@outerlayer/cli 0.18.0 → 0.19.0

package/dist/{chunk-KK4VBOH6.js → chunk-HPJNLETG.js}

@@ -1,17 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { autoConnect } from './chunk-WBT5X3NH.js';
-import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { workPageUrl } from './chunk-S76AYB4M.js';
-import { sanitizeTerminal } from './chunk-MQJSXHV7.js';
-import { resolveRepoIdentity } from './chunk-BMYGAGBJ.js';
+import { detectActiveSession, autoConnect } from './chunk-IF2OSI5T.js';
+import { workPageUrl } from './chunk-CG36IONK.js';
+import { sanitizeTerminal } from './chunk-G3IJ3N6F.js';
+import { resolveRepoIdentity } from './chunk-QNLX477Q.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
-import { defaultFetch } from './chunk-ZRL6HKBY.js';
-import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-52NC2FIU.js';
-import { signRunnerRequest } from './chunk-M2ZWWTWZ.js';
+import { defaultFetch } from './chunk-FVMYKL6L.js';
+import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-NTRCK4NH.js';
 import { readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
+import { signRunnerRequest } from './chunk-M2ZWWTWZ.js';
 
 createRequire(import.meta.url);
 
@@ -44,8 +43,8 @@ var TRACKERS = {
     scopeNoun: "project",
     connect: {
       kind: "form",
-      summary: "Read the projects you pick on a site, with a service account. One webhook is created in Jira by an admin.",
-      intro: "Uses a service account's OAuth client credential. Create one under Atlassian administration, then paste it here. Read scope only.",
+      summary: "Read the projects you pick on a site, and file specs as issues, with a service account. One webhook is created in Jira by an admin.",
+      intro: "Uses a service account's OAuth client credential. Create one under Atlassian administration, then paste it here. Give it read:jira-work, and write:jira-work to file specs. A credential's scopes are fixed when it is created.",
       notice: "After connecting, you get a webhook URL and secret to put on one webhook in Jira. That is the only manual step, and the only time the secret is shown.",
       fields: [
         { name: "siteUrl", label: "Site URL", placeholder: "https://your-team.atlassian.net" },
@@ -422,7 +421,7 @@ async function runWorkLinkSession(opts) {
     return await linkSession(opts);
   } catch (err) {
     if (opts.logFailures) {
-      const { logHookError } = await import('./hook-fast-W5MKHMJT.js');
+      const { logHookError } = await import('./hook-fast-YAZG5MDX.js');
       const reason = err instanceof Error ? err.message : String(err);
       logHookError(opts.home ?? homeFromEnv(opts.env ?? process.env), new Error(`work link-session #${opts.number} failed: ${reason}`));
     }

package/dist/{chunk-IP7BIBXJ.js → chunk-IF2OSI5T.js}

@@ -1,5 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
+import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-CG36IONK.js';
+import { resolveRepoIdentity } from './chunk-QNLX477Q.js';
+import { resolveGatewayCredentials } from './chunk-NTRCK4NH.js';
+import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
+import { cliInvocation } from './chunk-CRB3POP4.js';
+import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { openSync, fstatSync, readSync, closeSync } from 'fs';
 import { join } from 'path';
 
@@ -76,4 +82,32 @@ function transcriptPathForSession(sessionId, home, readTailImpl = readTail) {
   return found;
 }
 
