@outerlayer/cli 0.17.0 → 0.19.0

package/dist/{chunk-NWQTTSBB.js → chunk-7SJPQWBM.js}

@@ -1,23 +1,25 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LaunchFilter } from './chunk-HHJDN6AU.js';
+import { uploadSpooledSteps } from './chunk-KYS3TQAG.js';
+import { LaunchFilter } from './chunk-ESVW4MJY.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
+import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-G3IJ3N6F.js';
+import { writeSyncStatus, spoolDir } from './chunk-NFIR3GEE.js';
 import { hookExecSpoolPath } from './chunk-F7CU5ABH.js';
 import { applyReportedCost } from './chunk-BKO6JEZI.js';
-import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-WUYTWNMA.js';
-import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-JXYVA45C.js';
-import { C } from './chunk-YRYMNBGQ.js';
-import { readLaunchSpoolState, launchStatusIsDecisive, launchedItemsBySession, launchesPath } from './chunk-GQD22KKN.js';
+import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-QNLX477Q.js';
+import { C } from './chunk-ANPNT6PM.js';
+import { readLaunchSpoolState, launchStatusIsDecisive, launchedItemsBySession, launchesPath } from './chunk-T2Q7ISPE.js';
+import { defaultFetch } from './chunk-FVMYKL6L.js';
+import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-NTRCK4NH.js';
 import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
-import { defaultFetch } from './chunk-YO4PSLVB.js';
-import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-PLMTLGYH.js';
-import { CAPTURE_TIERS, inferArtifactKind, bannedPathsForTier, downconvertSession, isHumanUserTurn, turnCountBound, EVENT_TYPES } from './chunk-J5M7BSJQ.js';
-import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-EABW6AJQ.js';
-import { signerFor, signRunnerRequest } from './chunk-V7NIVOFD.js';
-import { writeSyncStatus, spoolDir } from './chunk-BWQ66M6N.js';
-import { removeJournalHooks } from './chunk-XCCLFVXM.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
+import { CAPTURE_TIERS, inferArtifactKind, bannedPathsForTier, downconvertSession, isHumanUserTurn, turnCountBound, EVENT_TYPES } from './chunk-7VUK5RFS.js';
+import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-EABW6AJQ.js';
+import { cliInvocation } from './chunk-CRB3POP4.js';
+import { removeJournalHooks } from './chunk-TUSYOL2O.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
+import { signerFor, signRunnerRequest } from './chunk-M2ZWWTWZ.js';
 import { dirname, basename, join } from 'path';
 import { statSync, readFileSync, readdirSync, mkdirSync, writeFileSync, renameSync, existsSync, rmSync } from 'fs';
 import { execFileSync } from 'child_process';
@@ -668,7 +670,7 @@ var LiveUploader = class {
       const credential = this.env.OUTERLAYER_API_KEY;
       const appId = this.env.OUTERLAYER_APP_ID;
       if (!url || !credential || !appId) {
-        this.warnOnce("incomplete", `live upload is idle: this build's environment lacks ${[!url && "OUTERLAYER_URL", !credential && "OUTERLAYER_API_KEY", !appId && "OUTERLAYER_APP_ID"].filter(Boolean).join(", ")}, so nothing streams until \`outerlayer sync\` runs.
+        this.warnOnce("incomplete", `live upload is idle: this build's environment lacks ${[!url && "OUTERLAYER_URL", !credential && "OUTERLAYER_API_KEY", !appId && "OUTERLAYER_APP_ID"].filter(Boolean).join(", ")}, so nothing streams until \`${cliInvocation()} sync\` runs.
 `);
         return false;
       }
@@ -724,7 +726,7 @@ var LiveUploader = class {
         this.stopped = true;
         this.onUnauthorized?.();
         this.stderr(
-          destination.credential.startsWith("olu_") ? `live upload stopped: the login was refused (expired or revoked). No session streams from this daemon until you run \`outerlayer login\` and it restarts.
+          destination.credential.startsWith("olu_") ? `live upload stopped: the login was refused (expired or revoked). No session streams from this daemon until you run \`${cliInvocation()} login\` and it restarts.
 ` : `live upload stopped: the API key was refused. No session streams from this daemon until it restarts with a valid key.
 `
         );
@@ -739,7 +741,7 @@ var LiveUploader = class {
           lastError: reason,
           updatedAt: (/* @__PURE__ */ new Date()).toISOString()
         });
-        this.stderr(`live upload stopped for session ${prepared.id}: ${reason}. The next \`outerlayer sync\` uploads it whole.
+        this.stderr(`live upload stopped for session ${prepared.id}: ${reason}. The next \`${cliInvocation()} sync\` uploads it whole.
 `);
         return true;
       }
@@ -1439,7 +1441,7 @@ async function runSyncInner(opts, stats) {
       if (opts.quiet || shippedBatches === 0) return;
       process.stderr.write(
         `
-${C.yellow}!${C.reset} progress saved: ${synced} session(s) in ${shippedBatches}/${batches.length} batch(es) shipped before the failure \u2014 re-run ${C.dim}outerlayer sync${C.reset} to resume from there.
+${C.yellow}!${C.reset} progress saved: ${synced} session(s) in ${shippedBatches}/${batches.length} batch(es) shipped before the failure \u2014 re-run ${C.dim}${cliInvocation()} sync${C.reset} to resume from there.
 `
       );
     };
@@ -1796,6 +1798,29 @@ ${C.yellow}!${C.reset} batch ${shippedBatches + 1}/${batches.length} accounting
       }
     }
     releaseArtifactLock();
+    const stepPass = await uploadSpooledSteps({
+      home,
+      url,
+      apiKey,
+      appId,
+      kind: resolved.kind,
+      onlyItem: itemScope?.item,
+      fetchImpl,
+      quiet: opts.quiet,
+      lockWaitMs: opts.artifactLockWaitMs
+    });
+    if (stepPass !== void 0) {
+      if (stepPass.uploaded > 0) stats.contacted = true;
+      if (!opts.quiet) {
+        process.stderr.write(
+          `${C.dim}steps${C.reset} ${stepPass.uploaded} uploaded \xB7 ${stepPass.pending} queued \xB7 ${stepPass.dropped} dropped
+`
+        );
+      }
+      if (stepPass.unauthorized !== void 0) {
+        throw new SyncTransportError(stepPass.unauthorized, 401);
+      }
+    }
     if (shippedBatches === batches.length && (opts.url || opts.apiKey || opts.appId)) {
       if (isLoopbackUrl(url)) {
         if (!opts.quiet) {

