@outerlayer/cli 0.17.0 → 0.18.0

package/dist/{chunk-2MNPHL23.js → chunk-47TTLEDX.js}

@@ -1,9 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { C } from './chunk-YRYMNBGQ.js';
-import { retiredSkillPaths, removeRetiredSkills } from './chunk-C5Y5ZJJZ.js';
-import { maintainedFilesForExistingSkills, loadMaintainedFiles, writeMaintainedFiles } from './chunk-POJMEEJJ.js';
-import { emitTree, parseOuterlayerConfig, classifyTree, generatedHeaderSource, CONTEXT_PIN_FILENAME, normalizePath } from './chunk-OHVJA253.js';
+import { C } from './chunk-ANPNT6PM.js';
+import { retiredSkillPaths, removeRetiredSkills } from './chunk-T4Y6SCG3.js';
+import { maintainedFilesForExistingSkills, loadMaintainedFiles, writeMaintainedFiles } from './chunk-MNTSH4CL.js';
+import { emitTree, parseOuterlayerConfig, classifyTree, generatedHeaderSource, CONTEXT_PIN_FILENAME, normalizePath } from './chunk-X5N6KC6V.js';
+import { cliInvocation } from './chunk-CRB3POP4.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, copyFileSync, readdirSync } from 'fs';
 import { join, dirname, relative, sep } from 'path';
 
@@ -97,7 +98,7 @@ function renderFailure(errors) {
 }
 function renderCheck(targets, drift) {
   if (drift.length === 0) return `${C.green}\u2713${C.reset} up to date for ${C.dim}${targets.join(", ")}${C.reset}`;
-  const lines = [`${C.red}\u2717${C.reset} drift detected (${drift.length}) \u2014 run \`outerlayer emit\` to update`];
+  const lines = [`${C.red}\u2717${C.reset} drift detected (${drift.length}) \u2014 run \`${cliInvocation()} emit\` to update`];
   for (const d of drift) lines.push(`  ${C.red}\u2717${C.reset} ${d.kind.padEnd(8)} ${d.path}`);
   return lines.join("\n");
 }

package/dist/{chunk-PLMTLGYH.js → chunk-52NC2FIU.js}

@@ -2,17 +2,18 @@
 import { createRequire } from 'node:module';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
+import { cliInvocation } from './chunk-CRB3POP4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 
 createRequire(import.meta.url);
 
 // src/credentials.ts
-var MISSING_HELP = "Run `outerlayer login` to sign in, or set OUTERLAYER_URL / OUTERLAYER_API_KEY / OUTERLAYER_APP_ID. Mint a key in the dashboard: Settings \u2192 API keys.";
-var NO_FACTORY_MESSAGE = "you are logged in, but no factory is chosen for this repository. Run `outerlayer connect` to choose one, or pass --app-id / set OUTERLAYER_APP_ID.";
+var MISSING_HELP = `Run \`${cliInvocation()} login\` to sign in, or set OUTERLAYER_URL / OUTERLAYER_API_KEY / OUTERLAYER_APP_ID. Mint a key in the dashboard: Settings \u2192 API keys.`;
+var NO_FACTORY_MESSAGE = `you are logged in, but no factory is chosen for this repository. Run \`${cliInvocation()} connect\` to choose one, or pass --app-id / set OUTERLAYER_APP_ID.`;
 var NO_FACTORY_OUTSIDE_REPOSITORY_MESSAGE = "you are logged in, but this directory is not in a git repository, so no factory is chosen. Pass --app-id / set OUTERLAYER_APP_ID, or run this from inside a connected repository.";
 var LOGIN_TOKEN_PREFIX = "olu_";
 function unauthorizedMessage(credential) {
-  return credential.startsWith(LOGIN_TOKEN_PREFIX) ? "not authorized \u2014 the login is expired or was revoked. Run `outerlayer login` to sign in again." : "not authorized \u2014 the API key is unknown, expired, or bound to a different factory. Mint a fresh key: dashboard \u2192 Settings \u2192 API keys.";
+  return credential.startsWith(LOGIN_TOKEN_PREFIX) ? `not authorized \u2014 the login is expired or was revoked. Run \`${cliInvocation()} login\` to sign in again.` : "not authorized \u2014 the API key is unknown, expired, or bound to a different factory. Mint a fresh key: dashboard \u2192 Settings \u2192 API keys.";
 }
 function resolveGatewayCredentials(sources = {}) {
   const env = sources.env ?? process.env;

