueRef: "number",
+    scopeNoun: "repository",
+    connect: { kind: "builtin" }
+  },
+  linear: {
+    label: "Linear",
+    hasStoredConnection: true,
+    verifiedKeys: true,
+    issueRef: "key",
+    scopeNoun: "team",
+    connect: {
+      kind: "oauth",
+      summary: "Read the teams you pick in a workspace, and file specs as issues. One authorization; Linear registers its own webhook."
+    }
+  },
+  jira: {
+    label: "Jira",
+    hasStoredConnection: true,
+    verifiedKeys: true,
+    issueRef: "key",
+    scopeNoun: "project",
+    connect: {
+      kind: "form",
+      summary: "Read the projects you pick on a site, with a service account. One webhook is created in Jira by an admin.",
+      intro: "Uses a service account's OAuth client credential. Create one under Atlassian administration, then paste it here. Read scope only.",
+      notice: "After connecting, you get a webhook URL and secret to put on one webhook in Jira. That is the only manual step, and the only time the secret is shown.",
+      fields: [
+        { name: "siteUrl", label: "Site URL", placeholder: "https://your-team.atlassian.net" },
+        { name: "clientId", label: "Client ID" },
+        { name: "clientSecret", label: "Client secret", secret: true },
+        {
+          name: "projectKeys",
+          label: "Projects to read",
+          placeholder: "ENG, OPS",
+          helperText: "Project keys, comma separated. Only issues in these projects are listed."
+        }
+      ]
+    }
+  }
+};
+function verifiedTrackerNames(descriptors) {
+  return Object.keys(descriptors).filter((name) => descriptors[name].verifiedKeys);
+}
+
 // src/runner/signature-refusals.ts
 var MESSAGES = /* @__PURE__ */ new Map([
   [
@@ -101,14 +151,8 @@ function parseRetries(raw) {
   const n = parseTrackerNumber(raw);
   return n === void 0 ? 0 : Math.min(n, WORK_LINK_RETRY_DELAYS_MS.length);
 }
-function resolveSubject(opts) {
-  const issue = parsePositiveInt(opts.issue, "--issue");
-  if (issue === void 0) {
-    throw new WorkCommandError("pass --issue");
-  }
-  return { issue };
-}
-var TRACKER_FLAG_HELP = 'expected "linear" or "jira" \u2014 GitHub issues are named by number, with no --tracker';
+var VERIFIED_TRACKERS = verifiedTrackerNames(TRACKERS);
+var TRACKER_FLAG_HELP = `expected ${VERIFIED_TRACKERS.map((name) => `"${name}"`).join(" or ")} \u2014 GitHub issues are named by number, with no --tracker`;
 function resolveWorkSubject(opts) {
   if (opts.issue === void 0) {
     throw new WorkCommandError("pass --issue");
@@ -120,32 +164,36 @@ function resolveWorkSubject(opts) {
     }
     return { repository: resolveRepository(opts.repo, opts.cwd), issue: asNumber };
   }
-  if (opts.tracker !== void 0 && opts.tracker !== "linear" && opts.tracker !== "jira") {
+  const tracker = opts.tracker === void 0 ? void 0 : VERIFIED_TRACKERS.find((name) => name === opts.tracker);
+  if (opts.tracker !== void 0 && tracker === void 0) {
     throw new WorkCommandError(`invalid --tracker "${opts.tracker}": ${TRACKER_FLAG_HELP}`);
   }
-  return { key: String(opts.issue), tracker: opts.tracker, repository: opts.repo };
+  return { key: String(opts.issue), tracker, repository: opts.repo };
 }
 async function postJson(url, path, apiKey, appId, body, fetchImpl, timeoutMs, signer) {
   const deadline = timeoutMs === void 0 ? void 0 : startDeadline(timeoutMs);
   try {
-    return await postJsonBefore(url, path, apiKey, appId, body, fetchImpl, deadline, signer);
+    return await sendJsonBefore("POST", url, path, apiKey, appId, body, fetchImpl, deadline, signer);
   } finally {
     deadline?.clear();
   }
 }
+function patchJson(url, path, apiKey, appId, body, fetchImpl) {
+  return sendJsonBefore("PATCH", url, path, apiKey, appId, body, fetchImpl, void 0, void 0);
+}
 function startDeadline(ms) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), ms);
   return { signal: controller.signal, ms, clear: () => clearTimeout(timer) };
 }
-async function postJsonBefore(url, path, apiKey, appId, body, fetchImpl, deadline, signer) {
+async function sendJsonBefore(method, url, path, apiKey, appId, body, fetchImpl, deadline, signer) {
   let response;
   const endpoint = new URL(path, url).toString();
   const payload = JSON.stringify(body);
-  const signature = await signatureHeaders("POST", endpoint, payload ?? "", signer);
+  const signature = await signatureHeaders(method, endpoint, payload ?? "", signer);
   try {
     response = await fetchImpl(endpoint, {
-      method: "POST",
+      method,
       headers: {
         "content-type": "application/json",
         authorization: `Bearer ${apiKey}`,
@@ -264,6 +312,22 @@ async function findLiveItem(creds, repository, subject, fetchImpl) {
   const items = page.data ?? [];