package/dist/{chunk-J5M7BSJQ.js → chunk-7VUK5RFS.js}

@@ -21728,12 +21728,13 @@ var UsageSchema = external_exports.looseObject({
    * open string: the provider adds tiers over time. Absent means standard. */
   speed: external_exports.string().min(1).max(SPEED_MAX_LENGTH).optional()
 });
-var INPUT_BAND_BOUNDARIES = [128e3, 2e5, 256e3, 272e3, 512e3];
+var INPUT_BAND_BOUNDARIES = [1e5, 128e3, 2e5, 256e3, 272e3, 512e3];
 function inputBandOf(totalInput) {
   let band = 0;
   for (const boundary of INPUT_BAND_BOUNDARIES) if (totalInput >= boundary) band = boundary;
   return band;
 }
+var BAND_BOUNDARIES_MAX = 64;
 var TOKEN_BUCKETS_MAX = 1024;
 var TokenBucketSchema = external_exports.looseObject({
   model: external_exports.string().min(1).max(BUCKET_MODEL_MAX_LENGTH),
@@ -21950,7 +21951,12 @@ var AgentSessionSchema = external_exports.looseObject({
     /** Token counts so far, per model, speed and input band. On a chunk part
      * or a streamed piece these cover the whole session so far, never just
      * the turns that payload carries. Absent from older writers. */
-    buckets: external_exports.array(TokenBucketSchema).max(TOKEN_BUCKETS_MAX).optional()
+    buckets: external_exports.array(TokenBucketSchema).max(TOKEN_BUCKETS_MAX).optional(),
+    /** The input band boundaries `buckets` were grouped by. A price tier whose
+     * threshold falls inside one of these bands cannot be applied from the
+     * buckets alone. Absent from older writers, which used
+     * {@link UNRECORDED_INPUT_BAND_BOUNDARIES}. */
+    bandBoundaries: external_exports.array(count).max(BAND_BOUNDARIES_MAX).optional()
   }),
   /** Filled natively (`pr-link` lines, `git commit` tool results) or by later
    * joins. A session can link MANY pull requests (stacked PRs, long-lived seat
@@ -22273,7 +22279,7 @@ var ArtifactTombstoneRecordSchema = external_exports.looseObject({
 });
 external_exports.union([ArtifactSpoolRecordSchema, ArtifactTombstoneRecordSchema]);
 var EMITTED_RESULTS = ["pass", "fail"];
-var RESERVED_EMIT_NAMES = ["artifact", "criteria", "finding", "findings"];
+var RESERVED_EMIT_NAMES = ["artifact", "criteria", "finding", "findings", "step"];
 var EmittedNameSchema = external_exports.string().regex(/^[a-z][a-z0-9._-]{0,63}$/).superRefine((name, ctx) => {
   if (RESERVED_EMIT_NAMES.includes(name)) {
     ctx.addIssue({
@@ -22318,6 +22324,19 @@ external_exports.object({
   item: external_exports.object({ number: external_exports.number().int().positive() }).optional(),
   sessionId: external_exports.string().optional()
 }).superRefine((request, ctx) => refuseDuplicateIds(request.criteria, ctx));
+var STEP_NAME_MAX = 80;
+var CONTROL_CHARACTER = /[\u0000-\u001f\u007f-\u009f\u2028\u2029]/;
+var StepNameSchema = external_exports.string().trim().min(1, "name must not be empty").max(STEP_NAME_MAX, `name must be at most ${STEP_NAME_MAX} characters`).refine((name) => !CONTROL_CHARACTER.test(name), {
+  message: "name must be one line, with no line break or control character"
+});
+var StepBodySchema = external_exports.object({
+  /** Minted by the CLI once per step; the same id on the same item is the same step. */
+  clientStepId: external_exports.string().uuid(),
+  name: StepNameSchema,
+  item: external_exports.object({ number: external_exports.number().int().positive() }),
+  /** When the agent started the step. The gateway clamps it to the receive time. */
+  startedAt: external_exports.string().datetime({ offset: true })
+});
 var FINDING_CATEGORIES = ["context", "flaky-test", "tooling", "environment", "defect", "other"];
 var FINDING_RULE_RELATIONS = ["wrong", "broken", "missing"];
 var FINDING_ID_MAX_LENGTH = 64;
@@ -22525,4 +22544,4 @@ xmlchars/xmlns/1.0/ed3.js:
    *)
 */
 