package/dist/chunk-6CHIYEZZ.js

@@ -0,0 +1,564 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { WorkCommandError, postJson } from './chunk-KK4VBOH6.js';
+import { defaultGitRunner, materializeContext, isStagingWriteFault, lookupGoverningSource } from './chunk-W5VPCONO.js';
+import { readDegraded, readContextManifest, readSourceCache } from './chunk-LXAY4A2G.js';
+import { signingFetchFor } from './chunk-ZRL6HKBY.js';
+import { MAINTAINED_SKILLS } from './chunk-MNTSH4CL.js';
+import { signerFor } from './chunk-M2ZWWTWZ.js';
+import { SHIM_DIR, stagedContextDir, contextHomeDir, deliveryDir } from './chunk-N2PXGQRL.js';
+import { SHIM_SCRIPT, rewriteControlPlanePaths, rewriteHookCommand } from './chunk-G2YNJIGF.js';
+import { fstatSync, existsSync, readdirSync, mkdirSync, writeFileSync, chmodSync, rmSync, copyFileSync, lstatSync, readFileSync } from 'fs';
+import { relative, join, dirname } from 'path';
+
+createRequire(import.meta.url);
+function logStamp(at) {
+  return at.toISOString().replace(/\.\d{3}Z$/, "Z");
+}
+function sameDestination(stat = fstatSync) {
+  try {
+    const out = stat(1);
+    const err = stat(2);
+    return out.dev === err.dev && out.ino === err.ino;
+  } catch {
+    return false;
+  }
+}
+function createRunnerLog(now = () => /* @__PURE__ */ new Date(), io = { stdout: process.stdout, stderr: process.stderr, joined: () => sameDestination() }) {
+  const write = (stream, text) => {
+    stream.write(`${logStamp(now())} ${text}
+`);
+  };
+  return {
+    line: (text) => write(io.stdout, text),
+    error: (text) => {
+      write(io.stdout, text);
+      if (!io.joined()) write(io.stderr, text);
+    }
+  };
+}
+function formatDuration(ms) {
+  const total = Math.max(0, Math.round(ms / 1e3));
+  const hours = Math.floor(total / 3600);
+  const minutes = Math.floor(total % 3600 / 60);
+  const seconds = total % 60;
+  if (hours > 0) return `${hours}h ${minutes}m`;
+  if (minutes > 0) return `${minutes}m ${String(seconds).padStart(2, "0")}s`;
+  return `${seconds}s`;
+}
+function formatClock(at, today) {
+  const hhmm = `${String(at.getUTCHours()).padStart(2, "0")}:${String(at.getUTCMinutes()).padStart(2, "0")} UTC`;
+  const sameDay = at.getUTCFullYear() === today.getUTCFullYear() && at.getUTCMonth() === today.getUTCMonth() && at.getUTCDate() === today.getUTCDate();
+  if (sameDay) return hhmm;
+  const month = at.toLocaleString("en-US", { month: "short", timeZone: "UTC" });
+  return `${month} ${at.getUTCDate()} ${hhmm}`;
+}
+function shortClaim(claimId) {
+  return claimId.length <= 8 ? claimId : `${claimId.slice(0, 8)}\u2026`;
+}
+function relativeToRunner(runnerDirPath, path) {
+  const rel = relative(runnerDirPath, path);
+  return rel === "" || rel.startsWith("..") ? path : rel;
+}
+function describeCallFailure(err) {
+  if (err instanceof Error) {
+    const status = err.status;
+    return status === void 0 ? err.message : `${err.message} (${status})`;
+  }
+  return String(err);
+}
+
+// src/runner/retry.ts
+var RETRY_WINDOW_MS = 12e4;
+var FIRST_BACKOFF_MS = 1e3;
+var MAX_BACKOFF_MS = 15e3;
+function isRetryable(err) {
+  if (err instanceof WorkCommandError) return err.retryable;
+  return true;
+}
+async function retrySend(send, deps = {}) {
+  const now = deps.now ?? (() => /* @__PURE__ */ new Date());
+  const sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const windowMs = deps.windowMs ?? RETRY_WINDOW_MS;
+  const startedMs = now().getTime();
+  let attempts = 0;
+  let backoffMs = FIRST_BACKOFF_MS;
+  for (; ; ) {
+    attempts++;
+    try {
+      return { ok: true, value: await send(), attempts };
+    } catch (err) {
+      const reason = describeCallFailure(err);
+      const code = err instanceof WorkCommandError ? err.code : void 0;
+      const status = err instanceof WorkCommandError ? err.status : void 0;
+      const message = err instanceof WorkCommandError ? err.message : void 0;
+      if (!isRetryable(err)) return { ok: false, attempts, reason, retryable: false, code, status, message };
+      const elapsedMs = now().getTime() - startedMs;
+      if (elapsedMs + backoffMs >= windowMs) return { ok: false, attempts, reason, retryable: true, code, status, message };
+      await sleep(backoffMs);
+      backoffMs = Math.min(backoffMs * 2, MAX_BACKOFF_MS);
+    }
+  }
+}
+
+// src/runner/build-tokens.ts
