@outerlayer/cli 0.17.0 → 0.19.0

package/dist/chunk-452TM7J4.js

@@ -0,0 +1,502 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { removeRetiredSkills } from './chunk-IXYZUUYQ.js';
+import { defaultFetch } from './chunk-FVMYKL6L.js';
+import { resolveGatewayCredentials } from './chunk-NTRCK4NH.js';
+import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
+import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-NNLA7LLQ.js';
+import { normalizeRepoName, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-WFSUUUAN.js';
+import { cliInvocation } from './chunk-CRB3POP4.js';
+import { writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, writeContextManifest, SOURCE_CACHE_TTL_SUCCESS_MS, readSourceCache, isSourceCacheFresh, clearDegraded } from './chunk-YQR6E6OV.js';
+import { homeFromEnv } from './chunk-VNVZDWO3.js';
+import { withTokenHeader } from './chunk-BQXFBI7T.js';
+import { execFileSync } from 'child_process';
+import { existsSync, mkdirSync, writeFileSync, chmodSync, lstatSync, readFileSync, copyFileSync } from 'fs';
+import { isAbsolute, join, dirname } from 'path';
+
+createRequire(import.meta.url);
+var CONFIG_PATH = ".outerlayer/config.json";
+var CONTENT_KINDS = /* @__PURE__ */ new Set(["skill", "skill-reference"]);
+function overlayMaintainedSkills(repoRoot, unsafe) {
+  const sources = loadMaintainedFiles().filter((file) => !unsafe(file.path));
+  writeMaintainedFiles(repoRoot, sources);
+  const paths = sources.map((file) => file.path);
+  const configAbs = join(repoRoot, CONFIG_PATH);
+  if (!existsSync(configAbs)) return paths;
+  const config = parseOuterlayerConfig(readFileSync(configAbs, "utf8"));
+  if (!config.ok || !config.config) return paths;
+  const { entries } = classifyTree(sources.map((file) => file.path));
+  const input = {
+    entries,
+    contents: new Map(entries.filter((e) => CONTENT_KINDS.has(e.kind)).map((e) => [e.path, sources.find((f) => f.path === e.path).content])),
+    assetPaths: [],
+    targets: config.config.targets
+  };
+  const compiled = emitTree(input);
+  if (compiled.errors.length > 0) return paths;
+  for (const file of compiled.files) {
+    if (unsafe(file.path)) continue;
+    const abs = join(repoRoot, file.path);
+    mkdirSync(dirname(abs), { recursive: true });
+    if (!existsSync(abs) || readFileSync(abs, "utf8") !== file.content) writeFileSync(abs, file.content);
+    paths.push(file.path);
+  }
+  for (const copy of compiled.copies) {
+    if (unsafe(copy.toPath)) continue;
+    const abs = join(repoRoot, copy.toPath);
+    mkdirSync(dirname(abs), { recursive: true });
+    copyFileSync(join(repoRoot, copy.fromSourcePath), abs);
+    paths.push(copy.toPath);
+  }
+  return paths;
+}
+
+// src/context-materialize.ts
+var defaultGitRunner = (args, opts) => {
+  try {
+    const stdout = execFileSync("git", args, {
+      cwd: opts.cwd,
+      timeout: opts.timeoutMs,
+      input: opts.input,
+      // Control-plane trees are small config/doc surfaces (AGENTS.md,
+      // .claude/**, .outerlayer/**) — generous but bounded so a runaway
+      // cat-file stream can't exhaust memory.
+      maxBuffer: 64 * 1024 * 1024,
+      stdio: ["pipe", "pipe", "pipe"],
+      env: (opts.env ?? ((base) => base))({
+        ...process.env,
+        // classifyGitFailure greps English stderr substrings
+        // ("Authentication failed", "Permission denied", …) — a git running
+        // under a non-English locale would translate those and silently
+        // misclassify every failure as "unreachable" instead of "no-access".
+        LC_ALL: "C",
+        // A bare https:// remote with no cached credential answer otherwise
+        // blocks on an interactive username/password prompt with no
+        // terminal to read from here, hanging until OUR OWN timeout instead
+        // of failing fast with a classifiable stderr message.