   return items[0] ?? null;
 }
+async function findLiveItemForIssue(creds, opts, fetchImpl) {
+  const subject = resolveWorkSubject(opts);
+  if ("issue" in subject) {
+    const item = await findLiveItem(creds, subject.repository, { issue: subject.issue }, fetchImpl);
+    return { item, label: `${subject.repository}#${subject.issue}` };
+  }
+  const query = new URLSearchParams({ key: subject.key });
+  if (subject.tracker !== void 0) query.set("tracker", subject.tracker);
+  const page = await getJson(creds.url, `/v1/work-items?${query.toString()}`, creds.apiKey, creds.appId, fetchImpl);
+  const items = page.data ?? [];
+  if (items.length > 1) {
+    const trackers = items.map((i) => i.tracker ?? "unknown").join(" and ");
+    throw new WorkCommandError(`${subject.key} names an item in ${trackers}. Pass --tracker to say which.`);
+  }
+  return { item: items[0] ?? null, label: subject.key };
+}
 function environmentFacts(opts) {
   const identity = resolveRepoIdentity(opts.cwd);
   const sessionId = opts.sessionIdOverride ?? detectActiveSession({
@@ -336,9 +400,7 @@ async function runWorkBuild(opts) {
     const { data: data2 } = await postJsonWithRetry(url, "/v1/work-items", apiKey, appId, body2, fetchImpl, retries, sleep);
     const label = data2.number != null ? `#${data2.number}` : String(data2.workItemId);
     const launch = data2.number != null ? `OUTERLAYER_WORK=${data2.number} claude` : null;
-    const branch = typeof data2.branch === "string" && data2.branch !== "" ? data2.branch : null;
-    const output2 = opts.json ? JSON.stringify({ ...data2, ...launch !== null ? { launchCommand: launch } : {} }) : `${C.green}\u2713${C.reset} on Work for you to build ${C.dim}\xB7${C.reset} ${label} ${C.dim}\xB7${C.reset} no host will take it` + (branch !== null ? `
-  branch: ${branch}` : "") + (launch !== null ? `
+    const output2 = opts.json ? JSON.stringify({ ...data2, ...launch !== null ? { launchCommand: launch } : {} }) : `${C.green}\u2713${C.reset} on Work for you to build ${C.dim}\xB7${C.reset} ${label} ${C.dim}\xB7${C.reset} no host will take it` + (launch !== null ? `
   start your session with: ${launch}` : "");
     if (!opts.quiet) process.stdout.write(output2 + "\n");
     return { data: data2, output: output2 };
@@ -360,7 +422,7 @@ async function runWorkLinkSession(opts) {
     return await linkSession(opts);
   } catch (err) {
     if (opts.logFailures) {
-      const { logHookError } = await import('./hook-fast-D7HV4IXG.js');
+      const { logHookError } = await import('./hook-fast-W5MKHMJT.js');
       const reason = err instanceof Error ? err.message : String(err);
       logHookError(opts.home ?? homeFromEnv(opts.env ?? process.env), new Error(`work link-session #${opts.number} failed: ${reason}`));
     }
@@ -428,13 +490,10 @@ async function runWorkRemove(opts) {
     if (!opts.quiet) process.stdout.write(output2 + "\n");
     return { data: data2, output: output2 };
   }
-  const subject = resolveSubject(opts);
-  const repository = resolveRepository(opts.repo, cwd);
-  const number = subject.issue;
-  const item = await findLiveItem(creds, repository, subject, fetchImpl);
+  const { item, label } = await findLiveItemForIssue(creds, { ...opts, cwd }, fetchImpl);
   if (!item) {
     const data2 = { workItemId: null, removed: true, itemWithdrawn: false, noLiveAddition: true };
-    const output2 = opts.json ? JSON.stringify(data2) : `${C.green}\u2713${C.reset} nothing to remove ${C.dim}\xB7${C.reset} no live addition on ${repository}#${number}`;
+    const output2 = opts.json ? JSON.stringify(data2) : `${C.green}\u2713${C.reset} nothing to remove ${C.dim}\xB7${C.reset} no live addition on ${label}`;
     if (!opts.quiet) process.stdout.write(output2 + "\n");
     return { data: data2, output: output2 };
   }
@@ -485,13 +544,10 @@ async function runWorkStatus(opts) {
     if (!opts.quiet) process.stdout.write(body + "\n");
     return { data: data2, output: body };
   }
-  const subject = resolveSubject(opts);
-  const repository = resolveRepository(opts.repo, cwd);
   const fetchImpl = opts.fetchImpl ?? defaultFetch;
-  const number = subject.issue;
-  const item = await findLiveItem(creds, repository, subject, fetchImpl);
+  const { item, label } = await findLiveItemForIssue(creds, { ...opts, cwd }, fetchImpl);
   if (!item) {
-    throw new WorkCommandError(`no live item for ${repository}#${number}`);
+    throw new WorkCommandError(`no live item for ${label}`);
   }
   const { data } = await getJson(creds.url, `/v1/work-items/${item.id}`, creds.apiKey, creds.appId, fetchImpl);
   const output = statusOutput(data, opts.json === true);
@@ -536,4 +592,4 @@ async function runWorkList(opts) {
   return { data, output };
 }
 