+var ISSUE_RETRY_WINDOW_MS = 3e4;
+var REVOKE_TIMEOUT_MS = 15e3;
+function isDue(expiresAtMs, nowMs) {
+  return nowMs >= expiresAtMs - 10 * 6e4;
+}
+function classifyRefusal(err) {
+  if (!(err instanceof WorkCommandError)) return { kind: "retry" };
+  if (err.status === 401 || err.code === "claim_expired" || err.code === "claim_not_held") return { kind: "lease_lost" };
+  if (err.code === "github_unavailable") return { kind: "retry" };
+  if (err.code === "github_request_failed") return { kind: "failed", reason: refusalCode(err) };
+  if (err.retryable && err.code !== "repository_tokens_unavailable") return { kind: "retry" };
+  return { kind: "failed", reason: refusalCode(err) };
+}
+function refusalCode(err) {
+  if (!(err instanceof WorkCommandError)) return "unavailable";
+  return err.code ?? `http_${err.status ?? "unknown"}`;
+}
+function keyOf(kind, repository) {
+  return repository === void 0 ? kind : `${kind}:${repository}`;
+}
+var BuildTokens = class {
+  constructor(options) {
+    this.options = options;
+    this.held = /* @__PURE__ */ new Map();
+    this.asking = /* @__PURE__ */ new Map();
+    this.issued = [];
+    this.usedKinds = /* @__PURE__ */ new Set();
+    this.revoked = false;
+    this.controlPlaneRetry = false;
+  }
+  now() {
+    return (this.options.now ?? (() => /* @__PURE__ */ new Date()))();
+  }
+  /** `repository` as the holder keys it: `undefined` for the primary, which is the one a request names no repository for. */
+  secondary(repository) {
+    if (repository === void 0) return void 0;
+    const primary = this.options.primary;
+    return primary !== void 0 && primary.toLowerCase() === repository.toLowerCase() ? void 0 : repository;
+  }
+  /**
+   * The token of `kind` for `repository`, or for the primary when none is
+   * named, asking the gateway for a new one when the build holds none or its
+   * token is within ten minutes of expiry.
+   */
+  token(kind, repository) {
+    const other = this.secondary(repository);
+    const key = keyOf(kind, other);
+    const held = this.held.get(key);
+    if (held !== void 0 && !isDue(held.expiresAtMs, this.now().getTime())) return Promise.resolve(held.token);
+    let asking = this.asking.get(key);
+    if (asking === void 0) {
+      asking = this.issueOrKeep(kind, other).finally(() => this.asking.delete(key));
+      this.asking.set(key, asking);
+    }
+    return asking;
+  }
+  /** A due token that has not yet expired is kept when the gateway cannot issue a new one. */
+  async issueOrKeep(kind, repository) {
+    try {
+      return await this.issue(kind, repository);
+    } catch (err) {
+      const held = this.held.get(keyOf(kind, repository));
+      if (held !== void 0 && this.now().getTime() < held.expiresAtMs && classifyRefusal(err).kind === "retry") return held.token;
+      throw err;
+    }
+  }
+  /** Asks the gateway for a token with `body`, retrying a failure about the moment. */
+  ask(body) {
+    const { config, item, fetchImpl } = this.options;
+    return retrySend(
+      async () => {
+        try {
+          return await postJson(
+            config.url,
+            `/v1/work-items/${item}/claim/tokens`,
+            config.apiKey,
+            config.appId,
+            body,
+            fetchImpl,
+            void 0,
+            await signerFor(config.configPath)
+          );
+        } catch (err) {
+          if (err instanceof WorkCommandError && (err.code === "repository_tokens_unavailable" || err.code === "github_request_failed")) {
+            throw new WorkCommandError(err.message, false, err.status, err.code);
+          }
+          throw err;
+        }
+      },
+      { now: this.options.now, sleep: this.options.sleep, windowMs: ISSUE_RETRY_WINDOW_MS }
+    );
+  }
+  /**
+   * A read-only token for the repository that governs the item's, which the
+   * runner uses on the host to fetch its context. It is revoked with the
+   * others when the attempt ends. It is not held or renewed: nothing uses it
+   * after the fetch. A refusal is thrown with the gateway's code. A lost
+   * lease is kept for `refusal()`, and a failure about the moment for
+   * `controlPlaneUnavailable()`, as the read token's are.
+   */
+  async controlPlane() {
+    const asked = await this.ask({ access: "read", target: "control_plane" });
+    if (!asked.ok) {