+        GIT_TERMINAL_PROMPT: "0"
+      })
+    });
+    return { ok: true, stdout: Buffer.isBuffer(stdout) ? stdout : Buffer.from(stdout), stderr: "" };
+  } catch (err) {
+    const e = err;
+    return {
+      ok: false,
+      stdout: e.stdout ? Buffer.from(e.stdout) : Buffer.alloc(0),
+      stderr: e.stderr ? Buffer.from(e.stderr).toString("utf8") : e.message ?? String(err)
+    };
+  }
+};
+function gitText(git, cwd, args, timeoutMs) {
+  const result = git(args, { cwd, timeoutMs });
+  return result.ok ? result.stdout.toString("utf8").trim() : void 0;
+}
+var GATEWAY_TOO_OLD_MESSAGE = "the OuterLayer this machine talks to is too old to name the control plane \u2014 ask whoever runs it to upgrade; context written earlier is kept";
+var CANNOT_IDENTIFY_MESSAGE = "this repository is governed, but the control plane cannot be identified \u2014 check OuterLayer connectivity/config";
+function designationAuthRejectedMessage(credential) {
+  return credential.startsWith("olu_") ? `the OuterLayer login was rejected (401/403) \u2014 run \`${cliInvocation()} login\` to sign in again` : "the OuterLayer API key was rejected (401/403) \u2014 check apiKey in ~/.outerlayer/config.json";
+}
+var PARTIAL_WRITE_MESSAGE = "control-plane content could not be fully written";
+var OVERLAY_FAILED_MESSAGE = "control-plane content was written but the maintained skills could not be refreshed";
+function isStagingWriteFault(message) {
+  return message === PARTIAL_WRITE_MESSAGE || message === OVERLAY_FAILED_MESSAGE;
+}
+function hasSymlinkComponent(root, relPath) {
+  let current = root;
+  for (const segment of relPath.split("/")) {
+    current = join(current, segment);
+    let st;
+    try {
+      st = lstatSync(current);
+    } catch {
+      return false;
+    }
+    if (st.isSymbolicLink()) return true;
+  }
+  return false;
+}
+function unreachableMessage() {
+  return "the control plane is unreachable";
+}
+function noAccessMessage() {
+  return "you do not have access to the control plane \u2014 check your git credentials (SSH key or token) and org/SSO access, then retry";
+}
+function classifyGitFailure(stderr) {
+  if (/authentication failed|permission denied \(publickey\)|\b403\b|saml sso|access denied/i.test(stderr)) {
+    return "no-access";
+  }
+  return "unreachable";
+}
+async function materializeContext(deps) {
+  const home = deps.home ?? homeFromEnv();
+  const now = deps.now ?? Date.now;
+  const git = deps.git ?? defaultGitRunner;
+  const fetchImpl = deps.fetchImpl ?? defaultFetch;
+  const repoRoot = gitText(git, deps.cwd, ["rev-parse", "--show-toplevel"], 2e3);
+  if (repoRoot === void 0) {
+    return { status: "not-a-repo", sha: null, verification: "none" };
+  }
+  const gitCommonDir = resolveGitCommonDir(git, repoRoot);
+  if (gitCommonDir === void 0) {
+    return { status: "not-a-repo", sha: null, verification: "none" };
+  }
+  const record = (sha2, verification, repository2, ref2) => {
+    if (deps.sessionId === void 0) return;
+    appendContextProvenance(
+      { t: new Date(now()).toISOString(), sessionId: deps.sessionId, repoRoot, repository: repository2, ref: ref2, sha: sha2, verification },
+      home
+    );
+  };
+  const selfOutcome = () => {
+    clearDegraded(gitCommonDir);
+    return { status: "self", sha: null, verification: "none" };
+  };
+  const ownRepoName = deriveOwnRepoName(git, repoRoot);
+  if (ownRepoName === void 0) {
+    return selfOutcome();
+  }
+  const designation = deps.pinnedSource === void 0 ? await resolveDesignation({ git, fetchImpl, home, cloud: deps.cloud, now, gitCommonDir, ownRepoName, repoRoot, lookup: deps.designationLookup ?? { timeoutMs: 2e3, attempts: 1 } }) : deps.pinnedSource === null ? { status: "self" } : { status: "governed", ...deps.pinnedSource };
+  const answered = { designation: "answered" };
+  if (designation.status === "self") {
+    if (designation.unanswered !== void 0) {