-export { WorkCommandError, environmentFacts, findLiveItem, getJson, isSignatureRefusal, parsePositiveInt, postJson, resolveCredentials, resolveRepository, runWorkBuild, runWorkLinkSession, runWorkList, runWorkRemove, runWorkStatus, signatureRefusalMessage };
+export { TRACKERS, WorkCommandError, environmentFacts, findLiveItemForIssue, getJson, isSignatureRefusal, parsePositiveInt, patchJson, postJson, resolveCredentials, runWorkBuild, runWorkLinkSession, runWorkList, runWorkRemove, runWorkStatus, signatureRefusalMessage, verifiedTrackerNames };

package/dist/{chunk-KMDLFI4P.js → chunk-L2USZT6T.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
+import { trackImageBuild, isOutOfMemory, ensureBuilder } from './chunk-S26M3YBJ.js';
 import { RecipeError } from './chunk-QOZKPLVJ.js';
-import { trackImageBuild, isOutOfMemory, ensureBuilder } from './chunk-4NPZVMJU.js';
 import { spawn } from 'child_process';
 import { existsSync, mkdirSync, createWriteStream, rmSync, readFileSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-WTE3MQML.js → chunk-LXAY4A2G.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { CONTEXT_PIN_SCHEMA_VERSION, CONTEXT_PIN_FILENAME } from './chunk-OHVJA253.js';
-import { readFileSync, existsSync, writeFileSync, mkdirSync, utimesSync, statSync, unlinkSync } from 'fs';
+import { CONTEXT_PIN_SCHEMA_VERSION, CONTEXT_PIN_FILENAME } from './chunk-X5N6KC6V.js';
+import { readFileSync, existsSync, writeFileSync, mkdirSync, utimesSync, unlinkSync } from 'fs';
 import { join, dirname } from 'path';
 
 createRequire(import.meta.url);
@@ -59,7 +59,6 @@ function writeContextManifest(gitCommonDir, manifest) {
 function manifestFilesPresent(workpieceRoot, manifest) {
   return manifest.files.every((f) => existsSync(join(workpieceRoot, f)));
 }
-var DEBOUNCE_MS = 10 * 60 * 1e3;
 function lastCheckPath(gitCommonDir) {
   return join(stateDir(gitCommonDir), "last-check");
 }
@@ -73,14 +72,6 @@ function touchLastCheck(gitCommonDir, now) {
   } catch {
   }
 }
-function isLastCheckFresh(gitCommonDir, now, debounceMs = DEBOUNCE_MS) {
-  try {
-    const mtimeMs = statSync(lastCheckPath(gitCommonDir)).mtimeMs;
-    return now - mtimeMs < debounceMs;
-  } catch {
-    return false;
-  }
-}
 function degradedPath(gitCommonDir) {
   return join(stateDir(gitCommonDir), "degraded.json");
 }
@@ -130,4 +121,4 @@ function writeBuildHold(gitCommonDir, hold) {
   writeJson(buildHoldPath(gitCommonDir), hold);
 }
 