+      const err = new WorkCommandError(asked.message ?? asked.reason, asked.retryable, asked.status, asked.code);
+      const refusal = classifyRefusal(err);
+      if (refusal.kind === "lease_lost") this.failure = refusal;
+      if (refusal.kind === "retry") this.controlPlaneRetry = true;
+      throw err;
+    }
+    const { token, expiresAt, repository } = asked.value.data;
+    if (typeof token !== "string" || token === "" || typeof expiresAt !== "string" || typeof repository !== "string" || repository === "") {
+      throw new WorkCommandError("the gateway's token answer carried no token, expiry or repository", false, void 0, "malformed_token_response");
+    }
+    if (this.revoked) {
+      await this.revoke([token]);
+      throw new WorkCommandError("the build's tokens were already revoked", false, void 0, "tokens_revoked");
+    }
+    this.issued.push(token);
+    return { token, expiresAt, repository };
+  }
+  async issue(kind, repository) {
+    const asked = await this.ask({ access: kind, ...repository === void 0 ? {} : { repository } });
+    let err;
+    if (!asked.ok) {
+      err = new WorkCommandError(asked.message ?? asked.reason, asked.retryable, asked.status, asked.code);
+    } else {
+      const { token, expiresAt } = asked.value.data;
+      const expiresAtMs = typeof expiresAt === "string" ? Date.parse(expiresAt) : Number.NaN;
+      if (typeof token === "string" && token !== "" && Number.isFinite(expiresAtMs)) {
+        if (this.revoked) {
+          await this.revoke([token]);
+          throw new WorkCommandError("the build's tokens were already revoked", false, void 0, "tokens_revoked");
+        }
+        this.held.set(keyOf(kind, repository), { token, expiresAtMs });
+        this.issued.push(token);
+        if (kind === "read" && repository === void 0) this.readSink?.(token);
+        return token;
+      }
+      err = new WorkCommandError("the gateway's token answer carried no token or no expiry", false, void 0, "malformed_token_response");
+    }
+    const refusal = classifyRefusal(err);
+    if (refusal.kind !== "retry") this.failure = refusal;
+    throw err;
+  }
+  /** Asks for a new read token when the build holds one within ten minutes of expiry. A refusal is kept for `refusal()`, not thrown. */
+  async renewReadIfDue() {
+    const held = this.held.get("read");
+    if (held === void 0 || !isDue(held.expiresAtMs, this.now().getTime())) return;
+    await this.token("read").catch(() => void 0);
+  }
+  /** Calls `sink` with the read token now, and again with each one that replaces it. */
+  onRead(sink) {
+    this.readSink = sink;
+    const held = this.held.get("read");
+    if (held !== void 0) sink(held.token);
+  }
+  markUsed(kind) {
+    if (this.usedKinds.has(kind)) return;
+    this.usedKinds.add(kind);
+    this.options.onUsed?.(this.used());
+  }
+  /** The kinds of token the build has used, read before push. */
+  used() {
+    return ["read", "push"].filter((kind) => this.usedKinds.has(kind));
+  }
+  /** The last refusal that ends the build, if a renewal or a push's token request met one. */
+  refusal() {
+    return this.failure;
+  }
+  /** Whether a control plane token request failed for a reason about the moment, which a later attempt may not meet. */
+  controlPlaneUnavailable() {
+    return this.controlPlaneRetry;
+  }
+  /** Revokes every token this holder was issued, the superseded ones too, at GitHub with the token itself. A failure is not an error: the token lapses within the hour. */
+  async revokeAll() {
+    this.revoked = true;
+    const tokens = this.issued.splice(0);
+    this.held.clear();
+    await this.revoke(tokens);
+  }
+  async revoke(tokens) {
+    const apiUrl = this.options.apiUrl ?? "https://api.github.com";
+    await Promise.allSettled(
+      tokens.map(
+        (token) => this.options.fetchImpl(`${apiUrl}/installation/token`, {
+          method: "DELETE",
+          headers: {
+            authorization: `Bearer ${token}`,
+            accept: "application/vnd.github+json",
+            "x-github-api-version": "2022-11-28",
+            "user-agent": "outerlayer-runner"
+          },
+          signal: AbortSignal.timeout(REVOKE_TIMEOUT_MS)
+        })
+      )
+    );
+  }
+};
+function deliverySection(dir) {