+      const { authRejected, gatewayTooOld } = designation.unanswered;
+      const message = authRejected ?? (gatewayTooOld ? GATEWAY_TOO_OLD_MESSAGE : void 0);
+      if (message !== void 0) {
+        writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind: "designation-unverified", message });
+      }
+      return {
+        status: "self",
+        sha: null,
+        verification: "none",
+        designation: "unknown",
+        ...authRejected ? { authRejected: true } : {},
+        ...message !== void 0 && !authRejected ? { message } : {}
+      };
+    }
+    return { ...selfOutcome(), ...answered };
+  }
+  if (designation.status === "unknown") {
+    const message = designation.authRejected ?? (designation.gatewayTooOld ? GATEWAY_TOO_OLD_MESSAGE : CANNOT_IDENTIFY_MESSAGE);
+    if (designation.authRejected || designation.gatewayTooOld) {
+      writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind: "designation-unverified", message });
+    }
+    writeSourceCache(gitCommonDir, {
+      checkedAt: new Date(now()).toISOString(),
+      status: "self",
+      ttlMs: SOURCE_CACHE_TTL_RETRY_MS,
+      unanswered: {
+        ...designation.authRejected ? { authRejected: designation.authRejected } : {},
+        ...designation.gatewayTooOld ? { gatewayTooOld: true } : {}
+      }
+    });
+    return {
+      status: "self",
+      sha: null,
+      verification: "none",
+      designation: "unknown",
+      ...designation.authRejected ? { authRejected: true } : {},
+      ...designation.gatewayTooOld ? { message } : {},
+      lookupFailure: designation.lookupFailure
+    };
+  }
+  const repository = designation.repository;
+  const ref = designation.ref;
+  const unverifiedIdentity = designation.unverifiedIdentity;
+  const storedSha = designation.sha;
+  const clearOrFlagIdentity = () => {
+    if (unverifiedIdentity) {
+      writeDegraded(gitCommonDir, {
+        at: new Date(now()).toISOString(),
+        kind: "designation-unverified",
+        message: designation.gatewayTooOld ? GATEWAY_TOO_OLD_MESSAGE : CANNOT_IDENTIFY_MESSAGE,
+        repository,
+        ref
+      });
+    } else {
+      clearDegraded(gitCommonDir);
+    }
+  };
+  const remoteUrl = deps.resolveControlPlaneUrl ? deps.resolveControlPlaneUrl(repository, ref, repoRoot) : buildControlPlaneUrl(git, repoRoot, repository);
+  const cacheHost = parseRemoteHost(remoteUrl).host || "unknown-host";
+  const cacheRepoDir = ensureBareCache(git, home, repository, cacheHost);
+  const localRef = `refs/outerlayer/sha-${sanitizeRefName(storedSha)}`;
+  const wanted = `+${storedSha}:${localRef}`;
+  const access = await deps.controlPlaneAccess?.([{ repository, ref }]);
+  const token = access !== void 0 && normalizeRepoName(access.repository) === normalizeRepoName(repository) ? access.token : void 0;
+  const fetchResult = git(["fetch", "--depth", "1", remoteUrl, wanted], {
+    cwd: cacheRepoDir,
+    timeoutMs: 1e4,
+    ...token === void 0 ? {} : { env: (base) => withTokenHeader(base, remoteUrl, token) }
+  });
+  const commitNote = (message) => `could not fetch commit \`${storedSha.slice(0, 7)}\` of ${repository}; ${message}`;
+  if (!fetchResult.ok) {
+    const kind = classifyGitFailure(fetchResult.stderr);
+    const doctorMessage = commitNote(kind === "no-access" ? noAccessMessage() : unreachableMessage());
+    writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind, message: doctorMessage, repository, ref });
+    record(null, "none", repository, ref);
+    return { status: kind, message: doctorMessage, sha: null, verification: "none" };
+  }
+  const fetchedSha = gitText(git, cacheRepoDir, ["rev-parse", localRef], 2e3);
+  if (fetchedSha !== storedSha) {
+    const doctorMessage = commitNote(unreachableMessage());
+    writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind: "unreachable", message: doctorMessage, repository, ref });
+    record(null, "none", repository, ref);