-export { SOURCE_CACHE_TTL_RETRY_MS, SOURCE_CACHE_TTL_SUCCESS_MS, clearDegraded, isLastCheckFresh, isSourceCacheFresh, manifestFilesPresent, pinExists, readBuildHold, readContextManifest, readDegraded, readPin, readSourceCache, touchLastCheck, writeBuildHold, writeContextManifest, writeDegraded, writePinIfChanged, writeSourceCache };
+export { SOURCE_CACHE_TTL_RETRY_MS, SOURCE_CACHE_TTL_SUCCESS_MS, clearDegraded, isSourceCacheFresh, manifestFilesPresent, pinExists, readBuildHold, readContextManifest, readDegraded, readPin, readSourceCache, touchLastCheck, writeBuildHold, writeContextManifest, writeDegraded, writePinIfChanged, writeSourceCache };

package/dist/{chunk-V7NIVOFD.js → chunk-M2ZWWTWZ.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { hostKeyPath, runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
+import { hostKeyPath, runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-N2PXGQRL.js';
 import { generateKeyPairSync, createPrivateKey, createPublicKey, sign } from 'crypto';
 import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs';
 

package/dist/{chunk-ERI5GBNI.js → chunk-MLAAT4S6.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { compareVersions } from './chunk-I2UOAV7X.js';
-import { launcherPath, writeLauncher, LauncherWriteError, pathNotes } from './chunk-PTW6W5NR.js';
-import { currentVersion, currentLink, isInLayout, packageRootIn, versionDir, switchCurrent, execStartLine } from './chunk-TI7B7UEO.js';
-import { RUNNER_DIR_MODE } from './chunk-ZM2IMMYN.js';
+import { launcherPath, writeLauncher, LauncherWriteError, pathNotes } from './chunk-VYAL7PUE.js';
+import { currentVersion, currentLink, isInLayout, packageRootIn, versionDir, switchCurrent, execStartLine } from './chunk-AMFWYESY.js';
+import { RUNNER_DIR_MODE } from './chunk-N2PXGQRL.js';
 import { realpathSync, readFileSync, mkdirSync, rmSync, cpSync, existsSync } from 'fs';
 import { dirname, sep, join } from 'path';
 

package/dist/{chunk-POJMEEJJ.js → chunk-MNTSH4CL.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { splitRawFile } from './chunk-OHVJA253.js';
+import { splitRawFile } from './chunk-X5N6KC6V.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, readdirSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-WUYTWNMA.js → chunk-MQJSXHV7.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { ArtifactTombstoneRecordSchema, ArtifactSpoolRecordSchema } from './chunk-J5M7BSJQ.js';
+import { ArtifactTombstoneRecordSchema, ArtifactSpoolRecordSchema } from './chunk-N3CUDFCW.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, appendFileSync, writeFileSync, renameSync, unlinkSync, existsSync, readdirSync, readFileSync, statSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-O765JR4W.js → chunk-MTP2QEVO.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-N2PXGQRL.js';
 import { readFileSync, existsSync, rmSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-ZM2IMMYN.js → chunk-N2PXGQRL.js}

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
+import { BUILD_HOME } from './chunk-BQXFBI7T.js';
 import { join, dirname } from 'path';
 
 createRequire(import.meta.url);
@@ -72,5 +73,12 @@ function diskTemplatesDir(runnerDirPath) {
 function vsockPath(buildDirPath) {
   return join(buildDirPath, "v.sock");
 }
+var SHIM_DIR = `${BUILD_HOME}/.outerlayer/bin`;
+function deliveryDir(repository, sha) {
+  if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repository) || repository.split("/").some((part) => part === "." || part === "..") || !/^[0-9a-f]{7,64}$/.test(sha)) {
+    throw new Error(`cannot name a delivery directory for ${repository} at ${sha}`);
+  }
+  return `${BUILD_HOME}/.outerlayer/context/${repository}/${sha}`;
+}
 
-export { RUNNER_DIR_MODE, RUNNER_FILE_MODE, attemptStamp, buildDir, contextHomeDir, diskTemplatesDir, ghConfigDir, hostKeyPath, imagesDir, jobDir, jobsDir, mirrorDir, pidFilePath, repoCacheDir, rootfsDir, rootfsPathFor, runnerDir, runnerDirOfBuild, spoolDir, stagedContextDir, vmAssetsDir, vsockPath };
+export { RUNNER_DIR_MODE, RUNNER_FILE_MODE, SHIM_DIR, attemptStamp, buildDir, contextHomeDir, deliveryDir, diskTemplatesDir, ghConfigDir, hostKeyPath, imagesDir, jobDir, jobsDir, mirrorDir, pidFilePath, repoCacheDir, rootfsDir, rootfsPathFor, runnerDir, runnerDirOfBuild, spoolDir, stagedContextDir, vmAssetsDir, vsockPath };