-export { detectActiveSession, transcriptPathForSession };
+// src/auto-connect.ts
+async function autoConnect(opts) {
+  const env = opts.env ?? process.env;
+  const home = opts.home ?? homeFromEnv(env);
+  const cwd = opts.cwd ?? process.cwd();
+  const resolved = resolveGatewayCredentials({ url: opts.url, apiKey: opts.apiKey, appId: opts.appId, home, env, cwd });
+  if (resolved.ok || resolved.kind !== "login" || !resolved.credential || !resolved.url) return void 0;
+  const dirs = findGitDirs(cwd);
+  const repository = opts.repository ?? resolveRepoIdentity(cwd).gitRepo;
+  if (dirs === void 0 || repository === void 0) return void 0;
+  const listed = await fetchFactories(opts.fetchImpl ?? fetch, resolved.url, resolved.credential, repository);
+  if (!listed.ok || listed.factories.length === 0) return void 0;
+  const chosen = selectFactory(listed.factories, readRepoConnection(cwd), repository);
+  if (chosen.factory === void 0) {
+    return `you are logged in, but no factory is chosen for this repository, and more than one fits. Run \`${cliInvocation()} connect --factory <org>/<factory>\` with one of:
+${chosen.text}
+Or pass --app-id / set OUTERLAYER_APP_ID.`;
+  }
+  try {
+    saveFactoryConnection(dirs.gitCommonDir, void 0, chosen.factory, /* @__PURE__ */ new Date());
+  } catch {
+    return void 0;
+  }
+  process.stderr.write(`${autoConnectedLine(repository, chosen.factory, chosen.reason)}
+`);
+  return void 0;
+}
+
+export { autoConnect, detectActiveSession, transcriptPathForSession };

package/dist/{chunk-T4Y6SCG3.js → chunk-IXYZUUYQ.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { skillDir, FORMER_MAINTAINED_NAMES, isMaintainedCopy } from './chunk-MNTSH4CL.js';
-import { emitTree, ALL_TARGET_IDS, classifyTree } from './chunk-X5N6KC6V.js';
+import { skillDir, FORMER_MAINTAINED_NAMES, isMaintainedCopy } from './chunk-NNLA7LLQ.js';
+import { emitTree, ALL_TARGET_IDS, classifyTree } from './chunk-WFSUUUAN.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { readFileSync, existsSync, unlinkSync, rmdirSync, readdirSync } from 'fs';
 import { join, dirname, relative, sep } from 'path';