+    return { status: "unreachable", message: doctorMessage, sha: null, verification: "none" };
+  }
+  const sha = fetchedSha;
+  const files = listMaterializedFiles(git, cacheRepoDir, sha);
+  const writeResult = writeFilesVerbatim(git, cacheRepoDir, files, repoRoot);
+  const partialWrite = () => {
+    writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind: "unreachable", message: PARTIAL_WRITE_MESSAGE, repository, ref });
+    record(null, "none", repository, ref);
+    return { status: "unreachable", message: PARTIAL_WRITE_MESSAGE, sha: null, verification: "none" };
+  };
+  if (!writeResult.ok) {
+    return partialWrite();
+  }
+  let overlayPaths = [];
+  let retiredPaths = /* @__PURE__ */ new Set();
+  let overlayFailed = false;
+  try {
+    retiredPaths = new Set(removeRetiredSkills(repoRoot, (rel) => hasSymlinkComponent(repoRoot, rel)));
+    overlayPaths = overlayMaintainedSkills(repoRoot, (rel) => hasSymlinkComponent(repoRoot, rel));
+  } catch {
+    overlayFailed = true;
+  }
+  const writtenPaths = [.../* @__PURE__ */ new Set([...writeResult.writtenPaths, ...overlayPaths])].filter((path) => !retiredPaths.has(path));
+  if (overlayFailed) {
+    writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind: "unreachable", message: OVERLAY_FAILED_MESSAGE, repository, ref });
+    record(sha, "unverified", repository, ref);
+    return { status: "unreachable", message: OVERLAY_FAILED_MESSAGE, sha, verification: "unverified" };
+  }
+  writeContextManifest(gitCommonDir, { schemaVersion: 1, sha, files: writtenPaths, materializedAt: new Date(now()).toISOString() });
+  clearOrFlagIdentity();
+  writeSourceCache(gitCommonDir, {
+    checkedAt: new Date(now()).toISOString(),
+    status: "governed",
+    repository,
+    ref,
+    sha: storedSha,
+    ttlMs: SOURCE_CACHE_TTL_SUCCESS_MS
+  });
+  record(sha, "verified", repository, ref);
+  return { status: "materialized", sha, verification: "verified" };
+}
+async function resolveDesignation(ctx) {
+  const cache = readSourceCache(ctx.gitCommonDir);
+  if (cache && cache.status === "self" && isSourceCacheFresh(cache, ctx.now())) {
+    return { status: "self", unanswered: cache.unanswered };
+  }
+  let authRejected;
+  let lookupFailure;
+  let gatewayTooOld = false;
+  const destination = resolveGatewayCredentials({
+    home: ctx.home,
+    env: {},
+    cwd: ctx.repoRoot,
+    ...ctx.cloud === void 0 ? {} : { url: ctx.cloud.url, apiKey: ctx.cloud.apiKey, appId: ctx.cloud.appId }
+  });
+  if (destination.ok) {
+    const lookup = await fetchContextSource(
+      { url: destination.url, apiKey: destination.credential, appId: destination.appId },
+      ctx.ownRepoName,
+      ctx.fetchImpl,
+      ctx.lookup
+    );
+    if (lookup.kind === "rejected") authRejected = designationAuthRejectedMessage(destination.credential);
+    if (lookup.kind === "failed") lookupFailure = lookup.failure;
+    if (lookup.kind === "answered") {
+      if (lookup.source === null) {
+        writeSourceCache(ctx.gitCommonDir, {
+          checkedAt: new Date(ctx.now()).toISOString(),
+          status: "self",
+          ttlMs: SOURCE_CACHE_TTL_SUCCESS_MS
+        });
+        return { status: "self" };
+      }
+      if (lookup.source !== void 0) {
+        return { status: "governed", repository: lookup.source.repository, ref: lookup.source.ref, sha: lookup.source.sha };
+      }
+      gatewayTooOld = true;
+    }
+  }
+  if (cache?.status === "self") {
+    return cache.unanswered !== void 0 || authRejected !== void 0 || gatewayTooOld ? {
+      status: "self",
+      unanswered: { ...cache.unanswered, ...authRejected ? { authRejected } : {}, ...gatewayTooOld ? { gatewayTooOld } : {} }
+    } : { status: "self" };
+  }
+  if (cache?.repository && cache.ref && cache.sha !== void 0) {
+    return { status: "governed", repository: cache.repository, ref: cache.ref, sha: cache.sha, unverifiedIdentity: true, ...gatewayTooOld ? { gatewayTooOld } : {} };
