@outerlayer/cli 0.17.0 → 0.18.0

package/dist/{chunk-OHVJA253.js → chunk-X5N6KC6V.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RESERVED_EMIT_NAMES, ARTIFACT_KINDS, ArtifactCriterionIdSchema } from './chunk-J5M7BSJQ.js';
+import { RESERVED_EMIT_NAMES, ARTIFACT_KINDS, ArtifactCriterionIdSchema } from './chunk-N3CUDFCW.js';
 import { __commonJS, __require, __toESM } from './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);
@@ -7950,31 +7950,12 @@ function mergeCopies(perTarget) {
   const copies = [...byPath.entries()].filter(([path]) => !conflicted.has(path)).map(([toPath, fromSourcePath]) => ({ toPath, fromSourcePath })).sort((a, b) => a.toPath.localeCompare(b.toPath));
   return { copies, errors };
 }
-var CONTEXT_SOURCE_CONFIG_PATH = ".outerlayer/config.json";
-function parseGoverns(content) {
-  let parsed;
-  try {
-    parsed = JSON.parse(content);
-  } catch {
-    return { error: `${CONTEXT_SOURCE_CONFIG_PATH} is not valid JSON` };
-  }
-  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-    return { error: `${CONTEXT_SOURCE_CONFIG_PATH} must be a JSON object` };
-  }
-  const governs = parsed["governs"];
-  if (governs === void 0) {
-    return { governs: [] };
-  }
-  if (!Array.isArray(governs) || governs.some((entry) => typeof entry !== "string")) {
-    return { error: `"governs" must be an array of "owner/repo" strings` };
-  }
-  return { governs };
-}
 function normalizeRepoName(repo) {
   return repo.trim().toLowerCase();
 }
 var CONTEXT_PIN_FILENAME = ".outerlayer-pin.json";
 var CONTEXT_PIN_SCHEMA_VERSION = 1;
+var MAX_BRIEF_LENGTH = 300;
 var MAX_COMMAND_LENGTH = 2e3;
 var EXTENDS_PROBLEM = '"extends" is not a policy key \u2014 every check is a file in .outerlayer/validators/. Run outerlayer init --template default to write .outerlayer/validators/code-review.yaml, then delete the extends line';
 var FREED_BUILTINS = /* @__PURE__ */ new Set(["ci-passed", "acceptance-criteria", "code-review-ran"]);
@@ -7994,6 +7975,8 @@ var MAX_ROW_LENGTH = 200;
 var MAX_NAME_LENGTH = 40;
 var MAX_GLOB_LENGTH = 200;
 var MAX_WHEN_PATHS = 20;
+var MAX_WHEN_REPOSITORIES = 20;
+var REPOSITORY_NAME = /^[\w.-]+\/[\w.-]+$/;
 var NEEDS_ALIASES = {
   "tool-calls.commands": "commands",
   "tool-calls.edits": "edits",
@@ -8276,13 +8259,14 @@ function parseCustomFile(file, problems) {
   let whenPaths = null;
   let whenIssueType = null;
   let whenIssueLabels = null;
+  let whenRepositories;
   if (root["when"] !== void 0) {
     const when = root["when"];
     if (!isRecord(when) || Object.keys(when).some(
-      (key) => key !== "paths" && key !== "issue.type" && key !== "issue.labels"
+      (key) => key !== "paths" && key !== "repositories" && key !== "issue.type" && key !== "issue.labels"
     ) || Object.keys(when).length === 0) {
       return fail(
-        `"${id}" when: only "paths", "issue.type", and "issue.labels" scoping is supported`
+        `"${id}" when: only "paths", "repositories", "issue.type", and "issue.labels" scoping is supported`
       );
     }
     const paths = when["paths"];
@@ -8301,6 +8285,18 @@ function parseCustomFile(file, problems) {
       }
       whenPaths = paths.map((p) => p.trim());
     }
+    const repositories = when["repositories"];
+    if (repositories !== void 0) {
+      if (!Array.isArray(repositories) || repositories.length === 0 || repositories.some((name2) => typeof name2 !== "string" || !REPOSITORY_NAME.test(name2.trim()))) {
+        return fail(`"${id}" when.repositories must be a non-empty list of owner/repo names`);
+      }
+      if (repositories.length > MAX_WHEN_REPOSITORIES) {
+        return fail(
+          `"${id}" when.repositories lists ${repositories.length} names \u2014 the cap is ${MAX_WHEN_REPOSITORIES}`
+        );
+      }