+  return `This repository's control plane is not in the checkout. Its files are in \`${dir}\`. When an instruction or skill names a path under \`.outerlayer/\` or \`.claude/\`, read it under \`${dir}\`.`;
+}
+function isFile(path) {
+  try {
+    return lstatSync(path).isFile();
+  } catch {
+    return false;
+  }
+}
+function filesUnder(dir, base = dir) {
+  if (!existsSync(dir) || !lstatSync(dir).isDirectory()) return [];
+  const out = [];
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const abs = join(dir, entry.name);
+    if (entry.isDirectory()) out.push(...filesUnder(abs, base));
+    else if (entry.isFile()) out.push(abs.slice(base.length + 1));
+  }
+  return out.sort();
+}
+function readText(path) {
+  if (!isFile(path)) return void 0;
+  const content = readFileSync(path);
+  return content.includes(0) ? void 0 : content.toString("utf8");
+}
+function deliveredSettings(raw, dir) {
+  if (raw === void 0) return "{}\n";
+  const rewrite = (value) => {
+    if (typeof value === "string") return rewriteHookCommand(value, dir);
+    if (Array.isArray(value)) return value.map(rewrite);
+    if (typeof value === "object" && value !== null) return Object.fromEntries(Object.entries(value).map(([key, inner]) => [key, rewrite(inner)]));
+    return value;
+  };
+  try {
+    return `${JSON.stringify(rewrite(JSON.parse(raw)), null, 2)}
+`;
+  } catch {
+    return rewriteHookCommand(raw, dir);
+  }
+}
+function composeDelivery(input) {
+  const { tree, dir } = input;
+  const added = [];
+  const put = (rel, content) => {
+    mkdirSync(dirname(join(tree, rel)), { recursive: true });
+    writeFileSync(join(tree, rel), content);
+    added.push(rel);
+  };
+  for (const skill of MAINTAINED_SKILLS) {
+    for (const rel of filesUnder(join(tree, ".outerlayer/skills", skill))) {
+      const target = `.claude/skills/${skill}/${rel}`;
+      if (existsSync(join(tree, target))) continue;
+      mkdirSync(dirname(join(tree, target)), { recursive: true });
+      copyFileSync(join(tree, ".outerlayer/skills", skill, rel), join(tree, target));
+      added.push(target);
+    }
+  }
+  for (const rel of [...filesUnder(join(tree, ".claude/skills"), tree), ...filesUnder(join(tree, ".claude/agents"), tree)]) {
+    const text = readText(join(tree, rel));
+    if (text === void 0) continue;
+    const rewritten = rewriteControlPlanePaths(text, dir);
+    if (rewritten !== text) writeFileSync(join(tree, rel), rewritten);
+  }
+  const agents = readText(join(tree, "AGENTS.md"));
+  put("CLAUDE.md", agents === void 0 ? `${deliverySection(dir)}
+` : `${deliverySection(dir)}
+
+${rewriteControlPlanePaths(agents, dir)}`);
+  put("settings.json", deliveredSettings(readText(join(tree, ".claude/settings.json")), dir));
+  return added;
+}
+function sharedSkillNames(tree) {
+  const dir = join(tree, ".claude/skills");
+  if (!existsSync(dir)) return [];
+  return readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name).sort();
+}
+function shimScript() {
+  return SHIM_SCRIPT;
+}
+function commandWithShim(job, cmdline) {
+  return job.environment?.controlPlane === void 0 ? cmdline : `PATH=${SHIM_DIR}:"$PATH"; export PATH; ${cmdline}`;
+}
+
+// src/runner/container/context.ts
+var TokenRefused = class extends Error {
+  constructor(code, detail) {
+    super(code);
+    this.code = code;
+    this.detail = detail;
+  }
+};
+var NoControlPlane = class extends Error {
+};
+var GatewayConflict = class extends Error {
+};
+var unavailable = (why) => ({ kind: "refused", reason: `context_unavailable: ${why}` });
+var DESIGNATION_LOOKUP = { timeoutMs: 1e4, attempts: 2 };
+function lookupFailureReason(failure, repository) {
+  switch (failure?.kind) {
+    case "timeout":
+      return `the gateway did not answer which repository governs ${repository} within ${failure.timeoutMs / 1e3} seconds, twice`;
+    case "status":
+      return `the gateway answered ${failure.status} when asked which repository governs ${repository}`;
+    case "network":
+      return `the request asking which repository governs ${repository} failed: ${failure.message}`;
+    default:
+      return `the gateway did not say which repository governs ${repository}`;
+  }
+}
+function controlPlaneTokenFailure(err, repository) {
+  const code = refusalCode(err);
+  const detail = err instanceof WorkCommandError && err.code === void 0 && err.status === void 0 ? describeCallFailure(err) : void 0;