-export { ARTIFACT_KINDS, ARTIFACT_MAX_CAPTION_LENGTH, ARTIFACT_MAX_FILENAME_LENGTH, ARTIFACT_MAX_REPLACES_TARGETS, ArtifactCriterionIdSchema, ArtifactSpoolRecordSchema, ArtifactTombstoneRecordSchema, BUCKET_MODEL_MAX_LENGTH, CAPTURE_TIERS, CriteriaListSchema, EMITTED_RESULTS, EMITTED_RESULT_MAX_BODY_LENGTH, EMITTED_RESULT_MAX_LINK_LENGTH, EVENT_TYPES, EmittedNameSchema, FindingBatchSchema, FindingsResponseSchema, RESERVED_EMIT_NAMES, SAME_PROBLEM_RULES, SCHEMA_VERSION, SPEED_MAX_LENGTH, bannedPathsForTier, bindTests, downconvertSession, inferArtifactKind, inputBandOf, isHumanUserTurn, mediaTypeForArtifactPath, parseAgentSession, parseJunit, parseTestSelector, turnCountBound };
+export { ARTIFACT_KINDS, ARTIFACT_MAX_CAPTION_LENGTH, ARTIFACT_MAX_FILENAME_LENGTH, ARTIFACT_MAX_REPLACES_TARGETS, ArtifactCriterionIdSchema, ArtifactSpoolRecordSchema, ArtifactTombstoneRecordSchema, BUCKET_MODEL_MAX_LENGTH, CAPTURE_TIERS, CriteriaListSchema, EMITTED_RESULTS, EMITTED_RESULT_MAX_BODY_LENGTH, EMITTED_RESULT_MAX_LINK_LENGTH, EVENT_TYPES, EmittedNameSchema, FindingBatchSchema, FindingsResponseSchema, INPUT_BAND_BOUNDARIES, RESERVED_EMIT_NAMES, SAME_PROBLEM_RULES, SCHEMA_VERSION, SPEED_MAX_LENGTH, StepBodySchema, StepNameSchema, bannedPathsForTier, bindTests, downconvertSession, inferArtifactKind, inputBandOf, isHumanUserTurn, mediaTypeForArtifactPath, parseAgentSession, parseJunit, parseTestSelector, turnCountBound };

package/dist/{chunk-OZGHL5Y5.js → chunk-7YP7T6GV.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_UNIT_NAME } from './chunk-RLYZLUQ7.js';
+import { DEFAULT_UNIT_NAME } from './chunk-QEFKA2QD.js';
 import { parseRunnerEnv } from './chunk-6MZSX4M7.js';
-import { RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
+import { RUNNER_FILE_MODE } from './chunk-N2PXGQRL.js';
 import { existsSync, readFileSync, writeFileSync, renameSync, rmSync } from 'fs';
 import { join, dirname } from 'path';
 

package/dist/{chunk-TI7B7UEO.js → chunk-AMFWYESY.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
+import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-N2PXGQRL.js';
 import { readlinkSync, realpathSync, mkdirSync, unlinkSync, symlinkSync, renameSync, readFileSync, writeFileSync, rmSync, existsSync, readdirSync } from 'fs';
 import { join, basename, sep, resolve } from 'path';
 

package/dist/{chunk-YRYMNBGQ.js → chunk-ANPNT6PM.js}

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
+import { cliInvocation } from './chunk-CRB3POP4.js';
 
 createRequire(import.meta.url);
 
@@ -49,6 +50,6 @@ function warnDeprecated(message) {
   process.stderr.write(`${C.yellow}!${C.reset} ${message}
 `);
 }
-var API_KEY_FLAG_DEPRECATION = "--api-key is deprecated: a key on the command line lands in shell history and process lists. Run `outerlayer login` once, or set OUTERLAYER_API_KEY.";
+var API_KEY_FLAG_DEPRECATION = `--api-key is deprecated: a key on the command line lands in shell history and process lists. Run \`${cliInvocation()} login\` once, or set OUTERLAYER_API_KEY.`;
 
 export { API_KEY_FLAG_DEPRECATION, C, NO_COLOR_FLAG, stripNoColor, warnDeprecated };