+  }
+  return { status: "unknown", authRejected, gatewayTooOld, lookupFailure };
+}
+async function lookupGoverningSource(config, repository, fetchImpl, lookup) {
+  return fetchContextSource(config, repository, fetchImpl, lookup);
+}
+async function fetchContextSource(config, ownRepoName, fetchImpl, lookup) {
+  const url = `${config.url.replace(/\/$/, "")}/v1/context/source?repo=${encodeURIComponent(ownRepoName)}`;
+  for (let attempt = 1; ; attempt++) {
+    const outcome = await askContextSource(url, config, fetchImpl, lookup.timeoutMs);
+    if (outcome.kind !== "failed" || !isRetryable(outcome.failure) || attempt >= lookup.attempts) return outcome;
+  }
+}
+function isRetryable(failure) {
+  return failure.kind !== "status" || failure.status >= 500;
+}
+async function askContextSource(url, config, fetchImpl, timeoutMs) {
+  const controller = new AbortController();
+  let timedOut = false;
+  const timer = setTimeout(() => {
+    timedOut = true;
+    controller.abort();
+  }, timeoutMs);
+  try {
+    const res = await fetchImpl(url, {
+      headers: { Authorization: `Bearer ${config.apiKey}`, "x-outerlayer-app-id": config.appId },
+      signal: controller.signal
+    });
+    if (res.status === 401 || res.status === 403) {
+      return { kind: "rejected" };
+    }
+    if (!res.ok) return { kind: "failed", failure: { kind: "status", status: res.status } };
+    const body = await res.json();
+    const data = body.data;
+    const source = validSource(data?.source);
+    if (typeof data !== "object" || data === null) {
+      return { kind: "failed", failure: { kind: "network", message: "the answer held no data" } };
+    }
+    return { kind: "answered", source };
+  } catch (err) {
+    return {
+      kind: "failed",
+      failure: timedOut ? { kind: "timeout", timeoutMs } : { kind: "network", message: err instanceof Error ? err.message : String(err) }
+    };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function validSource(source) {
+  if (source === null) return null;
+  const candidate = source;
+  if (typeof candidate?.repository === "string" && typeof candidate.ref === "string" && typeof candidate.sha === "string") {
+    return { repository: candidate.repository, ref: candidate.ref, sha: candidate.sha };
+  }
+  return void 0;
+}
+function resolveGitCommonDir(git, repoRoot) {
+  const abs = gitText(git, repoRoot, ["rev-parse", "--path-format=absolute", "--git-common-dir"], 2e3);
+  if (abs !== void 0) return abs;
+  const rel = gitText(git, repoRoot, ["rev-parse", "--git-common-dir"], 2e3);
+  if (rel === void 0) return void 0;
+  return isAbsolute(rel) ? rel : join(repoRoot, rel);
+}
+function deriveOwnRepoName(git, repoRoot) {
+  const url = gitText(git, repoRoot, ["config", "--get", "remote.origin.url"], 2e3);
+  if (url === void 0) return void 0;
+  return parseOwnerRepo(url);
+}
+function parseOwnerRepo(url) {
+  const stripped = url.replace(/\.git$/, "");
+  const scpMatch = stripped.match(/^[\w.-]+@[\w.-]+:(.+)$/);
+  if (scpMatch) return scpMatch[1];
+  try {
+    const parsed = new URL(stripped);
+    return parsed.pathname.replace(/^\//, "");
+  } catch {
+    return void 0;
+  }
+}
+function parseRemoteHost(url) {
+  const scpMatch = url.match(/^([\w.-]+)@([\w.-]+):/);
+  if (scpMatch) return { scheme: "ssh", host: scpMatch[2] };
+  try {
+    const parsed = new URL(url);
+    return { scheme: parsed.protocol === "https:" ? "https" : "ssh", host: parsed.host };
+  } catch {
+    return { scheme: "https", host: "github.com" };
+  }
+}
+function buildControlPlaneUrl(git, repoRoot, repository) {
+  const ownUrl = gitText(git, repoRoot, ["config", "--get", "remote.origin.url"], 2e3);
+  const { scheme, host } = ownUrl ? parseRemoteHost(ownUrl) : { scheme: "https", host: "github.com" };
+  return scheme === "ssh" ? `git@${host}:${repository}.git` : `https://${host}/${repository}.git`;
+}
+function cacheDirName(repository, host) {
