@outerlayer/cli 0.17.0 → 0.19.0

package/dist/{chunk-UGP76IZ5.js → chunk-S5PCA3SN.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-N2PXGQRL.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-RMWLBUCJ.js → chunk-SADUQSO4.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-N2PXGQRL.js';
 import { existsSync, readFileSync, mkdirSync, chmodSync, writeFileSync } from 'fs';
 import { dirname, join } from 'path';
 

package/dist/{chunk-GQD22KKN.js → chunk-T2Q7ISPE.js}

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { parseTrackerNumber } from './chunk-WZBHBH3J.js';
+import { cliInvocation } from './chunk-CRB3POP4.js';
 import { mkdirSync, appendFileSync, readFileSync } from 'fs';
 import { join } from 'path';
 
 createRequire(import.meta.url);
-var HOW_TO_CREATE_AN_ITEM = "outerlayer work build --local";
+var HOW_TO_CREATE_AN_ITEM = `${cliInvocation()} work build --local`;
 function parseWorkItemEnv(raw) {
   if (raw === void 0) return { reason: "OUTERLAYER_WORK is not set" };
   const value = raw.trim();

package/dist/chunk-TUSYOL2O.js

@@ -0,0 +1,113 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { homeFromEnv } from './chunk-VNVZDWO3.js';
+import { execFileSync } from 'child_process';
+import { readdirSync, readFileSync, existsSync, unlinkSync } from 'fs';
+import { join, isAbsolute, resolve } from 'path';
+
+createRequire(import.meta.url);
+var JOURNAL_HOOK_MARKER = "# outerlayer post-rewrite journal";
+var PRE_COMMIT_GUARD_MARKER = "# outerlayer materialized-context commit guard";
+function git(cwd, args) {
+  try {
+    return execFileSync("git", ["-C", cwd, ...args], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 2e3
+    }).trim();
+  } catch {
+    return void 0;
+  }
+}
+function hooksDir(cwd) {
+  const dir = git(cwd, ["rev-parse", "--git-path", "hooks"]);
+  if (dir === void 0) return void 0;
+  return isAbsolute(dir) ? dir : resolve(cwd, dir);
+}
+function commonHooksDir(cwd) {
+  const abs = git(cwd, ["rev-parse", "--path-format=absolute", "--git-common-dir"]);
+  if (abs !== void 0) return join(abs, "hooks");
+  const rel = git(cwd, ["rev-parse", "--git-common-dir"]);
+  if (rel === void 0) return void 0;
+  return join(isAbsolute(rel) ? rel : join(cwd, rel), "hooks");
+}
+function removeOurHookFile(path, marker) {
+  if (!existsSync(path)) return false;
+  let content;
+  try {
+    content = readFileSync(path, "utf8");
+  } catch {
+    return false;
+  }
+  if (!isOwnRecognitionLine(content, marker)) return false;
+  unlinkSync(path);
+  return true;
+}
+function isOwnRecognitionLine(content, marker) {
+  const secondLine = content.split("\n", 2)[1];
+  return secondLine !== void 0 && secondLine.startsWith(marker);
+}
+function removeJournalHooks(cwd) {
+  const dir = hooksDir(cwd);
+  if (dir === void 0) return { removed: false };
+  let removed = false;
+  for (const name of ["post-rewrite", "post-commit", "prepare-commit-msg"]) {
+    if (removeOurHookFile(join(dir, name), JOURNAL_HOOK_MARKER)) removed = true;
+  }
+  return { removed, path: dir };
+}
+function removePreCommitGuardHook(cwd) {
+  const dir = commonHooksDir(cwd);
+  if (dir === void 0) return { removed: false };
+  const path = join(dir, "pre-commit");
+  return { removed: removeOurHookFile(path, PRE_COMMIT_GUARD_MARKER), path };
+}
+function expandHooksPathTilde(hooksPath) {
+  if (hooksPath === "~") return homeFromEnv();
+  if (hooksPath.startsWith("~/")) return join(homeFromEnv(), hooksPath.slice(2));
+  return hooksPath;
+}
+function deadHooksState(cwd) {
+  const inRepo = git(cwd, ["rev-parse", "--is-inside-work-tree"]);
+  if (inRepo !== "true") return { dead: false };
+  const hooksPath = git(cwd, ["config", "core.hooksPath"]) ?? "";
+  if (hooksPath === "") return { dead: false };
+  const top = git(cwd, ["rev-parse", "--show-toplevel"]);
+  if (top === void 0) return { dead: false };
+  const expanded = expandHooksPathTilde(hooksPath);
+  const hooksDir2 = isAbsolute(expanded) ? expanded : join(top, expanded);
+  let entries;
+  try {
+    entries = readdirSync(hooksDir2);
+  } catch (err) {
+    const code = err.code;
+    if (code === "ENOENT" || code === "ENOTDIR") return { dead: true, hooksDir: hooksDir2, repoRoot: top };
+    return { dead: false, hooksDir: hooksDir2, repoRoot: top, unreadableError: err };
+  }
+  const dead = entries.filter((e) => e !== ".gitignore").length === 0;
+  return { dead, hooksDir: hooksDir2, repoRoot: top };
+}
+var ALLOWED_PACKAGE_MANAGERS = ["yarn", "npm", "pnpm", "bun"];
+function preparePackageManagerCommand(repoRoot) {
+  let declared = "";
+  try {
+    const pkg = JSON.parse(readFileSync(join(repoRoot, "package.json"), "utf8"));
+    if (typeof pkg.packageManager === "string") declared = pkg.packageManager.split("@")[0] ?? "";
+  } catch {
+    declared = "";
+  }
+  if (!ALLOWED_PACKAGE_MANAGERS.includes(declared)) declared = "";
+  if (declared === "yarn") return "yarn prepare";
+  return `${declared || "npm"} run prepare`;
+}
+function huskyPrepareScript(repoRoot) {
+  try {
+    const pkg = JSON.parse(readFileSync(join(repoRoot, "package.json"), "utf8"));
+    const script = pkg.scripts?.prepare;
+    if (typeof script === "string" && /husky/i.test(script)) return script;
+  } catch {
+  }
+  return null;
+}
+
+export { deadHooksState, huskyPrepareScript, preparePackageManagerCommand, removeJournalHooks, removePreCommitGuardHook };