package/dist/{chunk-4KSQKQXE.js → chunk-BM63HB2M.js}

@@ -1,9 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { revokeTokenOnDashboard } from './chunk-N6LURUEF.js';
-import { C } from './chunk-YRYMNBGQ.js';
-import { readCloudConfig, writeCloudConfig, cloudConfigPath } from './chunk-EABW6AJQ.js';
+import { revokeTokenOnDashboard } from './chunk-GOSFARMS.js';
+import { C } from './chunk-ANPNT6PM.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
+import { readCloudConfig, writeCloudConfig, cloudConfigPath } from './chunk-EABW6AJQ.js';
+import { cliInvocation } from './chunk-CRB3POP4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { generateKeyPairSync, privateDecrypt, constants, createPrivateKey } from 'crypto';
 import { spawn } from 'child_process';
@@ -18,7 +19,7 @@ var LoginError = class extends Error {
 };
 function runLogin(opts) {
   const apiKey = opts.apiKey.trim();
-  if (apiKey.length === 0) throw new LoginError("no API key given \u2014 pipe it on stdin, or run outerlayer login with no key on stdin to sign in by browser");
+  if (apiKey.length === 0) throw new LoginError(`no API key given \u2014 pipe it on stdin, or run ${cliInvocation()} login with no key on stdin to sign in by browser`);
   if (/\s/.test(apiKey)) throw new LoginError("the API key must be a single token with no spaces or line breaks");
   const url = opts.url?.trim() || void 0;
   const appId = opts.appId?.trim() || void 0;
@@ -229,7 +230,7 @@ function decryptToken(privateKeyPem, encryptedToken) {
       Buffer.from(encryptedToken, "base64")
     ).toString("utf8");
   } catch {
-    throw new LoginError("could not decrypt the token the dashboard sent; run outerlayer login again");
+    throw new LoginError(`could not decrypt the token the dashboard sent; run ${cliInvocation()} login again`);
   }
 }
 function normalizeDashboard(raw) {
@@ -246,7 +247,7 @@ function approveLink(dashboard, code) {
   return `${dashboard}/cli/login?code=${encodeURIComponent(code)}`;
 }
 function waitingDocument(link, code, id) {
-  return JSON.stringify({ status: "waiting", url: link, code, check: `outerlayer login --check ${id}` }) + "\n";
+  return JSON.stringify({ status: "waiting", url: link, code, check: `${cliInvocation()} login --check ${id}` }) + "\n";
 }
 async function finishApproved(flags, deps, home, dashboard, approved, privateKeyPem) {
   const accountToken = decryptToken(privateKeyPem, approved.encryptedToken);
@@ -257,7 +258,7 @@ async function finishApproved(flags, deps, home, dashboard, approved, privateKey
     const revoked = await revokeTokenOnDashboard(deps.fetchImpl, dashboard, accountToken);
     return fail(
       deps,
-      `could not save the login: ${err instanceof Error ? err.message : String(err)}. ` + (revoked === "revoked" ? "The token was revoked; run outerlayer login again." : "The token could not be revoked; revoke it on the CLI logins list at /profile/security.")
+      `could not save the login: ${err instanceof Error ? err.message : String(err)}. ` + (revoked === "revoked" ? `The token was revoked; run ${cliInvocation()} login again.` : "The token could not be revoked; revoke it on the CLI logins list at /profile/security.")
     );
   }
   if (before.accountToken && before.accountToken !== accountToken) {
@@ -279,9 +280,12 @@ async function finishApproved(flags, deps, home, dashboard, approved, privateKey
 }
 function nextAfterLogin(cwd) {
   const dirs = findGitDirs(cwd);
-  if (dirs === void 0) return "Next: in your repository, run `outerlayer init --factory <org>/<factory>`.\n";
-  if (existsSync(join(dirs.repoRoot, ".outerlayer"))) return "Next: run `outerlayer connect` to choose a factory.\n";
-  return "Next: run `outerlayer init --factory <org>/<factory>` to set up this repository.\n";
+  if (dirs === void 0) return `Next: in your repository, run \`${cliInvocation()} init --factory <org>/<factory>\`.
+`;
+  if (existsSync(join(dirs.repoRoot, ".outerlayer"))) return `Next: run \`${cliInvocation()} connect\` to choose a factory.
+`;
+  return `Next: run \`${cliInvocation()} init --factory <org>/<factory>\` to set up this repository.
+`;
 }
 function fail(deps, message) {
   deps.stderr.write(`${C.red}\u2717${C.reset} ${message}
@@ -301,10 +305,10 @@ async function runPastedKey(flags, deps, key, home) {
 }
 async function runCheck(flags, deps, home, id) {
   const pending = readPending(home, id);
-  if (!pending) return fail(deps, `no pending login ${id}; run outerlayer login to start one`);
+  if (!pending) return fail(deps, `no pending login ${id}; run ${cliInvocation()} login to start one`);
   if (Date.parse(pending.expires_at) <= deps.now().getTime()) {
     deletePending(home, id);
-    return fail(deps, "the login link expired; run outerlayer login again");
+    return fail(deps, `the login link expired; run ${cliInvocation()} login again`);
   }
   const result = await pollLogin(deps, pending.dashboard, pending.id);
   switch (result.kind) {
@@ -317,7 +321,7 @@ async function runCheck(flags, deps, home, id) {
       return fail(deps, "the login was denied");
     case "expired":
       deletePending(home, id);
-      return fail(deps, "the login link expired; run outerlayer login again");
+      return fail(deps, `the login link expired; run ${cliInvocation()} login again`);
     case "unavailable":
       deps.stderr.write(`could not check the login yet: ${result.message}
 `);
@@ -376,7 +380,7 @@ Waiting for approval...
       case "denied":
         return fail(deps, "the login was denied");
       case "expired":
-        return fail(deps, "the login link expired; run outerlayer login again");
+        return fail(deps, `the login link expired; run ${cliInvocation()} login again`);
       case "unavailable":
       case "error":
         failures += 1;
@@ -392,7 +396,7 @@ Waiting for approval...
     }
     const untilExpiryMs = Math.max(0, expiresAt - deps.now().getTime());
     await deps.sleep(Math.min(waitS * 1e3, untilExpiryMs));
-    if (deps.now().getTime() >= expiresAt) return fail(deps, "the login link expired; run outerlayer login again");
+    if (deps.now().getTime() >= expiresAt) return fail(deps, `the login link expired; run ${cliInvocation()} login again`);
   }
 }
 async function runLoginCommand(flags, deps) {
@@ -414,7 +418,7 @@ async function runLoginCommand(flags, deps) {
       return EXIT_USAGE;
     }
     if (flags.noInput) {
-      return fail(deps, 'no API key on stdin and --no-input forbids prompting \u2014 pipe the key: echo "$KEY" | outerlayer login');
+      return fail(deps, `no API key on stdin and --no-input forbids prompting \u2014 pipe the key: echo "$KEY" | ${cliInvocation()} login`);
     }
     purgeExpiredPending(home, deps.now());
     return await runBrowserLogin(flags, deps, home);