package/dist/{chunk-J5M7BSJQ.js → chunk-N3CUDFCW.js}

@@ -21728,12 +21728,13 @@ var UsageSchema = external_exports.looseObject({
    * open string: the provider adds tiers over time. Absent means standard. */
   speed: external_exports.string().min(1).max(SPEED_MAX_LENGTH).optional()
 });
-var INPUT_BAND_BOUNDARIES = [128e3, 2e5, 256e3, 272e3, 512e3];
+var INPUT_BAND_BOUNDARIES = [1e5, 128e3, 2e5, 256e3, 272e3, 512e3];
 function inputBandOf(totalInput) {
   let band = 0;
   for (const boundary of INPUT_BAND_BOUNDARIES) if (totalInput >= boundary) band = boundary;
   return band;
 }
+var BAND_BOUNDARIES_MAX = 64;
 var TOKEN_BUCKETS_MAX = 1024;
 var TokenBucketSchema = external_exports.looseObject({
   model: external_exports.string().min(1).max(BUCKET_MODEL_MAX_LENGTH),
@@ -21950,7 +21951,12 @@ var AgentSessionSchema = external_exports.looseObject({
     /** Token counts so far, per model, speed and input band. On a chunk part
      * or a streamed piece these cover the whole session so far, never just
      * the turns that payload carries. Absent from older writers. */
-    buckets: external_exports.array(TokenBucketSchema).max(TOKEN_BUCKETS_MAX).optional()
+    buckets: external_exports.array(TokenBucketSchema).max(TOKEN_BUCKETS_MAX).optional(),
+    /** The input band boundaries `buckets` were grouped by. A price tier whose
+     * threshold falls inside one of these bands cannot be applied from the
+     * buckets alone. Absent from older writers, which used
+     * {@link UNRECORDED_INPUT_BAND_BOUNDARIES}. */
+    bandBoundaries: external_exports.array(count).max(BAND_BOUNDARIES_MAX).optional()
   }),
   /** Filled natively (`pr-link` lines, `git commit` tool results) or by later
    * joins. A session can link MANY pull requests (stacked PRs, long-lived seat
@@ -22525,4 +22531,4 @@ xmlchars/xmlns/1.0/ed3.js:
    *)
 */
 
-export { ARTIFACT_KINDS, ARTIFACT_MAX_CAPTION_LENGTH, ARTIFACT_MAX_FILENAME_LENGTH, ARTIFACT_MAX_REPLACES_TARGETS, ArtifactCriterionIdSchema, ArtifactSpoolRecordSchema, ArtifactTombstoneRecordSchema, BUCKET_MODEL_MAX_LENGTH, CAPTURE_TIERS, CriteriaListSchema, EMITTED_RESULTS, EMITTED_RESULT_MAX_BODY_LENGTH, EMITTED_RESULT_MAX_LINK_LENGTH, EVENT_TYPES, EmittedNameSchema, FindingBatchSchema, FindingsResponseSchema, RESERVED_EMIT_NAMES, SAME_PROBLEM_RULES, SCHEMA_VERSION, SPEED_MAX_LENGTH, bannedPathsForTier, bindTests, downconvertSession, inferArtifactKind, inputBandOf, isHumanUserTurn, mediaTypeForArtifactPath, parseAgentSession, parseJunit, parseTestSelector, turnCountBound };
+export { ARTIFACT_KINDS, ARTIFACT_MAX_CAPTION_LENGTH, ARTIFACT_MAX_FILENAME_LENGTH, ARTIFACT_MAX_REPLACES_TARGETS, ArtifactCriterionIdSchema, ArtifactSpoolRecordSchema, ArtifactTombstoneRecordSchema, BUCKET_MODEL_MAX_LENGTH, CAPTURE_TIERS, CriteriaListSchema, EMITTED_RESULTS, EMITTED_RESULT_MAX_BODY_LENGTH, EMITTED_RESULT_MAX_LINK_LENGTH, EVENT_TYPES, EmittedNameSchema, FindingBatchSchema, FindingsResponseSchema, INPUT_BAND_BOUNDARIES, RESERVED_EMIT_NAMES, SAME_PROBLEM_RULES, SCHEMA_VERSION, SPEED_MAX_LENGTH, bannedPathsForTier, bindTests, downconvertSession, inferArtifactKind, inputBandOf, isHumanUserTurn, mediaTypeForArtifactPath, parseAgentSession, parseJunit, parseTestSelector, turnCountBound };