package/dist/{chunk-NBGDBTO2.js → chunk-TWF3RICI.js}

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { mcpTargetPath, INIT_STDIO_ENTRY, INIT_DOCS_ENTRY, DOCS_MCP_SERVER_NAME } from './chunk-XCK2YAY5.js';
-import { POLICY_CONTENT, VALIDATOR_FILES, VALIDATORS_DIR, POLICY_PATH } from './chunk-42ZI52JW.js';
-import { pinExists, readContextManifest } from './chunk-WTE3MQML.js';
-import { resolvePackRoot, loadTemplateFiles, skillDir } from './chunk-POJMEEJJ.js';
+import { mcpTargetPath, INIT_STDIO_ENTRY, INIT_DOCS_ENTRY, DOCS_MCP_SERVER_NAME } from './chunk-YVZJ6GKF.js';
+import { POLICY_CONTENT, VALIDATOR_FILES, VALIDATORS_DIR, POLICY_PATH } from './chunk-6X4SQ5MY.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
+import { resolvePackRoot, loadTemplateFiles, skillDir } from './chunk-NNLA7LLQ.js';
+import { cliInvocation } from './chunk-CRB3POP4.js';
+import { cloneIsGoverned } from './chunk-YQR6E6OV.js';
 import { createHash } from 'crypto';
 import { existsSync, readFileSync } from 'fs';
 import { join } from 'path';
@@ -105,11 +106,11 @@ function inspectStarterFiles(root, opts = {}) {
 function itemLabel(item) {
   return item.kind === "file" ? item.path : `${item.path} "${item.server}" server`;
 }
-function contextIsGoverned(root, gitCommonDir) {
-  return pinExists(root) || readContextManifest(gitCommonDir) !== void 0;
+function contextIsGoverned(gitCommonDir) {
+  return cloneIsGoverned(gitCommonDir);
 }
 var NAME = "Starter files";
-var UPDATE = "outerlayer init --update";
+var UPDATE = `${cliInvocation()} init --update`;
 function shownPaths(items, all) {
   const shown = [];
   const whole = /* @__PURE__ */ new Set();
@@ -130,7 +131,7 @@ function shownPaths(items, all) {
 function checkStarterFiles(cwd, opts = {}) {
   const none = { checks: [], mcpOutdated: false };
   const dirs = findGitDirs(cwd ?? process.cwd());
-  if (dirs === void 0 || contextIsGoverned(dirs.repoRoot, dirs.gitCommonDir)) return none;
+  if (dirs === void 0 || contextIsGoverned(dirs.gitCommonDir)) return none;
   const report = inspectStarterFiles(dirs.repoRoot, opts);
   if (report.items.every((i) => i.kind === "mcp" || i.state === "missing")) return none;
   const by = (state) => report.items.filter((i) => i.state === state);