+      whenRepositories = repositories.map((name2) => name2.trim());
+    }
     const issueType = when["issue.type"];
     if (issueType !== void 0) {
       if (typeof issueType !== "string" || issueType.trim() === "") {
@@ -8325,10 +8321,11 @@ function parseCustomFile(file, problems) {
   let declaresEmit = null;
   let runWhere;
   let command;
+  let judge;
   if (hasRun) {
     const run = root["run"];
-    if (!isRecord(run) || Object.keys(run).some((key) => key !== "where" && key !== "emit" && key !== "command")) {
-      return fail(`"${id}" run: must be a mapping of "where", "emit" and, for where: host, "command"`);
+    if (!isRecord(run) || Object.keys(run).some((key) => key !== "where" && key !== "emit" && key !== "command" && key !== "judge")) {
+      return fail(`"${id}" run: must be a mapping of "where", "emit" and, for where: host, "command" or "judge"`);
     }
     const where = run["where"];
     if (where !== "ci" && where !== "host") {
@@ -8346,10 +8343,29 @@ function parseCustomFile(file, problems) {
     if (where === "ci" && run["command"] !== void 0) {
       return fail(`"${id}" run.command is only for run.where: host \u2014 a where: ci check runs in your own CI`);
     }
-    if (where === "host") {
+    if (where === "ci" && run["judge"] !== void 0) {
+      return fail(`"${id}" run.judge is only for run.where: host \u2014 a where: ci check runs in your own CI`);
+    }
+    if (where === "host" && run["judge"] !== void 0) {
+      if (run["command"] !== void 0) {
+        return fail(`"${id}" run declares both "judge" and "command" \u2014 a host check has one or the other`);
+      }
+      const rawJudge = run["judge"];
+      if (!isRecord(rawJudge) || Object.keys(rawJudge).some((key) => key !== "brief")) {
+        return fail(`"${id}" run.judge must be a mapping with a "brief"`);
+      }
+      const brief = rawJudge["brief"];
+      if (typeof brief !== "string" || brief.trim() === "" || brief.length > MAX_BRIEF_LENGTH || brief.startsWith("/") || brief.split("/").includes("..")) {
+        return fail(
+          `"${id}" run.judge.brief must be a relative path inside the repository, of at most ${MAX_BRIEF_LENGTH} characters, with no ".." segment`
+        );
+      }
+      judge = { brief: brief.trim() };
+      runWhere = "host";
+    } else if (where === "host") {
       const rawCommand = run["command"];
       if (rawCommand === void 0) {
-        return fail(`"${id}" run.where: host needs a "command" \u2014 the shell line the host runs`);
+        return fail(`"${id}" run.where: host needs a "command" or a "judge" \u2014 what the host runs`);
       }
       if (typeof rawCommand !== "string" || rawCommand.trim() === "" || rawCommand.length > MAX_COMMAND_LENGTH) {
         return fail(`"${id}" run.command must be a non-empty string of at most ${MAX_COMMAND_LENGTH} characters`);
@@ -8375,6 +8391,7 @@ function parseCustomFile(file, problems) {
       whenPaths,
       whenIssueType,
       whenIssueLabels,
+      ...whenRepositories === void 0 ? {} : { whenRepositories, whenRepositoriesFile: file.path },
       requireAny,
       // Declared needs only — the author's own statement of what the rule
       // reads. A session.ran alternative is guarded per-alternative at
@@ -8384,7 +8401,8 @@ function parseCustomFile(file, problems) {
       needs: [...new Set(declaredNeeds)].sort(),
       declaresEmit,
       ...runWhere === void 0 ? {} : { runWhere },
-      ...command === void 0 ? {} : { command }
+      ...command === void 0 ? {} : { command },
+      ...judge === void 0 ? {} : { judge }
     },
     file: file.path,
     validatorRefs: requireAny.flatMap((alt) => alt.type === "validator" ? [alt.id] : []),
@@ -8685,4 +8703,4 @@ function sessionsToTimeline(sessions) {
   return out;
 }
 