package/dist/chunk-KYS3TQAG.js

@@ -0,0 +1,296 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
+import { autoConnect, detectActiveSession } from './chunk-IF2OSI5T.js';
+import { acquireSpoolLockAt } from './chunk-G3IJ3N6F.js';
+import { resolveRepoIdentity } from './chunk-QNLX477Q.js';
+import { C } from './chunk-ANPNT6PM.js';
+import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
+import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
+import { defaultFetch } from './chunk-FVMYKL6L.js';
+import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-NTRCK4NH.js';
+import { StepNameSchema, StepBodySchema } from './chunk-7VUK5RFS.js';
+import { homeFromEnv } from './chunk-VNVZDWO3.js';
+import { randomUUID } from 'crypto';
+import { readFileSync, existsSync, mkdirSync, writeFileSync, renameSync, appendFileSync } from 'fs';
+import { join, dirname } from 'path';
+
+createRequire(import.meta.url);
+var STEP_RETRY_MAX_AGE_MS = 14 * 24 * 60 * 60 * 1e3;
+var STEP_STATE_RESOLVED_CAP = 5e3;
+function stepsSpoolPath(home = homeFromEnv()) {
+  return join(home, ".outerlayer", "spool", "steps.jsonl");
+}
+function stepsStatePath(home = homeFromEnv()) {
+  return join(home, ".outerlayer", "spool", "steps.state.json");
+}
+function stepsLockPath(home = homeFromEnv()) {
+  return join(home, ".outerlayer", "spool", "steps.lock");
+}
+function appendStepRecord(record, home = homeFromEnv()) {
+  const path = stepsSpoolPath(home);
+  mkdirSync(dirname(path), { recursive: true });
+  appendFileSync(path, JSON.stringify(record) + "\n");
+}
+function isRecord(value) {
+  if (value === null || typeof value !== "object") return false;
+  const r = value;
+  return typeof r.clientStepId === "string" && typeof r.name === "string" && typeof r.startedAt === "string" && typeof r.itemNumber === "number" && typeof r.appId === "string" && typeof r.cwd === "string" && typeof r.spooledAt === "string";
+}
+function readStepRecords(home = homeFromEnv()) {
+  const path = stepsSpoolPath(home);
+  if (!existsSync(path)) return { records: [], skipped: 0 };
+  const records = [];
+  let skipped = 0;
+  for (const line of readFileSync(path, "utf8").split("\n")) {
+    if (line.trim() === "") continue;
+    try {
+      const parsed = JSON.parse(line);
+      if (isRecord(parsed)) records.push(parsed);
+      else skipped += 1;
+    } catch {
+      skipped += 1;
+    }
+  }
+  return { records, skipped };
+}
+function readStepState(home = homeFromEnv()) {
+  const state = /* @__PURE__ */ new Map();
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(stepsStatePath(home), "utf8"));
+  } catch {
+    return state;
+  }
+  const entries = parsed?.records;
+  if (!Array.isArray(entries)) return state;
+  for (const entry of entries) {
+    const e = entry;
+    if (typeof e?.clientStepId !== "string") continue;
+    if (e.state === "pending" || e.state === "uploaded" || e.state === "dropped") state.set(e.clientStepId, e.state);
+  }
+  return state;
+}
+function writeStepState(state, home = homeFromEnv()) {
+  try {
+    const path = stepsStatePath(home);
+    mkdirSync(dirname(path), { recursive: true });
+    const pending = [];
+    const resolved = [];
+    for (const pair of state.entries()) (pair[1] === "pending" ? pending : resolved).push(pair);
+    const kept = resolved.length > STEP_STATE_RESOLVED_CAP ? resolved.slice(-STEP_STATE_RESOLVED_CAP) : resolved;
+    const records = [...pending, ...kept].map(([clientStepId, disposition]) => ({ clientStepId, state: disposition }));
+    const tmp = `${path}.tmp`;
+    writeFileSync(tmp, JSON.stringify({ version: 1, records }));
+    renameSync(tmp, path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/emit-step-cmd.ts
+var EmitStepError = class extends Error {
+};
+function firstIssue(error) {
+  const issue = error.issues[0];
+  if (!issue) return "malformed";
+  const path = issue.path.join(".");