package/dist/{chunk-4Q7OMKAT.js → chunk-BQXFBI7T.js}

@@ -1,6 +1,5 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { authorEnvironment, withHooksPath } from './chunk-BYT5O5RV.js';
 import { existsSync, unlinkSync, chmodSync } from 'fs';
 import { request as request$1, createServer } from 'http';
 import { request } from 'https';
@@ -345,6 +344,61 @@ async function startBuildServices(input) {
   }
 }
 
+// src/runner/commit-identity.ts
+var NOREPLY_SUFFIX = "@users.noreply.github.com";
+var MAX_LENGTH = 200;
+function parseIdentity(value) {
+  if (typeof value !== "object" || value === null) return void 0;
+  const { name, email } = value;
+  if (typeof name !== "string" || typeof email !== "string") return void 0;
+  if (name.trim() === "" || name.length > MAX_LENGTH || /[\r\n\0<>]/.test(name)) return void 0;
+  if (email.length > MAX_LENGTH || !email.endsWith(NOREPLY_SUFFIX) || /[\s\0<>]/.test(email) || email.length === NOREPLY_SUFFIX.length) return void 0;
+  return { name, email };
+}
+function parseClaimIdentity(data) {
+  const author = parseIdentity(data.commitAuthor);
+  if (author === void 0) return void 0;
+  const coAuthor = parseIdentity(data.coAuthor);
+  return coAuthor === void 0 ? { author } : { author, coAuthor };
+}
+function authorEnvironment(identity) {
+  if (identity === void 0) return {};
+  return {
+    GIT_AUTHOR_NAME: identity.name,
+    GIT_AUTHOR_EMAIL: identity.email,
+    GIT_COMMITTER_NAME: identity.name,
+    GIT_COMMITTER_EMAIL: identity.email
+  };
+}
+function configCount(env) {
+  const raw = String(env.GIT_CONFIG_COUNT);
+  return /^[0-9]+$/.test(raw) ? Number(raw) : 0;
+}
+function withGitConfig(env, key, value) {
+  const at = configCount(env);
+  return {
+    ...env,
+    GIT_CONFIG_COUNT: String(at + 1),
+    [`GIT_CONFIG_KEY_${at}`]: key,
+    [`GIT_CONFIG_VALUE_${at}`]: value
+  };
+}
+function tokenHeader(token) {
+  return `Authorization: Basic ${Buffer.from(`x-access-token:${token}`).toString("base64")}`;
+}
+function withTokenHeader(env, url, token) {
+  return withGitConfig(env, `http.${url}.extraHeader`, tokenHeader(token));
+}
+function withHooksPath(env, dir) {
+  return withGitConfig(env, "core.hooksPath", dir);
+}
+function commitIdentityRecord(identity) {
+  return {
+    author: identity === void 0 ? "host" : "app",
+    coAuthor: identity?.coAuthor !== void 0 && identity.hooksPath !== void 0 ? "credited" : "none"
+  };
+}
+
 // src/runner/repositories.ts
 function parseClaimedRepositories(value) {
   if (!Array.isArray(value) || value.length === 0) return void 0;
@@ -372,10 +426,19 @@ function primaryOf(repositories) {
 var RELAY_PORT = 3128;
 var JOB_MOUNT = "/outerlayer/job";
 var EVAL_INPUT_DIR = `${JOB_MOUNT}/eval-input`;
+var BUILD_HOME = "/build/home";
 var CHECKOUT_DIR = "/build/work/checkout";
 var REPOS_DIR = "/build/work/repos";
 function checkoutPath(entry) {
-  return entry.primary ? CHECKOUT_DIR : `${REPOS_DIR}/${entry.repository}`;
+  return entry.primary ? CHECKOUT_DIR : repositoryPath(entry.repository);
+}
+function repositoryPath(repository) {
+  return `${REPOS_DIR}/${repository.toLowerCase()}`;
+}
+function lifecycleWorkdir(repositories, governingRepository) {
+  const governing = governingRepository?.toLowerCase();
+  const entry = governing === void 0 ? void 0 : repositories.find((candidate) => candidate.repository.toLowerCase() === governing);
+  return entry === void 0 ? CHECKOUT_DIR : checkoutPath(entry);
 }
 var MAX_HOSTS = 200;
 function tokenVariables() {
@@ -404,10 +467,16 @@ function proxyEnvironment(proxyUrl, alsoNoProxy) {