+  const parts = repository.split("/");
+  return [host, ...parts].join("__").replace(/[^a-zA-Z0-9._-]/g, "-");
+}
+function sanitizeRefName(ref) {
+  return ref.replace(/[^a-zA-Z0-9._-]/g, "-");
+}
+function ensureBareCache(git, home, repository, host) {
+  const dir = join(home, ".outerlayer", "control-planes", `${cacheDirName(repository, host)}.git`);
+  if (!existsSync(join(dir, "HEAD"))) {
+    mkdirSync(dirname(dir), { recursive: true });
+    git(["init", "--bare", "-q", dir], { cwd: dirname(dir), timeoutMs: 5e3 });
+  }
+  return dir;
+}
+var MATERIALIZED_ROOTS = ["AGENTS.md", ".claude", ".outerlayer"];
+function listMaterializedFiles(git, cacheRepoDir, sha) {
+  const result = git(["ls-tree", "-r", "-z", sha, "--", ...MATERIALIZED_ROOTS], { cwd: cacheRepoDir, timeoutMs: 1e4 });
+  if (!result.ok) return [];
+  const entries = [];
+  for (const raw of result.stdout.toString("utf8").split("\0")) {
+    if (!raw) continue;
+    const tabIdx = raw.indexOf("	");
+    if (tabIdx === -1) continue;
+    const meta = raw.slice(0, tabIdx).split(" ");
+    const [mode, type, objSha] = meta;
+    const path = raw.slice(tabIdx + 1);
+    if (mode === void 0 || objSha === void 0 || path === void 0) continue;
+    if (mode === "120000") continue;
+    if (type !== "blob") continue;
+    if (path.includes("..") || isAbsolute(path)) continue;
+    entries.push({ mode, type: "blob", sha: objSha, path });
+  }
+  return entries;
+}
+function parseBatchReply(files, stdout) {
+  const parsed = [];
+  let pos = 0;
+  for (const file of files) {
+    const headerEnd = stdout.indexOf(10, pos);
+    if (headerEnd === -1) return void 0;
+    const header = stdout.subarray(pos, headerEnd).toString("utf8");
+    const parts = header.split(" ");
+    if (parts[0] !== file.sha) return void 0;
+    if (parts[1] === "missing") return void 0;
+    const size = parts[1] === "blob" && parts[2] !== void 0 ? Number(parts[2]) : NaN;
+    if (!Number.isFinite(size) || stdout.length < headerEnd + 1 + size + 1) return void 0;
+    const contentStart = headerEnd + 1;
+    parsed.push({ path: file.path, content: stdout.subarray(contentStart, contentStart + size), mode: file.mode });
+    pos = contentStart + size + 1;
+  }
+  return parsed;
+}
+function writeFilesVerbatim(git, cacheRepoDir, files, workpieceRoot) {
+  if (files.length === 0) return { writtenPaths: [], ok: true };
+  const input = files.map((f) => f.sha).join("\n") + "\n";
+  const result = git(["cat-file", "--batch"], { cwd: cacheRepoDir, timeoutMs: 15e3, input });
+  if (!result.ok) return { writtenPaths: [], ok: false };
+  const parsed = parseBatchReply(files, result.stdout);
+  if (parsed === void 0) return { writtenPaths: [], ok: false };
+  const writtenPaths = [];
+  let anySkipped = false;
+  for (const file of parsed) {
+    if (hasSymlinkComponent(workpieceRoot, file.path)) {
+      anySkipped = true;
+      continue;
+    }
+    const dest = join(workpieceRoot, file.path);
+    mkdirSync(dirname(dest), { recursive: true });
+    const mode = file.mode === "100755" ? 493 : 420;
+    writeFileSync(dest, file.content, { mode });
+    chmodSync(dest, mode);
+    writtenPaths.push(file.path);
+  }
+  return { writtenPaths, ok: !anySkipped };
+}
+
+export { defaultGitRunner, isStagingWriteFault, lookupGoverningSource, materializeContext, parseOwnerRepo, resolveGitCommonDir };

package/dist/{chunk-NNRTPG7X.js → chunk-5GHGAF6P.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-NWQTTSBB.js';
-import { CaptureDaemon } from './chunk-JXYVA45C.js';
-import { parseWorkItemEnv } from './chunk-GQD22KKN.js';
-import { spoolDir } from './chunk-BWQ66M6N.js';
+import { LiveUploader } from './chunk-7SJPQWBM.js';
+import { spoolDir } from './chunk-NFIR3GEE.js';
+import { CaptureDaemon } from './chunk-QNLX477Q.js';
+import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, writeFileSync, rmSync } from 'fs';
 import { join } from 'path';