+  return path === "" || path === "name" ? issue.message : `${path}: ${issue.message}`;
+}
+function detectSessionId(opts) {
+  const identity = resolveRepoIdentity(opts.cwd);
+  return detectActiveSession({
+    env: opts.env,
+    home: opts.home,
+    cwds: identity.repoRoot !== void 0 ? [identity.repoRoot, opts.cwd] : [opts.cwd],
+    nowMs: opts.now().getTime()
+  });
+}
+function resolveItem(opts) {
+  if (opts.sessionId !== void 0) {
+    const refusal = launchRefusalForSession(opts.sessionId, opts.home);
+    if (refusal !== void 0) throw new EmitStepError(refusal);
+  }
+  if (opts.item !== void 0) {
+    const number = parseTrackerNumber(opts.item);
+    if (number === void 0) throw new EmitStepError(trackerNumberError("--item", opts.item));
+    return number;
+  }
+  const launched = opts.sessionId !== void 0 ? launchedItemForSession(opts.sessionId, opts.home) : void 0;
+  if (launched !== void 0) return launched;
+  throw new EmitStepError(
+    "no work item to report this step on. Pass --item <number>, or run inside a recorded session launched with OUTERLAYER_WORK, whose launch record names the item."
+  );
+}
+async function refusalReason(response) {
+  let text = "";
+  try {
+    text = await response.text();
+  } catch {
+  }
+  try {
+    const message = JSON.parse(text).error?.message;
+    if (typeof message === "string" && message !== "") return message;
+  } catch {
+  }
+  return text.replace(/\s+/g, " ").trim().slice(0, 160);
+}
+function stepUrl(base) {
+  return new URL("/v1/work-items/steps", base).toString();
+}
+function stepHeaders(apiKey, appId) {
+  return { "content-type": "application/json", authorization: `Bearer ${apiKey}`, "x-outerlayer-app-id": appId };
+}
+async function runEmitStep(opts) {
+  const cwd = opts.cwd ?? process.cwd();
+  const home = opts.home ?? homeFromEnv();
+  const env = opts.env ?? process.env;
+  const now = opts.now ?? (() => /* @__PURE__ */ new Date());
+  const name = StepNameSchema.safeParse(opts.name);
+  if (!name.success) throw new EmitStepError(`invalid step name: ${firstIssue(name.error)}`);
+  const sessionId = detectSessionId({ cwd, home, env, now });
+  const itemNumber = resolveItem({ item: opts.item, sessionId, home });
+  const parsed = StepBodySchema.safeParse({
+    clientStepId: randomUUID(),
+    name: opts.name,
+    item: { number: itemNumber },
+    startedAt: now().toISOString()
+  });
+  if (!parsed.success) throw new EmitStepError(`invalid step: ${firstIssue(parsed.error)}`);
+  const body = parsed.data;
+  const refusal = await autoConnect({ ...opts, cwd, home, env });
+  if (refusal !== void 0) throw new EmitStepError(refusal);
+  const resolved = resolveGatewayCredentials({ ...opts, cwd, home, env });
+  if (!resolved.ok) throw new EmitStepError(resolved.message);
+  const { url, credential: apiKey, appId } = resolved;
+  const fetchImpl = opts.fetchImpl ?? defaultFetch;
+  const endpoint = stepUrl(url);
+  const spool = (why) => {
+    appendStepRecord(
+      {
+        clientStepId: body.clientStepId,
+        name: body.name,
+        startedAt: body.startedAt,
+        itemNumber,
+        appId,
+        cwd,
+        spooledAt: now().toISOString()
+      },
+      home
+    );
+    const output2 = `${C.yellow}!${C.reset} step "${body.name}" queued (${why}); \`outerlayer sync\` will send it`;
+    if (!opts.quiet) process.stdout.write(output2 + "\n");
+    return { data: { clientStepId: body.clientStepId, queued: true }, output: output2, exitCode: 0, queued: true };
+  };
+  let response;
+  try {
+    response = await fetchImpl(endpoint, { method: "POST", headers: stepHeaders(apiKey, appId), body: JSON.stringify(body) });
+  } catch (err) {
+    return spool(`could not reach ${new URL(endpoint).host}: ${String(err)}`);
+  }
+  if (response.status >= 500) return spool(`the gateway answered ${response.status}`);
+  if (response.status === 401) throw new EmitStepError(unauthorizedMessage(apiKey));