-export { ALL_TARGET_IDS, CONTEXT_PIN_FILENAME, CONTEXT_PIN_SCHEMA_VERSION, CONTEXT_SOURCE_CONFIG_PATH, classifyTree, emitTree, extractFacts, generatedHeaderSource, normalizePath, normalizeRepoName, orderSessions, parseGoverns, parseOuterlayerConfig, parsePolicy, sessionsToTimeline, splitRawFile };
+export { ALL_TARGET_IDS, CONTEXT_PIN_FILENAME, CONTEXT_PIN_SCHEMA_VERSION, classifyTree, emitTree, extractFacts, generatedHeaderSource, normalizePath, normalizeRepoName, orderSessions, parseOuterlayerConfig, parsePolicy, sessionsToTimeline, splitRawFile };

package/dist/{chunk-22RMZBGW.js → chunk-XGP3VYOG.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { MAX_ALLOW_HOSTS, allowHostProblem } from './chunk-UXYLWVTQ.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
-import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-4Q7OMKAT.js';
+import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-BQXFBI7T.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { existsSync, statSync, accessSync, constants, readFileSync } from 'fs';
 import { hostname } from 'os';

package/dist/{chunk-HYZRY4KZ.js → chunk-XNGMQ27R.js}

@@ -1,12 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EXEC_PORT } from './chunk-RSNSZ2LJ.js';
-import { RELAY_PORT } from './chunk-4Q7OMKAT.js';
+import { EXEC_PORT } from './chunk-X5H2WYMB.js';
+import { startTimeOf } from './chunk-JBJTC3UU.js';
+import { RELAY_PORT } from './chunk-BQXFBI7T.js';
 import { spawn, spawnSync } from 'child_process';
 import { writeFileSync, chmodSync, mkdirSync } from 'fs';
 
 createRequire(import.meta.url);
 var HELPER_PATH = "/opt/outerlayer/bin/outerlayer-guest";
+var HELPER_RECORD = "/run/outerlayer-helpers";
 var KERNEL_FLAG = "outerlayer.relay";
 var DOCKER_FLAG = "outerlayer.docker";
 var DOCKERD_CONFIG = "/run/outerlayer-dockerd.json";
@@ -62,9 +64,11 @@ function runGuestInit(host, cmdline) {
   }
   host.writeFile("/proc/sys/kernel/hostname", HOSTNAME);
   host.mount({ source: "tmpfs", target: "/outerlayer/job", type: "tmpfs", options: "mode=0755" });
-  host.spawnDetached([HELPER_PATH, "relay", ...ports.flatMap((port) => ["--forward", String(port)])]);
+  const relay = host.spawnDetached([HELPER_PATH, "relay", ...ports.flatMap((port) => ["--forward", String(port)])]);
   if (dockerRequestedBy(cmdline)) startDocker(host);
-  host.spawnDetached([HELPER_PATH, "exec-agent", "--port", String(EXEC_PORT)]);
+  const agent = host.spawnDetached([HELPER_PATH, "exec-agent", "--port", String(EXEC_PORT)]);
+  host.writeFile(HELPER_RECORD, [relay, agent].map((started) => `${started.pid} ${started.start}
+`).join(""));
 }
 function realGuestHost() {
   return {
@@ -81,9 +85,15 @@ function realGuestHost() {
     chmod: (path, mode) => chmodSync(path, mode),
     writeFile: (path, text) => writeFileSync(path, text),
     spawnDetached(argv) {
-      spawn(argv[0], argv.slice(1), { detached: true, stdio: ["ignore", "inherit", "inherit"] }).unref();
+      const child = spawn(argv[0], argv.slice(1), { detached: true, stdio: ["ignore", "inherit", "inherit"] });
+      child.unref();
+      child.once("error", () => {
+      });
+      const start = child.pid === void 0 ? null : startTimeOf(child.pid);
+      if (child.pid === void 0 || start === null) throw new Error(`${argv[0]} did not start`);
+      return { pid: child.pid, start };
     }
   };
 }
 
-export { DOCKERD_LOG, HELPER_PATH, realGuestHost, relayPortsFrom, runGuestInit };
+export { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD, realGuestHost, relayPortsFrom, runGuestInit };