package/dist/{chunk-4KSQKQXE.js → chunk-NACDBXUG.js}

@@ -1,9 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { revokeTokenOnDashboard } from './chunk-N6LURUEF.js';
-import { C } from './chunk-YRYMNBGQ.js';
+import { revokeTokenOnDashboard } from './chunk-GOSFARMS.js';
+import { C } from './chunk-ANPNT6PM.js';
 import { readCloudConfig, writeCloudConfig, cloudConfigPath } from './chunk-EABW6AJQ.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
+import { cliInvocation } from './chunk-CRB3POP4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { generateKeyPairSync, privateDecrypt, constants, createPrivateKey } from 'crypto';
 import { spawn } from 'child_process';
@@ -18,7 +19,7 @@ var LoginError = class extends Error {
 };
 function runLogin(opts) {
   const apiKey = opts.apiKey.trim();
-  if (apiKey.length === 0) throw new LoginError("no API key given \u2014 pipe it on stdin, or run outerlayer login with no key on stdin to sign in by browser");
+  if (apiKey.length === 0) throw new LoginError(`no API key given \u2014 pipe it on stdin, or run ${cliInvocation()} login with no key on stdin to sign in by browser`);
   if (/\s/.test(apiKey)) throw new LoginError("the API key must be a single token with no spaces or line breaks");
   const url = opts.url?.trim() || void 0;
   const appId = opts.appId?.trim() || void 0;
@@ -229,7 +230,7 @@ function decryptToken(privateKeyPem, encryptedToken) {
       Buffer.from(encryptedToken, "base64")
     ).toString("utf8");
   } catch {
-    throw new LoginError("could not decrypt the token the dashboard sent; run outerlayer login again");
+    throw new LoginError(`could not decrypt the token the dashboard sent; run ${cliInvocation()} login again`);
   }
 }
 function normalizeDashboard(raw) {
@@ -246,7 +247,7 @@ function approveLink(dashboard, code) {
   return `${dashboard}/cli/login?code=${encodeURIComponent(code)}`;
 }
 function waitingDocument(link, code, id) {
-  return JSON.stringify({ status: "waiting", url: link, code, check: `outerlayer login --check ${id}` }) + "\n";
+  return JSON.stringify({ status: "waiting", url: link, code, check: `${cliInvocation()} login --check ${id}` }) + "\n";
 }
 async function finishApproved(flags, deps, home, dashboard, approved, privateKeyPem) {
   const accountToken = decryptToken(privateKeyPem, approved.encryptedToken);
@@ -257,7 +258,7 @@ async function finishApproved(flags, deps, home, dashboard, approved, privateKey
     const revoked = await revokeTokenOnDashboard(deps.fetchImpl, dashboard, accountToken);
     return fail(
       deps,
-      `could not save the login: ${err instanceof Error ? err.message : String(err)}. ` + (revoked === "revoked" ? "The token was revoked; run outerlayer login again." : "The token could not be revoked; revoke it on the CLI logins list at /profile/security.")
+      `could not save the login: ${err instanceof Error ? err.message : String(err)}. ` + (revoked === "revoked" ? `The token was revoked; run ${cliInvocation()} login again.` : "The token could not be revoked; revoke it on the CLI logins list at /profile/security.")
     );
   }
   if (before.accountToken && before.accountToken !== accountToken) {
@@ -279,9 +280,12 @@ async function finishApproved(flags, deps, home, dashboard, approved, privateKey
 }
 function nextAfterLogin(cwd) {
   const dirs = findGitDirs(cwd);
-  if (dirs === void 0) return "Next: in your repository, run `outerlayer init --factory <org>/<factory>`.\n";
-  if (existsSync(join(dirs.repoRoot, ".outerlayer"))) return "Next: run `outerlayer connect` to choose a factory.\n";
-  return "Next: run `outerlayer init --factory <org>/<factory>` to set up this repository.\n";
+  if (dirs === void 0) return `Next: in your repository, run \`${cliInvocation()} init --factory <org>/<factory>\`.
+`;
+  if (existsSync(join(dirs.repoRoot, ".outerlayer"))) return `Next: run \`${cliInvocation()} connect\` to choose a factory.
+`;
+  return `Next: run \`${cliInvocation()} init --factory <org>/<factory>\` to set up this repository.
+`;
 }
 function fail(deps, message) {
   deps.stderr.write(`${C.red}\u2717${C.reset} ${message}
@@ -301,10 +305,10 @@ async function runPastedKey(flags, deps, key, home) {
 }
 async function runCheck(flags, deps, home, id) {
   const pending = readPending(home, id);
-  if (!pending) return fail(deps, `no pending login ${id}; run outerlayer login to start one`);
+  if (!pending) return fail(deps, `no pending login ${id}; run ${cliInvocation()} login to start one`);
   if (Date.parse(pending.expires_at) <= deps.now().getTime()) {
     deletePending(home, id);
-    return fail(deps, "the login link expired; run outerlayer login again");
+    return fail(deps, `the login link expired; run ${cliInvocation()} login again`);
   }
   const result = await pollLogin(deps, pending.dashboard, pending.id);
   switch (result.kind) {
@@ -317,7 +321,7 @@ async function runCheck(flags, deps, home, id) {
       return fail(deps, "the login was denied");
     case "expired":
       deletePending(home, id);
-      return fail(deps, "the login link expired; run outerlayer login again");
+      return fail(deps, `the login link expired; run ${cliInvocation()} login again`);
     case "unavailable":
       deps.stderr.write(`could not check the login yet: ${result.message}
 `);
@@ -376,7 +380,7 @@ Waiting for approval...
       case "denied":
         return fail(deps, "the login was denied");
       case "expired":
-        return fail(deps, "the login link expired; run outerlayer login again");
+        return fail(deps, `the login link expired; run ${cliInvocation()} login again`);
       case "unavailable":
       case "error":
         failures += 1;
@@ -392,7 +396,7 @@ Waiting for approval...
     }
     const untilExpiryMs = Math.max(0, expiresAt - deps.now().getTime());
     await deps.sleep(Math.min(waitS * 1e3, untilExpiryMs));
-    if (deps.now().getTime() >= expiresAt) return fail(deps, "the login link expired; run outerlayer login again");
+    if (deps.now().getTime() >= expiresAt) return fail(deps, `the login link expired; run ${cliInvocation()} login again`);
   }
 }
 async function runLoginCommand(flags, deps) {
@@ -414,7 +418,7 @@ async function runLoginCommand(flags, deps) {
       return EXIT_USAGE;
     }
     if (flags.noInput) {
-      return fail(deps, 'no API key on stdin and --no-input forbids prompting \u2014 pipe the key: echo "$KEY" | outerlayer login');
+      return fail(deps, `no API key on stdin and --no-input forbids prompting \u2014 pipe the key: echo "$KEY" | ${cliInvocation()} login`);
     }
     purgeExpiredPending(home, deps.now());
     return await runBrowserLogin(flags, deps, home);