package/dist/{chunk-ONKJUM6R.js → chunk-UVG35MWF.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-MAK5LYRF.js';
+import { MIN_ENGINE_MAJOR } from './chunk-7KSSBQTS.js';
 import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-CX22S5BA.js';
 import { spawnSync } from 'child_process';
 import { existsSync, accessSync, constants, statSync, readFileSync } from 'fs';

package/dist/{chunk-KMDLFI4P.js → chunk-VMJPFQNE.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
+import { trackImageBuild, isOutOfMemory, ensureBuilder } from './chunk-3UZTIRLF.js';
 import { RecipeError } from './chunk-QOZKPLVJ.js';
-import { trackImageBuild, isOutOfMemory, ensureBuilder } from './chunk-4NPZVMJU.js';
 import { spawn } from 'child_process';
 import { existsSync, mkdirSync, createWriteStream, rmSync, readFileSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/chunk-VRRGENS4.js

@@ -0,0 +1,144 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { readContextManifest, removeContextManifest } from './chunk-YQR6E6OV.js';
+import { removePreCommitGuardHook } from './chunk-TUSYOL2O.js';
+import { execFileSync } from 'child_process';
+import { existsSync, unlinkSync, lstatSync, readdirSync, rmdirSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
+import { join, dirname, isAbsolute } from 'path';
+
+createRequire(import.meta.url);
+var CONTEXT_EXCLUDE_MARKER = "outerlayer context materialization";
+var BEGIN_PREFIX = `# BEGIN ${CONTEXT_EXCLUDE_MARKER}`;
+var END = `# END ${CONTEXT_EXCLUDE_MARKER}`;
+function excludeFilePath(gitCommonDir) {
+  return join(gitCommonDir, "info", "exclude");
+}
+function readLines(path) {
+  if (!existsSync(path)) return [];
+  const content = readFileSync(path, "utf8");
+  if (content === "") return [];
+  const lines = content.split("\n");
+  if (lines[lines.length - 1] === "") lines.pop();
+  return lines;
+}
+function writeLines(path, lines) {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, lines.length ? lines.join("\n") + "\n" : "");
+}
+function findWellFormedBlock(lines) {
+  let i = 0;
+  while (i < lines.length) {
+    if (!lines[i].startsWith(BEGIN_PREFIX)) {
+      i++;
+      continue;
+    }
+    const beginIdx = i;
+    let endIdx = -1;
+    let j = beginIdx + 1;
+    for (; j < lines.length; j++) {
+      if (lines[j] === END) {
+        endIdx = j;
+        break;
+      }
+      if (lines[j].startsWith(BEGIN_PREFIX)) break;
+    }
+    if (endIdx !== -1) return { beginIdx, endIdx };
+    i = j;
+  }
+  return void 0;
+}
+function removeContextExcludes(gitCommonDir) {
+  const path = excludeFilePath(gitCommonDir);
+  const lines = readLines(path);
+  const block = findWellFormedBlock(lines);
+  if (block === void 0) return { changed: false };
+  writeLines(path, [...lines.slice(0, block.beginIdx), ...lines.slice(block.endIdx + 1)]);
+  return { changed: true };
+}
+function contextExcludesPresent(gitCommonDir) {
+  return findWellFormedBlock(readLines(excludeFilePath(gitCommonDir))) !== void 0;
+}
+
+// src/context-cleanup.ts