+  if (!response.ok) {
+    const reason = await refusalReason(response);
+    throw new EmitStepError(`step refused (${response.status})${reason ? `: ${reason}` : ""}`);
+  }
+  let data = {};
+  try {
+    data = (await response.json()).data ?? {};
+  } catch {
+  }
+  const output = opts.json ? JSON.stringify(data) : `${C.green}\u2713${C.reset} step started: ${body.name} ${C.dim}\xB7${C.reset} item #${itemNumber}`;
+  if (!opts.quiet) process.stdout.write(output + "\n");
+  return { data, output, exitCode: 0, queued: false };
+}
+async function uploadSpooledSteps(opts) {
+  const { home } = opts;
+  const waiting = () => {
+    const state = readStepState(home);
+    return readStepRecords(home).records.filter((record) => {
+      const disposition = state.get(record.clientStepId);
+      return disposition !== "uploaded" && disposition !== "dropped";
+    });
+  };
+  if (waiting().length === 0) return void 0;
+  const lock = await acquireSpoolLockAt(stepsLockPath(home), { waitMs: opts.lockWaitMs });
+  if (!lock.ok) {
+    if (!opts.quiet) {
+      process.stderr.write(`${C.yellow}!${C.reset} steps not sent: ${lock.reason}; they stay queued for the next sync
+`);
+    }
+    return { uploaded: 0, dropped: 0, pending: waiting().length };
+  }
+  try {
+    const fetchImpl = opts.fetchImpl ?? defaultFetch;
+    const nowMs = opts.nowMs ?? Date.now();
+    const state = readStepState(home);
+    const result = { uploaded: 0, dropped: 0, pending: 0 };
+    let stopped = false;
+    for (const record of readStepRecords(home).records) {
+      const saved = state.get(record.clientStepId);
+      if (saved === "uploaded" || saved === "dropped") continue;
+      const spooledMs = Date.parse(record.spooledAt);
+      if (Number.isFinite(spooledMs) && nowMs - spooledMs > STEP_RETRY_MAX_AGE_MS) {
+        state.set(record.clientStepId, "dropped");
+        result.dropped += 1;
+        continue;
+      }
+      const foreign = opts.kind === "key" && record.appId !== opts.appId || opts.onlyItem !== void 0 && record.itemNumber !== opts.onlyItem;
+      if (stopped || foreign) {
+        result.pending += 1;
+        continue;
+      }
+      const body = {
+        clientStepId: record.clientStepId,
+        name: record.name,
+        item: { number: record.itemNumber },
+        startedAt: record.startedAt
+      };
+      let response;
+      try {
+        response = await fetchImpl(stepUrl(opts.url), {
+          method: "POST",
+          headers: stepHeaders(opts.apiKey, opts.kind === "login" ? record.appId : opts.appId),
+          body: JSON.stringify(body)
+        });
+      } catch {
+        stopped = true;
+        result.pending += 1;
+        continue;
+      }
+      if (response.ok) {
+        state.set(record.clientStepId, "uploaded");
+        result.uploaded += 1;
+      } else if (response.status === 401) {
+        result.unauthorized = unauthorizedMessage(opts.apiKey);
+        stopped = true;
+        result.pending += 1;
+      } else if (response.status >= 500 || response.status === 408 || response.status === 429) {
+        result.pending += 1;
+      } else {
+        state.set(record.clientStepId, "dropped");
+        result.dropped += 1;
+        if (!opts.quiet) {
+          const reason = await refusalReason(response);
+          process.stderr.write(
+            `${C.yellow}!${C.reset} step "${record.name}" on item #${record.itemNumber} refused (${response.status}) and dropped${reason ? `: ${reason}` : ""}
+`
+          );
+        }
+      }
+    }
+    if (!writeStepState(state, opts.home) && !opts.quiet) {
+      process.stderr.write(
+        `${C.yellow}!${C.reset} failed to save ${stepsStatePath(home)}; steps sent this run may be sent again, which is harmless
+`
+      );
+    }
+    return result;
+  } finally {
+    lock.release();
+  }
+}
+
+export { EmitStepError, runEmitStep, uploadSpooledSteps };