     YARN_HTTP_PROXY: proxyUrl
   };
 }
+var PROXY_WARNING_FLAG = "--disable-warning=UNDICI-EHPA";
+function withProxyWarningHidden(options) {
+  const given = options?.trim() ?? "";
+  if (given.split(/\s+/).includes(PROXY_WARNING_FLAG)) return given;
+  return given === "" ? PROXY_WARNING_FLAG : `${given} ${PROXY_WARNING_FLAG}`;
+}
 function runnerLiterals(repository, repositories = []) {
   return {
     OUTERLAYER_JOB_DIR: JOB_MOUNT,
-    HOME: "/build/home",
+    HOME: BUILD_HOME,
     TMPDIR: "/tmp",
     ...proxyEnvironment(PROXY_URL),
     GIT_TERMINAL_PROMPT: "0",
@@ -466,6 +535,11 @@ function buildEnvironment(input) {
     passed[name] = value;
     variables.push(name);
   }
+  const nodeOptions = {};
+  if (input.imageEnv !== void 0) {
+    if (passed.NODE_OPTIONS !== void 0) passed.NODE_OPTIONS = withProxyWarningHidden(passed.NODE_OPTIONS);
+    else nodeOptions.NODE_OPTIONS = withProxyWarningHidden(recipe.NODE_OPTIONS ?? input.imageEnv.NODE_OPTIONS);
+  }
   const destinations = destinationEnvironment(input.config.build?.destinations, containerLocalAddress);
   const builtInLiterals = builtIns ? builtInEnvironment(containerBuiltInAddress, claudeCredential(input.hostEnv)) : {};
   const hooksPath = input.identity?.hooksPath;
@@ -483,6 +557,7 @@ function buildEnvironment(input) {
   return {
     literals: {
       ...recipe,
+      ...nodeOptions,
       ...destinations,
       ...runnerLiterals(input.repository, repositoriesOf({ repositories: input.repositories, repository: input.repository, branch: input.branch })),
       ...builtInLiterals,
@@ -502,7 +577,8 @@ function checkEnvironment(input) {
     repository: input.repository,
     hostEnv: input.hostEnv,
     containerEnv: input.containerEnv,
-    builtIns: false
+    builtIns: false,
+    imageEnv: input.imageEnv
   });
   const withheld = /* @__PURE__ */ new Set(["OUTERLAYER_URL", "OUTERLAYER_API_KEY", ...CLAUDE_CREDENTIAL_VARIABLES]);
   const literals = { OUTERLAYER_EVAL_INPUT: EVAL_INPUT_DIR };
@@ -544,4 +620,4 @@ function withTunnelRecord(environment, record, onlyWhenUsed = false) {
   };
 }
 
-export { AGENT_CREDENTIAL_MISSING, BUILT_IN_NAMES, CHECKOUT_DIR, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, EVAL_INPUT_DIR, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, RELAY_PORT, buildEnvironment, builtInEnvironment, checkEnvironment, checkoutPath, claudeCredential, containerLocalAddress, destinationEnvironment, headerVariables, isRefusedInConfig, isReservedVariable, parseClaimedRepositories, parseIsolation, primaryOf, proxyEnvironment, repositoriesOf, resolveDestinations, sharedUserEnvironment, startBuildServices, withTunnelRecord };
+export { AGENT_CREDENTIAL_MISSING, BUILD_HOME, BUILT_IN_NAMES, CHECKOUT_DIR, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, EVAL_INPUT_DIR, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, RELAY_PORT, authorEnvironment, buildEnvironment, builtInEnvironment, checkEnvironment, checkoutPath, claudeCredential, commitIdentityRecord, containerLocalAddress, destinationEnvironment, headerVariables, isRefusedInConfig, isReservedVariable, lifecycleWorkdir, parseClaimIdentity, parseClaimedRepositories, parseIsolation, primaryOf, proxyEnvironment, repositoriesOf, repositoryPath, resolveDestinations, sharedUserEnvironment, startBuildServices, tokenHeader, withGitConfig, withHooksPath, withProxyWarningHidden, withTokenHeader, withTunnelRecord };

package/dist/{chunk-ADJRGVZC.js → chunk-BWSUPRDK.js}

@@ -4,6 +4,6 @@ import { createRequire } from 'node:module';
 createRequire(import.meta.url);
 