+function hasEarlierCopies(gitCommonDir) {
+  return readContextManifest(gitCommonDir) !== void 0 || contextExcludesPresent(gitCommonDir);
+}
+function isCopiedPath(rel) {
+  if (isAbsolute(rel) || rel.split("/").includes("..")) return false;
+  return rel === "AGENTS.md" || rel.startsWith(".claude/") || rel.startsWith(".outerlayer/");
+}
+function hasSymlinkComponent(root, rel) {
+  let current = root;
+  for (const segment of rel.split("/")) {
+    current = join(current, segment);
+    try {
+      if (lstatSync(current).isSymbolicLink()) return true;
+    } catch {
+      return false;
+    }
+  }
+  return false;
+}
+function trackedPaths(repoRoot) {
+  try {
+    const out = execFileSync("git", ["ls-files", "-z", "--", "AGENTS.md", ".claude", ".outerlayer"], {
+      cwd: repoRoot,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 5e3
+    });
+    return new Set(out.split("\0").filter((path) => path !== ""));
+  } catch {
+    return void 0;
+  }
+}
+function pruneEmptyDirs(start, root) {
+  let current = start;
+  while (current !== root && current.startsWith(root)) {
+    try {
+      if (readdirSync(current).length > 0) return;
+      rmdirSync(current);
+    } catch {
+      return;
+    }
+    current = dirname(current);
+  }
+}
+function cleanupEarlierCopies(input) {
+  const { repoRoot, gitCommonDir } = input;
+  const result = { removedFiles: [], excludeRemoved: false, guardRemoved: false };
+  if (!hasEarlierCopies(gitCommonDir)) return result;
+  let complete = true;
+  try {
+    const manifest = readContextManifest(gitCommonDir);
+    if (manifest !== void 0) {
+      const tracked = trackedPaths(repoRoot);
+      if (tracked === void 0) return result;
+      const isTracked = (rel) => [...tracked].some((path) => path === rel || rel.startsWith(`${path}/`));
+      for (const rel of manifest.files) {
+        if (!isCopiedPath(rel) || isTracked(rel) || hasSymlinkComponent(repoRoot, rel)) continue;
+        const abs = join(repoRoot, rel);
+        if (!existsSync(abs)) continue;
+        try {
+          unlinkSync(abs);
+          result.removedFiles.push(rel);
+          pruneEmptyDirs(dirname(abs), repoRoot);
+        } catch {
+          complete = false;
+        }
+      }
+    }
+  } catch {
+    return result;
+  }
+  if (!complete) return result;
+  try {
+    result.guardRemoved = removePreCommitGuardHook(repoRoot).removed;
+    result.excludeRemoved = removeContextExcludes(gitCommonDir).changed;
+    removeContextManifest(gitCommonDir);
+  } catch {
+  }
+  return result;
+}
+
+export { cleanupEarlierCopies };

package/dist/{chunk-PTW6W5NR.js → chunk-VYAL7PUE.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { currentLink } from './chunk-TI7B7UEO.js';
+import { currentLink } from './chunk-AMFWYESY.js';
 import { readFileSync, statSync, chmodSync, mkdirSync, writeFileSync, renameSync, rmSync, existsSync, lstatSync, accessSync, constants, realpathSync } from 'fs';
 import { randomBytes } from 'crypto';
 import { join, dirname, delimiter, resolve } from 'path';