package/dist/chunk-LLM3I5YU.js

@@ -0,0 +1,89 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { rewriteControlPlanePaths, rewriteHookCommand } from './chunk-G2YNJIGF.js';
+import { MAINTAINED_SKILLS } from './chunk-NNLA7LLQ.js';
+import { existsSync, mkdirSync, copyFileSync, writeFileSync, readdirSync, lstatSync, readFileSync } from 'fs';
+import { join, dirname } from 'path';
+
+createRequire(import.meta.url);
+function deliverySection(dir) {
+  return `This repository's control plane is not in the checkout. Its files are in \`${dir}\`. When an instruction or skill names a path under \`.outerlayer/\` or \`.claude/\`, read it under \`${dir}\`.`;
+}
+function isFile(path) {
+  try {
+    return lstatSync(path).isFile();
+  } catch {
+    return false;
+  }
+}
+function filesUnder(dir, base = dir) {
+  if (!existsSync(dir) || !lstatSync(dir).isDirectory()) return [];
+  const out = [];
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const abs = join(dir, entry.name);
+    if (entry.isDirectory()) out.push(...filesUnder(abs, base));
+    else if (entry.isFile()) out.push(abs.slice(base.length + 1));
+  }
+  return out.sort();
+}
+function readText(path) {
+  if (!isFile(path)) return void 0;
+  const content = readFileSync(path);
+  return content.includes(0) ? void 0 : content.toString("utf8");
+}
+function deliveredSettings(raw, dir) {
+  if (raw === void 0) return "{}\n";
+  const rewrite = (value) => {
+    if (typeof value === "string") return rewriteHookCommand(value, dir);
+    if (Array.isArray(value)) return value.map(rewrite);
+    if (typeof value === "object" && value !== null) return Object.fromEntries(Object.entries(value).map(([key, inner]) => [key, rewrite(inner)]));
+    return value;
+  };
+  try {
+    return `${JSON.stringify(rewrite(JSON.parse(raw)), null, 2)}
+`;
+  } catch {
+    return rewriteHookCommand(raw, dir);
+  }
+}
+function composeDelivery(input) {
+  const { tree, dir } = input;
+  const added = [];
+  const put = (rel, content) => {
+    mkdirSync(dirname(join(tree, rel)), { recursive: true });
+    writeFileSync(join(tree, rel), content);
+    added.push(rel);
+  };
+  for (const skill of MAINTAINED_SKILLS) {
+    for (const rel of filesUnder(join(tree, ".outerlayer/skills", skill))) {
+      const target = `.claude/skills/${skill}/${rel}`;
+      if (existsSync(join(tree, target))) continue;
+      mkdirSync(dirname(join(tree, target)), { recursive: true });
+      copyFileSync(join(tree, ".outerlayer/skills", skill, rel), join(tree, target));
+      added.push(target);
+    }
+  }
+  for (const rel of [...filesUnder(join(tree, ".claude/skills"), tree), ...filesUnder(join(tree, ".claude/agents"), tree)]) {
+    const text = readText(join(tree, rel));
+    if (text === void 0) continue;
+    const rewritten = rewriteControlPlanePaths(text, dir);
+    if (rewritten !== text) writeFileSync(join(tree, rel), rewritten);
+  }
+  const agents = readText(join(tree, "AGENTS.md"));
+  put("CLAUDE.md", agents === void 0 ? `${deliverySection(dir)}
+` : `${deliverySection(dir)}
+
+${rewriteControlPlanePaths(agents, dir)}`);
+  put("settings.json", deliveredSettings(readText(join(tree, ".claude/settings.json")), dir));
+  return added;
+}
+function sharedSkillNames(tree) {
+  const dir = join(tree, ".claude/skills");
+  if (!existsSync(dir)) return [];
+  return readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name).sort();
+}
+function skillConflictMessage(input) {
+  return `.claude/skills/${input.skill} in ${input.repository} has the same name as the shared skill ${input.skill} from ${input.controlPlane}`;
+}
+
+export { composeDelivery, sharedSkillNames, skillConflictMessage };

package/dist/{chunk-B3UKB46N.js → chunk-LRG3ZMZD.js}

@@ -1,13 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { autoConnect } from './chunk-WBT5X3NH.js';
-import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { resolveRepoIdentity } from './chunk-BMYGAGBJ.js';
+import { autoConnect, detectActiveSession } from './chunk-IF2OSI5T.js';
+import { resolveRepoIdentity } from './chunk-QNLX477Q.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
-import { defaultFetch } from './chunk-ZRL6HKBY.js';
-import { unauthorizedMessage, resolveGatewayCredentials } from './chunk-52NC2FIU.js';
+import { defaultFetch } from './chunk-FVMYKL6L.js';
+import { unauthorizedMessage, resolveGatewayCredentials } from './chunk-NTRCK4NH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 
 createRequire(import.meta.url);