+  return detail === void 0 ? `context_unavailable: the gateway refused a token for the control plane named for ${repository} (${code})` : `context_unavailable: the token request for the control plane named for ${repository} failed: ${detail}`;
+}
+function makeReadable(tree, dir, files) {
+  chmodSync(dir, 493);
+  chmodSync(tree, 493);
+  const directories = /* @__PURE__ */ new Set();
+  for (const rel of files) {
+    for (let current = dirname(join(tree, rel)); current !== tree; current = dirname(current)) directories.add(current);
+    chmodSync(join(tree, rel), (lstatSync(join(tree, rel)).mode & 73) !== 0 ? 493 : 420);
+  }
+  for (const directory of directories) chmodSync(directory, 493);
+}
+async function stageGovernedContext(input) {
+  const git = input.git ?? defaultGitRunner;
+  const dir = stagedContextDir(input.buildDir);
+  const tree = join(dir, "tree");
+  const finish = (outcome) => {
+    removeStagedContext(input.buildDir);
+    return outcome;
+  };
+  try {
+    mkdirSync(tree, { recursive: true });
+    for (const args of [
+      ["init", "-q", "--initial-branch=main", tree],
+      ["-C", tree, "remote", "add", "origin", `https://github.com/${input.repository}.git`]
+    ]) {
+      const done = git(args, { cwd: dir, timeoutMs: 1e4 });
+      if (!done.ok) return finish(unavailable(`the staging directory could not be prepared: ${done.stderr.trim().split("\n")[0] ?? ""}`));
+    }
+    const { url, apiKey, appId, configPath } = input.config;
+    let tokenRepository;
+    const result = await materializeContext({
+      cwd: tree,
+      sessionId: `build-${input.buildId}`,
+      home: contextHomeDir(configPath),
+      cloud: { url, apiKey, appId },
+      fetchImpl: signingFetchFor(input.fetchImpl, configPath, apiKey),
+      designationLookup: DESIGNATION_LOOKUP,
+      ...input.source === void 0 ? {} : { pinnedSource: input.source },
+      git,
+      now: input.now,
+      resolveControlPlaneUrl: (repository) => input.controlPlaneUrl(repository),
+      controlPlaneAccess: input.controlPlaneToken === void 0 ? void 0 : async (candidates) => {
+        const access = await controlPlaneAccess(input.controlPlaneToken, candidates, input.repository, input.log, input.tag);
+        tokenRepository = access?.repository;
+        return access;
+      }
+    });
+    switch (result.status) {
+      case "materialized": {
+        const manifest = readContextManifest(join(tree, ".git"));
+        const source = readSourceCache(join(tree, ".git"));
+        if (result.sha === null || manifest === void 0 || source?.status !== "governed" || source.repository === void 0 || source.ref === void 0) {
+          return finish(unavailable(`the context of ${input.repository} was materialized without a record of it`));
+        }
+        const composed = composeDelivery({ tree, dir: deliveryDir(source.repository, result.sha) });
+        writeFileSync(
+          join(dir, "staged.json"),
+          JSON.stringify({ schemaVersion: 1, sha: result.sha, repository: source.repository, ref: source.ref, files: manifest.files }) + "\n"
+        );
+        makeReadable(tree, dir, [.../* @__PURE__ */ new Set([...manifest.files, ...composed])]);
+        chmodSync(join(dir, "staged.json"), 420);
+        return { kind: "staged", dir, sha: result.sha, repository: source.repository, ref: source.ref, files: manifest.files };
+      }
+      case "self":
+        if (result.designation === "answered") return finish({ kind: "none" });
+        if (result.authRejected === true) {
+          return finish(unavailable(`the gateway rejected the runner's API key (401/403) when asked which repository governs ${input.repository}`));
+        }
+        if (result.message !== void 0) return finish(unavailable(result.message));
+        return finish(unavailable(lookupFailureReason(result.lookupFailure, input.repository)));
+      case "unreachable":
+      case "no-access": {
+        const plane = isStagingWriteFault(result.message) ? void 0 : readDegraded(join(tree, ".git"))?.repository;
+        if (plane !== void 0) {
+          const credential = tokenRepository !== void 0 && tokenRepository.toLowerCase() === plane.toLowerCase() ? "the token the gateway issued" : "the host's git login";