package/dist/{chunk-OHVJA253.js → chunk-WFSUUUAN.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RESERVED_EMIT_NAMES, ARTIFACT_KINDS, ArtifactCriterionIdSchema } from './chunk-J5M7BSJQ.js';
+import { RESERVED_EMIT_NAMES, ARTIFACT_KINDS, ArtifactCriterionIdSchema } from './chunk-7VUK5RFS.js';
 import { __commonJS, __require, __toESM } from './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);
@@ -7950,31 +7950,11 @@ function mergeCopies(perTarget) {
   const copies = [...byPath.entries()].filter(([path]) => !conflicted.has(path)).map(([toPath, fromSourcePath]) => ({ toPath, fromSourcePath })).sort((a, b) => a.toPath.localeCompare(b.toPath));
   return { copies, errors };
 }
-var CONTEXT_SOURCE_CONFIG_PATH = ".outerlayer/config.json";
-function parseGoverns(content) {
-  let parsed;
-  try {
-    parsed = JSON.parse(content);
-  } catch {
-    return { error: `${CONTEXT_SOURCE_CONFIG_PATH} is not valid JSON` };
-  }
-  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-    return { error: `${CONTEXT_SOURCE_CONFIG_PATH} must be a JSON object` };
-  }
-  const governs = parsed["governs"];
-  if (governs === void 0) {
-    return { governs: [] };
-  }
-  if (!Array.isArray(governs) || governs.some((entry) => typeof entry !== "string")) {
-    return { error: `"governs" must be an array of "owner/repo" strings` };
-  }
-  return { governs };
-}
 function normalizeRepoName(repo) {
   return repo.trim().toLowerCase();
 }
 var CONTEXT_PIN_FILENAME = ".outerlayer-pin.json";
-var CONTEXT_PIN_SCHEMA_VERSION = 1;
+var MAX_BRIEF_LENGTH = 300;
 var MAX_COMMAND_LENGTH = 2e3;
 var EXTENDS_PROBLEM = '"extends" is not a policy key \u2014 every check is a file in .outerlayer/validators/. Run outerlayer init --template default to write .outerlayer/validators/code-review.yaml, then delete the extends line';
 var FREED_BUILTINS = /* @__PURE__ */ new Set(["ci-passed", "acceptance-criteria", "code-review-ran"]);
@@ -7994,6 +7974,8 @@ var MAX_ROW_LENGTH = 200;
 var MAX_NAME_LENGTH = 40;
 var MAX_GLOB_LENGTH = 200;
 var MAX_WHEN_PATHS = 20;
+var MAX_WHEN_REPOSITORIES = 20;
+var REPOSITORY_NAME = /^[\w.-]+\/[\w.-]+$/;
 var NEEDS_ALIASES = {
   "tool-calls.commands": "commands",
   "tool-calls.edits": "edits",
@@ -8276,13 +8258,14 @@ function parseCustomFile(file, problems) {
   let whenPaths = null;
   let whenIssueType = null;
   let whenIssueLabels = null;
+  let whenRepositories;
   if (root["when"] !== void 0) {
     const when = root["when"];
     if (!isRecord(when) || Object.keys(when).some(
-      (key) => key !== "paths" && key !== "issue.type" && key !== "issue.labels"
+      (key) => key !== "paths" && key !== "repositories" && key !== "issue.type" && key !== "issue.labels"
     ) || Object.keys(when).length === 0) {
       return fail(
-        `"${id}" when: only "paths", "issue.type", and "issue.labels" scoping is supported`
+        `"${id}" when: only "paths", "repositories", "issue.type", and "issue.labels" scoping is supported`
       );
     }
     const paths = when["paths"];
@@ -8301,6 +8284,18 @@ function parseCustomFile(file, problems) {
       }
       whenPaths = paths.map((p) => p.trim());
     }
+    const repositories = when["repositories"];
+    if (repositories !== void 0) {
+      if (!Array.isArray(repositories) || repositories.length === 0 || repositories.some((name2) => typeof name2 !== "string" || !REPOSITORY_NAME.test(name2.trim()))) {
+        return fail(`"${id}" when.repositories must be a non-empty list of owner/repo names`);
+      }
+      if (repositories.length > MAX_WHEN_REPOSITORIES) {
+        return fail(
+          `"${id}" when.repositories lists ${repositories.length} names \u2014 the cap is ${MAX_WHEN_REPOSITORIES}`
+        );
+      }