package/dist/{chunk-RSPXEVDX.js → chunk-NL4XPC7W.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-EWORLJMO.js';
+import { MIN_ENGINE_MAJOR } from './chunk-Y5MXET4M.js';
 import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-CX22S5BA.js';
 import { spawnSync } from 'child_process';
 import { existsSync, accessSync, constants, statSync, readFileSync } from 'fs';

package/dist/{chunk-EHAAPRWY.js → chunk-QQM2UJ6T.js}

@@ -1,30 +1,31 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LEASE_SECONDS, releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, ALREADY_RELEASED } from './chunk-R4ZQQ7U2.js';
-import { writePendingUpdate } from './chunk-O765JR4W.js';
-import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-UGP76IZ5.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
-import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-YETTWTAY.js';
-import { writeJobFile, readJobFile, readJobFileChecked } from './chunk-RMWLBUCJ.js';
 import { compareVersions, satisfiesRange } from './chunk-I2UOAV7X.js';
-import { RUNNER_PROTOCOL } from './chunk-ADJRGVZC.js';
-import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-FWX735W7.js';
+import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-YETTWTAY.js';
+import { LEASE_SECONDS, releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, ALREADY_RELEASED } from './chunk-3OFZM4X6.js';
+import { writeJobFile, readJobFile, readJobFileChecked } from './chunk-SADUQSO4.js';
+import { RUNNER_PROTOCOL } from './chunk-KDVIU23F.js';
+import { writePendingUpdate } from './chunk-MTP2QEVO.js';
+import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-S5PCA3SN.js';
+import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-FUB7LRUE.js';
+import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, cleanVersions, isInLayout, stagingDir } from './chunk-AMFWYESY.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
-import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, cleanVersions, isInLayout, stagingDir } from './chunk-TI7B7UEO.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, BuildTokens, classifyRefusal, refusalCode, measureDisk, createRunnerLog, setUpRunnerCgroup, parseCpuList, ensureTunnel, keepGhConfigCurrent, createContainerRuntime, formatClock } from './chunk-EWORLJMO.js';
-import { spawnRun } from './chunk-KMDLFI4P.js';
-import { checkFit } from './chunk-RLYZLUQ7.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-6QRMLNH3.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-22RMZBGW.js';
-import { startTimeOf, claimPidFile, readPidFile, isSameProcess, releasePidFile } from './chunk-N5FOE5PS.js';
-import { builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, BUILD_LABEL, RUNNER_LABEL } from './chunk-4NPZVMJU.js';
+import { provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, measureDisk, setUpRunnerCgroup, parseCpuList, ensureTunnel, keepGhConfigCurrent, createContainerRuntime } from './chunk-Y5MXET4M.js';
+import { spawnRun } from './chunk-L2USZT6T.js';
+import { builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, BUILD_LABEL, RUNNER_LABEL } from './chunk-S26M3YBJ.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-6CHIYEZZ.js';
+import { checkFit } from './chunk-WGAUY5LE.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-KK4VBOH6.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-XGP3VYOG.js';
 import { exceedsDisk } from './chunk-7RQ73DLO.js';
-import { parseClaimedRepositories, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, claudeCredential } from './chunk-4Q7OMKAT.js';
-import { parseClaimIdentity } from './chunk-BYT5O5RV.js';
+import { claimPidFile, readPidFile, releasePidFile } from './chunk-ECODQ7II.js';