package/dist/{chunk-ULSIJGLS.js → chunk-NFIR3GEE.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { CONTROL_PLANE_DIR_VARIABLE } from './chunk-G2YNJIGF.js';
-import { deadHooksState, huskyPrepareScript, preparePackageManagerCommand } from './chunk-XCCLFVXM.js';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
+import { CONTROL_PLANE_DIR_VARIABLE } from './chunk-G2YNJIGF.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
+import { deadHooksState, huskyPrepareScript, preparePackageManagerCommand } from './chunk-TUSYOL2O.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync, existsSync, statSync, appendFileSync, opendirSync, unlinkSync } from 'fs';
 import { spawn, execFileSync } from 'child_process';
@@ -502,15 +502,16 @@ function installedCliStalenessContext(home, cwd) {
   return `The installed OuterLayer CLI (~/.outerlayer/cli) is behind the workspace build: installed ${installedLabel}, workspace ${workspaceLabel}.
 ${howToRefresh}`;
 }
-function writeSessionStartContext(event, home, cwd, write, extraParts = []) {
+function writeSessionStartContext(event, home, cwd, write, systemMessage, extraParts = []) {
   try {
     if (event !== "SessionStart") return;
     const parts = [syncHealthContext(home), installedCliStalenessContext(home, cwd), ...extraParts].filter(
       (s) => s !== null
     );
-    if (parts.length === 0) return;
+    if (parts.length === 0 && systemMessage === void 0) return;
     write(
       JSON.stringify({
+        ...systemMessage === void 0 ? {} : { systemMessage },
         hookSpecificOutput: { hookEventName: "SessionStart", additionalContext: parts.join("\n\n") }
       })
     );
@@ -571,7 +572,6 @@ function deadHooksAutoHealContext(cwd, home) {
   clearHealFailureMarker(home, state.repoRoot);
   return null;
 }
-var PIN_FILENAME = ".outerlayer-pin.json";
 function sourceCachePath(gitCommonDir) {
   return join(gitCommonDir, "outerlayer", "source.json");
 }
@@ -579,8 +579,8 @@ function contextPossiblyGoverned(cwd, home = homeFromEnv()) {
   try {
     const found = findGitDirs(cwd);
     if (found === void 0) return false;
-    const { repoRoot, gitCommonDir } = found;
-    if (existsSync(join(repoRoot, PIN_FILENAME))) return true;
+    const { gitCommonDir } = found;
+    if (existsSync(join(gitCommonDir, "outerlayer", "delivery.json"))) return true;
     if (!existsSync(join(home, ".outerlayer", "config.json"))) return false;
     let cache;
     try {
@@ -620,6 +620,50 @@ function recordDeliveredContext(cwd, sessionId, home) {
     home
   );
 }
+async function missingControlPlane(cwd, sessionId, home, env) {
+  const dirs = findGitDirs(cwd);
+  if (dirs === void 0) return void 0;
+  if (existsSync(join(dirs.gitCommonDir, "outerlayer", "materialized.json")) || hasExcludeBlock(dirs.gitCommonDir)) {
+    const { cleanupEarlierCopies } = await import('./context-cleanup-HSVYDGMI.js');
+    cleanupEarlierCopies(dirs);
+  }
+  if (!contextPossiblyGoverned(cwd, home)) return void 0;
+  const { governanceOf } = await import('./control-plane-launch-NYVDJESK.js');
+  if (await governanceOf({ cwd, env, home }) !== "governed") return void 0;
+  recordMissingContext(dirs, sessionId, home);
+  const launcher = `${cliInvocation()} claude`;
+  return {
+    person: `This repository's shared instructions and skills are missing from this session, because it did not start through \`${launcher}\`. Start Claude Code with \`${launcher}\`, or run \`${cliInvocation()} init\` once to make plain \`claude\` do the same.`,