+      whenRepositories = repositories.map((name2) => name2.trim());
+    }
     const issueType = when["issue.type"];
     if (issueType !== void 0) {
       if (typeof issueType !== "string" || issueType.trim() === "") {
@@ -8325,10 +8320,11 @@ function parseCustomFile(file, problems) {
   let declaresEmit = null;
   let runWhere;
   let command;
+  let judge;
   if (hasRun) {
     const run = root["run"];
-    if (!isRecord(run) || Object.keys(run).some((key) => key !== "where" && key !== "emit" && key !== "command")) {
-      return fail(`"${id}" run: must be a mapping of "where", "emit" and, for where: host, "command"`);
+    if (!isRecord(run) || Object.keys(run).some((key) => key !== "where" && key !== "emit" && key !== "command" && key !== "judge")) {
+      return fail(`"${id}" run: must be a mapping of "where", "emit" and, for where: host, "command" or "judge"`);
     }
     const where = run["where"];
     if (where !== "ci" && where !== "host") {
@@ -8346,10 +8342,29 @@ function parseCustomFile(file, problems) {
     if (where === "ci" && run["command"] !== void 0) {
       return fail(`"${id}" run.command is only for run.where: host \u2014 a where: ci check runs in your own CI`);
     }
-    if (where === "host") {
+    if (where === "ci" && run["judge"] !== void 0) {
+      return fail(`"${id}" run.judge is only for run.where: host \u2014 a where: ci check runs in your own CI`);
+    }
+    if (where === "host" && run["judge"] !== void 0) {
+      if (run["command"] !== void 0) {
+        return fail(`"${id}" run declares both "judge" and "command" \u2014 a host check has one or the other`);
+      }
+      const rawJudge = run["judge"];
+      if (!isRecord(rawJudge) || Object.keys(rawJudge).some((key) => key !== "brief")) {
+        return fail(`"${id}" run.judge must be a mapping with a "brief"`);
+      }
+      const brief = rawJudge["brief"];
+      if (typeof brief !== "string" || brief.trim() === "" || brief.length > MAX_BRIEF_LENGTH || brief.startsWith("/") || brief.split("/").includes("..")) {
+        return fail(
+          `"${id}" run.judge.brief must be a relative path inside the repository, of at most ${MAX_BRIEF_LENGTH} characters, with no ".." segment`
+        );
+      }
+      judge = { brief: brief.trim() };
+      runWhere = "host";
+    } else if (where === "host") {
       const rawCommand = run["command"];
       if (rawCommand === void 0) {
-        return fail(`"${id}" run.where: host needs a "command" \u2014 the shell line the host runs`);
+        return fail(`"${id}" run.where: host needs a "command" or a "judge" \u2014 what the host runs`);
       }
       if (typeof rawCommand !== "string" || rawCommand.trim() === "" || rawCommand.length > MAX_COMMAND_LENGTH) {
         return fail(`"${id}" run.command must be a non-empty string of at most ${MAX_COMMAND_LENGTH} characters`);
@@ -8375,6 +8390,7 @@ function parseCustomFile(file, problems) {
       whenPaths,
       whenIssueType,
       whenIssueLabels,
+      ...whenRepositories === void 0 ? {} : { whenRepositories, whenRepositoriesFile: file.path },
       requireAny,
       // Declared needs only — the author's own statement of what the rule
       // reads. A session.ran alternative is guarded per-alternative at
@@ -8384,7 +8400,8 @@ function parseCustomFile(file, problems) {
       needs: [...new Set(declaredNeeds)].sort(),
       declaresEmit,
       ...runWhere === void 0 ? {} : { runWhere },
-      ...command === void 0 ? {} : { command }
+      ...command === void 0 ? {} : { command },
+      ...judge === void 0 ? {} : { judge }
     },
     file: file.path,
     validatorRefs: requireAny.flatMap((alt) => alt.type === "validator" ? [alt.id] : []),
@@ -8685,4 +8702,4 @@ function sessionsToTimeline(sessions) {
   return out;
 }
 