 // src/runner/protocol.ts
-var RUNNER_PROTOCOL = 17;
+var RUNNER_PROTOCOL = 20;
 
 export { RUNNER_PROTOCOL };

package/dist/{chunk-3NSNIIBE.js → chunk-CG36IONK.js}

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { sanitizeTerminal } from './chunk-WUYTWNMA.js';
-import { remoteLookupFailed } from './chunk-JXYVA45C.js';
-import { DEFAULT_DASHBOARD } from './chunk-4KSQKQXE.js';
-import { resolveGatewayCredentials } from './chunk-PLMTLGYH.js';
-import { readCloudConfig } from './chunk-EABW6AJQ.js';
+import { sanitizeTerminal } from './chunk-G3IJ3N6F.js';
+import { DEFAULT_DASHBOARD } from './chunk-BM63HB2M.js';
+import { remoteLookupFailed } from './chunk-QNLX477Q.js';
+import { resolveGatewayCredentials } from './chunk-NTRCK4NH.js';
 import { writeRepoConnection, findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
+import { readCloudConfig } from './chunk-EABW6AJQ.js';
+import { cliInvocation } from './chunk-CRB3POP4.js';
 import { execFileSync } from 'child_process';
 import { createInterface } from 'readline/promises';
 
@@ -53,7 +54,7 @@ function notLinkedText(factoryName, repository, url) {
 Link it on the factory's Work page: ${url}
   1. Connect GitHub repository, and grant the App access to ${name}.
   2. Link repository, and pick ${name} and its default branch.
-Then run \`outerlayer connect\` again.
+Then run \`${cliInvocation()} connect\` again.
 `;
 }
 
@@ -151,7 +152,7 @@ async function fetchFactories(fetchImpl, url, token, repository) {
     return { ok: false, result: result(1, "failed", message, message) };
   }
   if (res.status === 401) {
-    const message = "the gateway refused the login. Run `outerlayer login` to sign in again.";
+    const message = `the gateway refused the login. Run \`${cliInvocation()} login\` to sign in again.`;
     return { ok: false, result: result(1, "failed", message, message) };
   }
   if (!res.ok) {
@@ -160,7 +161,7 @@ async function fetchFactories(fetchImpl, url, token, repository) {
   }
   const factories = parseFactories(await res.json().catch(() => null));
   if (factories === void 0) {
-    const message = `${url} answered, but the reply is not a list of factories. Check the gateway address with \`outerlayer doctor\`, then run \`outerlayer connect\` again.`;
+    const message = `${url} answered, but the reply is not a list of factories. Check the gateway address with \`${cliInvocation()} doctor\`, then run \`${cliInvocation()} connect\` again.`;
     return { ok: false, result: result(1, "failed", `${url} did not answer with a factory list`, message) };
   }
   return { ok: true, factories };
@@ -205,7 +206,7 @@ ${listText(factories, repository)}`;
   if (!deps.isTerminal) {
     const why = linked.length > 1 ? `${repository} is linked to more than one factory you can use` : `you can use more than one factory, and none is the only one ${repository} is linked to`;
     const message = `${why}, and there is no terminal to ask on.
-Run \`outerlayer connect --factory <org>/<factory>\` with one of:
+Run \`${cliInvocation()} connect --factory <org>/<factory>\` with one of:
 ${listText(factories, repository)}`;
     return result(1, "failed", "more than one factory fits; pass --factory", message);
   }
@@ -226,18 +227,18 @@ ${listText(factories, repository)}`;
     }))
   });
   const factory = pool.find((f) => f.id === picked);
-  if (!factory) return result(1, "failed", "no factory was chosen", "no factory was chosen. Run `outerlayer connect` again, or pass --factory <org>/<factory>.");
+  if (!factory) return result(1, "failed", "no factory was chosen", `no factory was chosen. Run \`${cliInvocation()} connect\` again, or pass --factory <org>/<factory>.`);
   return { factory, reason: "prompt" };
 }
 async function runConnect(flags, deps) {
   const creds = resolveGatewayCredentials({ home: deps.home, env: deps.env, cwd: deps.cwd });
   if (creds.credential === void 0) {
-    const message = "no saved credential. Run `outerlayer login` to sign in, then run `outerlayer connect` again.";
-    return { ...result(1, "skipped", "no credential; run `outerlayer login` first", message), next: "Run `outerlayer login`, then `outerlayer init` again." };
+    const message = `no saved credential. Run \`${cliInvocation()} login\` to sign in, then run \`${cliInvocation()} connect\` again.`;
+    return { ...result(1, "skipped", `no credential; run \`${cliInvocation()} login\` first`, message), next: `Run \`${cliInvocation()} login\`, then \`${cliInvocation()} init\` again.` };
   }
   if (creds.kind === "key") {
     if (flags.factory !== void 0 && flags.factory !== creds.appId) {
-      const message2 = `a factory key decides the factory${creds.appId ? ` (${creds.appId})` : ""}, so --factory ${flags.factory} cannot apply. Remove --factory, or sign in with \`outerlayer login\` and unset the key.`;
+      const message2 = `a factory key decides the factory${creds.appId ? ` (${creds.appId})` : ""}, so --factory ${flags.factory} cannot apply. Remove --factory, or sign in with \`${cliInvocation()} login\` and unset the key.`;
       return result(1, "failed", "--factory names a factory other than the key's", message2);
     }
     const message = `Your factory key decides the factory${creds.appId ? ` (${creds.appId})` : ""}, so there is nothing to connect. No file was changed.`;
@@ -248,14 +249,14 @@ async function runConnect(flags, deps) {
   }
   const repository = deps.resolveRepository(deps.cwd);
   if (repository === void 0 && remoteLookupFailed(deps.cwd)) {
-    const message = "git did not answer when asked for this repository's remote, so connect cannot tell which repository it is. Run `git remote -v` here, then run `outerlayer connect` again.";
+    const message = `git did not answer when asked for this repository's remote, so connect cannot tell which repository it is. Run \`git remote -v\` here, then run \`${cliInvocation()} connect\` again.`;
     return result(1, "failed", "git could not read this repository's remote", message);
   }
   if (repository === void 0) {
-    return result(1, "skipped", "this repository has no git remote", "this repository has no git remote, so connect cannot tell which repository it is. Add one (`git remote add origin <url>`), then run `outerlayer connect` again.");
+    return result(1, "skipped", "this repository has no git remote", `this repository has no git remote, so connect cannot tell which repository it is. Add one (\`git remote add origin <url>\`), then run \`${cliInvocation()} connect\` again.`);
   }
   if (creds.url === void 0) {
-    const message = "no gateway address is saved. Run `outerlayer login` to sign in.";
+    const message = `no gateway address is saved. Run \`${cliInvocation()} login\` to sign in.`;
     return result(1, "failed", message, message);
   }
   const listed = await fetchFactories(deps.fetchImpl, creds.url, creds.credential, repository);
@@ -285,7 +286,7 @@ async function runConnect(flags, deps) {
     const linkUrl = workPageUrl(deps.home, factory.organization.name, factory.name);
     return { ...result(EXIT_NOT_LINKED, "done", why, connected + notLinkedText(factory.displayName, repository, linkUrl)), ...chosen, linked, linkUrl };
   }
-  const changeIt = "Run `outerlayer connect --factory <org>/<factory>` to change it.";
+  const changeIt = `Run \`${cliInvocation()} connect --factory <org>/<factory>\` to change it.`;
   const text = linked === null ? `${connected}Could not check whether ${sanitizeTerminal(repository)} is linked to ${factory.displayName}.
 ${changeIt}` : connected + changeIt;
   return { ...result(0, "done", why, text), ...chosen, linked };