+          return finish(unavailable(`${credential} cannot read ${plane}, the control plane named for ${input.repository}`));
+        }
+        return finish(unavailable(result.message ?? `the context of ${input.repository} could not be materialized (${result.status})`));
+      }
+      default:
+        return finish(unavailable(result.message ?? `the context of ${input.repository} could not be materialized (${result.status})`));
+    }
+  } catch (err) {
+    if (err instanceof NoControlPlane) return finish({ kind: "none" });
+    if (err instanceof GatewayConflict) return finish({ kind: "refused", reason: `context_conflict: ${err.message}` });
+    if (err instanceof TokenRefused) {
+      return finish(
+        unavailable(
+          err.detail === void 0 ? `the gateway refused a token for the control plane named for ${input.repository} (${err.code})` : `the token request for the control plane named for ${input.repository} failed: ${err.detail}`
+        )
+      );
+    }
+    return finish(unavailable(`the context of ${input.repository} could not be staged: ${err instanceof Error ? err.message : String(err)}`));
+  }
+}
+async function controlPlaneAccess(ask, candidates, repository, log, tag) {
+  let answer;
+  try {
+    answer = await ask();
+  } catch (err) {
+    const code = refusalCode(err);
+    if (code === "repository_tokens_unavailable") return void 0;
+    if (code === "no_control_plane") throw new NoControlPlane(code);
+    if (code === "context_conflict") throw new GatewayConflict(err instanceof Error ? err.message : code);
+    throw new TokenRefused(code, err instanceof WorkCommandError && err.code === void 0 && err.status === void 0 ? describeCallFailure(err) : void 0);
+  }
+  const named = candidates.some((candidate) => candidate.repository.toLowerCase() === answer.repository.toLowerCase());
+  if (!named) {
+    log?.line(
+      `${tag === void 0 ? "" : `${tag} `}the gateway issued a control plane token for ${answer.repository}, which is none of the repositories named for ${repository} (${candidates.map((candidate) => candidate.repository).join(", ")}) \xB7 fetching with the host's git login`
+    );
+    return void 0;
+  }
+  return answer;
+}
+function removeStagedContext(buildDir) {
+  rmSync(stagedContextDir(buildDir), { recursive: true, force: true });
+}
+
+// src/runner/governing-source.ts
+var unavailable2 = (why) => ({ ok: false, reason: `context_unavailable: ${why}` });
+function pinnedSourceOf(source) {
+  return source.kind === "self" ? null : { repository: source.repository, ref: source.ref, sha: source.sha };
+}
+async function resolveGoverningSource(input) {
+  const { url, apiKey, appId, configPath } = input.config;
+  const lookup = await lookupGoverningSource({ url, apiKey, appId }, input.repository, signingFetchFor(input.fetchImpl, configPath, apiKey), DESIGNATION_LOOKUP);
+  switch (lookup.kind) {
+    case "rejected":
+      return unavailable2(`the gateway rejected the runner's API key (401/403) when asked which repository governs ${input.repository}`);
+    case "failed":
+      return unavailable2(lookupFailureReason(lookup.failure, input.repository));
+    case "answered":
+      if (lookup.source === null) return { ok: true, source: { kind: "self" } };
+      if (lookup.source === void 0) {
+        return unavailable2("the OuterLayer this machine talks to is too old to name the control plane \u2014 ask whoever runs it to upgrade");
+      }
+      return { ok: true, source: { kind: "governed", ...lookup.source } };
+  }
+}
+async function imageTargetFor(input) {
+  if (input.config === void 0) return { ok: true, repository: input.repository };
+  const resolved = await resolveGoverningSource({ config: input.config, repository: input.repository, fetchImpl: input.fetchImpl });
+  if (!resolved.ok) return resolved;
+  if (resolved.source.kind === "self") return { ok: true, repository: input.repository };
+  return { ok: true, repository: resolved.source.repository, pinned: { commit: resolved.source.sha, ref: resolved.source.ref } };
+}
+
+export { BuildTokens, classifyRefusal, commandWithShim, controlPlaneTokenFailure, createRunnerLog, describeCallFailure, formatClock, formatDuration, imageTargetFor, pinnedSourceOf, refusalCode, relativeToRunner, removeStagedContext, resolveGoverningSource, retrySend, sharedSkillNames, shimScript, shortClaim, stageGovernedContext };