+    agent: `This repository is governed by a control plane, and this session did not start through \`${launcher}\`, so the control plane's shared instructions and skills are not loaded. Tell the person to start Claude Code with \`${launcher}\`.`
+  };
+}
+function recordMissingContext(dirs, sessionId, home) {
+  let cache;
+  try {
+    cache = JSON.parse(readFileSync(sourceCachePath(dirs.gitCommonDir), "utf8"));
+  } catch {
+    cache = {};
+  }
+  appendContextProvenance(
+    {
+      t: (/* @__PURE__ */ new Date()).toISOString(),
+      sessionId,
+      repoRoot: dirs.repoRoot,
+      ...typeof cache.repository === "string" ? { repository: cache.repository } : {},
+      ...typeof cache.ref === "string" ? { ref: cache.ref } : {},
+      sha: null,
+      verification: "none"
+    },
+    home
+  );
+}
+function hasExcludeBlock(gitCommonDir) {
+  try {
+    return readFileSync(join(gitCommonDir, "info", "exclude"), "utf8").includes("# BEGIN outerlayer context materialization");
+  } catch {
+    return false;
+  }
+}
 async function runHookFast(event, home = homeFromEnv(), read = readStdin, env = process.env, spawnImpl = spawnDetached) {
   try {
     const stdin = read();
@@ -649,7 +693,7 @@ async function runHookFast(event, home = homeFromEnv(), read = readStdin, env =
     const hookSessionId = typeof payload.session_id === "string" ? payload.session_id : void 0;
     await maybeRenewWorkLease(resolvedEvent, hookSessionId, home, env, spawnImpl, Date.now(), sessionCwd);
     await handleWorkSessionEnd(resolvedEvent, hookSessionId, home, env, spawnImpl, sessionCwd);
-    let materializeMessage;
+    let missingPlane;
     let deadHooksMessage;
     let workLaunchMessage;
     let hookErrorsMessage;
@@ -664,12 +708,9 @@ async function runHookFast(event, home = homeFromEnv(), read = readStdin, env =
         } catch (err) {
           logHookError(home, err);
         }
-      } else if (contextPossiblyGoverned(sessionCwd, home)) {
+      } else {
         try {
-          const { materializeContext: materialize } = await import('./context-materialize-Y5IJ4MQT.js');
-          const sessionId = typeof payload.session_id === "string" ? payload.session_id : "unknown";
-          const result = await materialize({ cwd: sessionCwd, sessionId, home });
-          materializeMessage = result.message;
+          missingPlane = await missingControlPlane(sessionCwd, typeof payload.session_id === "string" ? payload.session_id : "unknown", home, env);
         } catch (err) {
           logHookError(home, err);
         }
@@ -697,7 +738,8 @@ async function runHookFast(event, home = homeFromEnv(), read = readStdin, env =
       home,
       sessionCwd,
       (out) => process.stdout.write(out),
-      [materializeMessage, deadHooksMessage, workLaunchMessage, hookErrorsMessage, renewalHookMessage].filter(
+      missingPlane?.person,
+      [missingPlane?.agent, deadHooksMessage, workLaunchMessage, hookErrorsMessage, renewalHookMessage].filter(
         (s) => s !== void 0
       )
     );

package/dist/{chunk-MNTSH4CL.js → chunk-NNLA7LLQ.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { splitRawFile } from './chunk-X5N6KC6V.js';
+import { splitRawFile } from './chunk-WFSUUUAN.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, readdirSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-WGAUY5LE.js → chunk-QEFKA2QD.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { builtinKind } from './chunk-XGP3VYOG.js';
+import { builtinKind } from './chunk-P53VEAOF.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
 import { runnerDir } from './chunk-N2PXGQRL.js';
 import { dirname } from 'path';