package/dist/chunk-CJJDJ7AT.js

@@ -0,0 +1,56 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { existsSync, readFileSync, writeFileSync } from 'fs';
+import { join, basename } from 'path';
+
+createRequire(import.meta.url);
+var BEGIN = "# BEGIN outerlayer claude";
+var END = "# END outerlayer claude";
+var SHELL_FUNCTION_LINE = 'claude() { outerlayer claude "$@"; }';
+var STARTUP_FILES = { zsh: ".zshrc", bash: ".bashrc" };
+function startupFileFor(home, shellPath) {
+  const name = STARTUP_FILES[basename(shellPath ?? "")];
+  return name === void 0 ? void 0 : join(home, name);
+}
+function blockLines() {
+  return [BEGIN, "# Added by `outerlayer init`. Remove this block, or run `outerlayer init --no-shell-function`, to undo it.", SHELL_FUNCTION_LINE, END];
+}
+function find(lines) {
+  let begin = -1;
+  for (let i = 0; i < lines.length; i++) {
+    if (lines[i] === BEGIN) begin = i;
+    else if (lines[i] === END && begin >= 0) return { begin, end: i };
+  }
+  return void 0;
+}
+function installShellFunction(input) {
+  const file = startupFileFor(input.home, input.shellPath);
+  if (file === void 0) return { status: "unsupported" };
+  const text = existsSync(file) ? readFileSync(file, "utf8") : "";
+  if (find(text.split("\n")) !== void 0) return { status: "unchanged", file };
+  const endsLine = text === "" || text.endsWith("\n");
+  writeFileSync(file, `${text}${endsLine ? "" : "\n"}
+${blockLines().join("\n")}${endsLine ? "\n" : ""}`);
+  return { status: "added", file };
+}
+function removeShellFunction(input) {
+  const changed = [];
+  for (const name of Object.values(STARTUP_FILES)) {
+    const file = join(input.home, name);
+    if (!existsSync(file)) continue;
+    const lines = readFileSync(file, "utf8").split("\n");
+    const found = find(lines);
+    if (found === void 0) continue;
+    const from = found.begin > 0 && lines[found.begin - 1] === "" ? found.begin - 1 : found.begin;
+    lines.splice(from, found.end - from + 1);
+    writeFileSync(file, lines.join("\n"));
+    changed.push(file);
+  }
+  return changed;
+}
+function shellFunctionInstalled(input) {
+  const file = startupFileFor(input.home, input.shellPath);
+  return file !== void 0 && existsSync(file) && find(readFileSync(file, "utf8").split("\n")) !== void 0;
+}
+
+export { SHELL_FUNCTION_LINE, installShellFunction, removeShellFunction, shellFunctionInstalled };