package/dist/{chunk-TI7B7UEO.js → chunk-AMFWYESY.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
+import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-N2PXGQRL.js';
 import { readlinkSync, realpathSync, mkdirSync, unlinkSync, symlinkSync, renameSync, readFileSync, writeFileSync, rmSync, existsSync, readdirSync } from 'fs';
 import { join, basename, sep, resolve } from 'path';
 

package/dist/{chunk-YRYMNBGQ.js → chunk-ANPNT6PM.js}

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
+import { cliInvocation } from './chunk-CRB3POP4.js';
 
 createRequire(import.meta.url);
 
@@ -49,6 +50,6 @@ function warnDeprecated(message) {
   process.stderr.write(`${C.yellow}!${C.reset} ${message}
 `);
 }
-var API_KEY_FLAG_DEPRECATION = "--api-key is deprecated: a key on the command line lands in shell history and process lists. Run `outerlayer login` once, or set OUTERLAYER_API_KEY.";
+var API_KEY_FLAG_DEPRECATION = `--api-key is deprecated: a key on the command line lands in shell history and process lists. Run \`${cliInvocation()} login\` once, or set OUTERLAYER_API_KEY.`;
 
 export { API_KEY_FLAG_DEPRECATION, C, NO_COLOR_FLAG, stripNoColor, warnDeprecated };

package/dist/{chunk-YU3VKZ5F.js → chunk-B3UKB46N.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { autoConnect } from './chunk-6Y5RUTHO.js';
+import { autoConnect } from './chunk-WBT5X3NH.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { resolveRepoIdentity } from './chunk-JXYVA45C.js';
-import { C } from './chunk-YRYMNBGQ.js';
-import { parseWorkItemEnv } from './chunk-GQD22KKN.js';
+import { resolveRepoIdentity } from './chunk-BMYGAGBJ.js';
+import { C } from './chunk-ANPNT6PM.js';
+import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
-import { defaultFetch } from './chunk-YO4PSLVB.js';
-import { unauthorizedMessage, resolveGatewayCredentials } from './chunk-PLMTLGYH.js';
+import { defaultFetch } from './chunk-ZRL6HKBY.js';
+import { unauthorizedMessage, resolveGatewayCredentials } from './chunk-52NC2FIU.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 
 createRequire(import.meta.url);