+import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
-import { loadHostKey, ensureHostKey, signerFor } from './chunk-V7NIVOFD.js';
-import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, jobsDir, pidFilePath, spoolDir, RUNNER_FILE_MODE, rootfsDir } from './chunk-ZM2IMMYN.js';
+import { loadHostKey, ensureHostKey, signerFor } from './chunk-M2ZWWTWZ.js';
+import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, jobsDir, pidFilePath, spoolDir, RUNNER_FILE_MODE, rootfsDir } from './chunk-N2PXGQRL.js';
+import { parseClaimIdentity, parseClaimedRepositories, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, claudeCredential } from './chunk-BQXFBI7T.js';
 import { HOOKS_DIR_NAME, writeCommitHooks } from './chunk-XCCLFVXM.js';
 import { randomBytes } from 'crypto';
 import { mkdirSync, existsSync, chmodSync, statSync, readdirSync, readFileSync, rmSync, renameSync, writeFileSync, closeSync, openSync, constants, lstatSync } from 'fs';
@@ -839,8 +840,11 @@ function reportRepeating(state, key, message, level = "error") {
   }
 }
 function deriveRepo(item) {
-  const host = item.tracker === void 0 ? void 0 : TRACKER_REPOSITORY_HOSTS[item.tracker];
-  if (host === void 0) return void 0;
+  if (item.tracker === void 0) return void 0;
+  const host = TRACKER_REPOSITORY_HOSTS[item.tracker];
+  if (host === void 0) {
+    return item.specRepository ? `${TRACKER_REPOSITORY_HOSTS.github}/${item.specRepository}` : void 0;
+  }
   const hash = item.trackerKey.lastIndexOf("#");
   const repoPart = hash === -1 ? item.trackerKey : item.trackerKey.slice(0, hash);
   return repoPart === "" ? void 0 : `${host}/${repoPart}`;
@@ -1315,7 +1319,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-DJQJEZVB.js');
+  const { postJson: postJson2 } = await import('./work-cmd-7S5B2H2P.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -1610,6 +1614,7 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity,
       config: state.config,
       runtime: runtimeOf(state),
       item,
+      repository: primary?.repository,
       itemKey,
       jobDir: dirPath,
       cliVersion,
@@ -1635,10 +1640,10 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity,
     installCommitHooks(active.job, log, tag);
   } else {
     const runtime = runtimeOf(state);
-    const build = await startHostBuild(state, active, item.specRepository ?? void 0);
+    const build = await startHostBuild(state, active, primary?.repository);
     const provisionEnv = provisionEnvironment(jobEnv(state.config, item.number, itemKey, dirPath, process.env, branch, identity?.author), {
       buildDir: build.state.buildDir,
-      repository: item.specRepository,
+      repository: primary?.repository ?? null,
       recipeCommit: build.recipeCommit,
       limits: {
         memory: state.config.build?.memory ?? "8g",
@@ -1978,7 +1983,7 @@ async function renewLeaseIfDue(state, active, nowMs) {
 }
 async function watchTick(state, active, nowMs, logMtimeMs) {
   if (active.ending) {
-    if (active.job.stage === "checks") await renewLeaseIfDue(state, active, nowMs);
+    if (active.job.stage === "checks" || active.job.stage === "judge") await renewLeaseIfDue(state, active, nowMs);
     return;
   }
   const log = logOf(state);
@@ -2074,7 +2079,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     const outcome = await onStartUnderMarker({
       configPath,
       own: ownVersionOf(deps),
-      check: update.check ? () => update.check(configPath) : async () => (await import('./check-CNTMSGOG.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
+      check: update.check ? () => update.check(configPath) : async () => (await import('./check-5C4YDZYV.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
     });