-export { ALL_TARGET_IDS, CONTEXT_PIN_FILENAME, CONTEXT_PIN_SCHEMA_VERSION, CONTEXT_SOURCE_CONFIG_PATH, classifyTree, emitTree, extractFacts, generatedHeaderSource, normalizePath, normalizeRepoName, orderSessions, parseGoverns, parseOuterlayerConfig, parsePolicy, sessionsToTimeline, splitRawFile };
+export { ALL_TARGET_IDS, CONTEXT_PIN_FILENAME, classifyTree, emitTree, extractFacts, generatedHeaderSource, normalizePath, normalizeRepoName, orderSessions, parseOuterlayerConfig, parsePolicy, sessionsToTimeline, splitRawFile };

package/dist/{chunk-RSNSZ2LJ.js → chunk-X5H2WYMB.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RELAY_PORT, GATEWAY_SOCKET, GATEWAY_PORT, CLAUDE_SOCKET, CLAUDE_PORT, DESTINATION_BASE_PORT } from './chunk-4Q7OMKAT.js';
+import { RELAY_PORT, GATEWAY_SOCKET, GATEWAY_PORT, CLAUDE_SOCKET, CLAUDE_PORT, DESTINATION_BASE_PORT } from './chunk-BQXFBI7T.js';
 import { symlinkSync, unlinkSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-HYZRY4KZ.js → chunk-XNGMQ27R.js}

@@ -1,12 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EXEC_PORT } from './chunk-RSNSZ2LJ.js';
-import { RELAY_PORT } from './chunk-4Q7OMKAT.js';
+import { EXEC_PORT } from './chunk-X5H2WYMB.js';
+import { startTimeOf } from './chunk-JBJTC3UU.js';
+import { RELAY_PORT } from './chunk-BQXFBI7T.js';
 import { spawn, spawnSync } from 'child_process';
 import { writeFileSync, chmodSync, mkdirSync } from 'fs';
 
 createRequire(import.meta.url);
 var HELPER_PATH = "/opt/outerlayer/bin/outerlayer-guest";
+var HELPER_RECORD = "/run/outerlayer-helpers";
 var KERNEL_FLAG = "outerlayer.relay";
 var DOCKER_FLAG = "outerlayer.docker";
 var DOCKERD_CONFIG = "/run/outerlayer-dockerd.json";
@@ -62,9 +64,11 @@ function runGuestInit(host, cmdline) {
   }
   host.writeFile("/proc/sys/kernel/hostname", HOSTNAME);
   host.mount({ source: "tmpfs", target: "/outerlayer/job", type: "tmpfs", options: "mode=0755" });
-  host.spawnDetached([HELPER_PATH, "relay", ...ports.flatMap((port) => ["--forward", String(port)])]);
+  const relay = host.spawnDetached([HELPER_PATH, "relay", ...ports.flatMap((port) => ["--forward", String(port)])]);
   if (dockerRequestedBy(cmdline)) startDocker(host);
-  host.spawnDetached([HELPER_PATH, "exec-agent", "--port", String(EXEC_PORT)]);
+  const agent = host.spawnDetached([HELPER_PATH, "exec-agent", "--port", String(EXEC_PORT)]);
+  host.writeFile(HELPER_RECORD, [relay, agent].map((started) => `${started.pid} ${started.start}
+`).join(""));
 }
 function realGuestHost() {
   return {
@@ -81,9 +85,15 @@ function realGuestHost() {
     chmod: (path, mode) => chmodSync(path, mode),
     writeFile: (path, text) => writeFileSync(path, text),
     spawnDetached(argv) {
-      spawn(argv[0], argv.slice(1), { detached: true, stdio: ["ignore", "inherit", "inherit"] }).unref();
+      const child = spawn(argv[0], argv.slice(1), { detached: true, stdio: ["ignore", "inherit", "inherit"] });
+      child.unref();
+      child.once("error", () => {
+      });
+      const start = child.pid === void 0 ? null : startTimeOf(child.pid);
+      if (child.pid === void 0 || start === null) throw new Error(`${argv[0]} did not start`);
+      return { pid: child.pid, start };
     }
   };
 }
 
-export { DOCKERD_LOG, HELPER_PATH, realGuestHost, relayPortsFrom, runGuestInit };
+export { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD, realGuestHost, relayPortsFrom, runGuestInit };