@outerlayer/cli 0.18.0 → 0.19.1

package/dist/{chunk-QQM2UJ6T.js → chunk-F2KXHIFI.js}

@@ -1,24 +1,24 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
+import { LEASE_SECONDS, releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, ALREADY_RELEASED } from './chunk-B6SCN5NY.js';
+import { writePendingUpdate } from './chunk-MTP2QEVO.js';
+import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-S5PCA3SN.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
-import { compareVersions, satisfiesRange } from './chunk-I2UOAV7X.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-YETTWTAY.js';
-import { LEASE_SECONDS, releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, ALREADY_RELEASED } from './chunk-3OFZM4X6.js';
 import { writeJobFile, readJobFile, readJobFileChecked } from './chunk-SADUQSO4.js';
-import { RUNNER_PROTOCOL } from './chunk-KDVIU23F.js';
-import { writePendingUpdate } from './chunk-MTP2QEVO.js';
-import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-S5PCA3SN.js';
-import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-FUB7LRUE.js';
-import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, cleanVersions, isInLayout, stagingDir } from './chunk-AMFWYESY.js';
+import { compareVersions, satisfiesRange } from './chunk-I2UOAV7X.js';
+import { RUNNER_PROTOCOL } from './chunk-BWSUPRDK.js';
+import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-GEMQLBMW.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
+import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, cleanVersions, isInLayout, stagingDir } from './chunk-AMFWYESY.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, measureDisk, setUpRunnerCgroup, parseCpuList, ensureTunnel, keepGhConfigCurrent, createContainerRuntime } from './chunk-Y5MXET4M.js';
-import { spawnRun } from './chunk-L2USZT6T.js';
-import { builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, BUILD_LABEL, RUNNER_LABEL } from './chunk-S26M3YBJ.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-6CHIYEZZ.js';
-import { checkFit } from './chunk-WGAUY5LE.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-KK4VBOH6.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-XGP3VYOG.js';
+import { provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, measureDisk, setUpRunnerCgroup, parseCpuList, ensureTunnel, keepGhConfigCurrent, createContainerRuntime } from './chunk-3ZR7Y23Y.js';
+import { spawnRun } from './chunk-VMJPFQNE.js';
+import { builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, BUILD_LABEL, RUNNER_LABEL } from './chunk-3UZTIRLF.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-XZ4H4X5F.js';
+import { checkFit } from './chunk-QEFKA2QD.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-FBTGMSQF.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-P53VEAOF.js';
 import { exceedsDisk } from './chunk-7RQ73DLO.js';
 import { claimPidFile, readPidFile, releasePidFile } from './chunk-ECODQ7II.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
@@ -26,11 +26,10 @@ import { resolveVersion } from './chunk-RA3O54FC.js';
 import { loadHostKey, ensureHostKey, signerFor } from './chunk-M2ZWWTWZ.js';
 import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, jobsDir, pidFilePath, spoolDir, RUNNER_FILE_MODE, rootfsDir } from './chunk-N2PXGQRL.js';
 import { parseClaimIdentity, parseClaimedRepositories, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, claudeCredential } from './chunk-BQXFBI7T.js';
-import { HOOKS_DIR_NAME, writeCommitHooks } from './chunk-XCCLFVXM.js';
 import { randomBytes } from 'crypto';
-import { mkdirSync, existsSync, chmodSync, statSync, readdirSync, readFileSync, rmSync, renameSync, writeFileSync, closeSync, openSync, constants, lstatSync } from 'fs';
+import { mkdirSync, existsSync, chmodSync, statSync, readdirSync, writeFileSync, readFileSync, rmSync, renameSync, closeSync, openSync, constants, lstatSync } from 'fs';
 import { join, dirname } from 'path';
-import { totalmem } from 'os';
+import { totalmem, constants as constants$1 } from 'os';
 
 createRequire(import.meta.url);
 function openKvm() {
@@ -786,6 +785,145 @@ async function removeStaleRootDisks(root, unfinished, options) {
   }
   return freed;
 }
+var HOOKS_DIR_NAME = "git-hooks";
+var CO_AUTHOR_FILE = "co-author";
+var HOOKS = [
+  "applypatch-msg",
+  "pre-applypatch",
+  "post-applypatch",
+  "pre-commit",
+  "pre-merge-commit",
+  "prepare-commit-msg",
+  "commit-msg",
+  "post-commit",
+  "pre-rebase",
+  "post-checkout",
+  "post-merge",
+  "pre-push",
+  "pre-receive",
+  "update",
+  "post-receive",
+  "post-update",
+  "reference-transaction",
+  "pre-auto-gc",
+  "post-rewrite",
+  "sendemail-validate",
+  "post-index-change"
+];
+var READS_STDIN = /* @__PURE__ */ new Set(["pre-push", "pre-receive", "post-receive", "reference-transaction", "post-rewrite"]);
+var ADD_TRAILER = `
+# Every commit of the build names the requester once: a trailer already there is left alone.
+file=\${1-}
+if [ -n "$file" ] && [ -f "$file" ]; then
+  git interpret-trailers --in-place --if-exists addIfDifferent --trailer "Co-authored-by: $(cat "$here/${CO_AUTHOR_FILE}")" "$file" ||
+    echo "outerlayer: could not add the co-author line to the commit message" >&2
+fi
+`;
+var HOOK_WRAPPER_MARKER = "# Written by the OuterLayer runner.";
+function script(name) {
+  const adds = name === "prepare-commit-msg";
+  return `#!/bin/sh
+${HOOK_WRAPPER_MARKER} Runs the repository's own ${name} hook, then
+# ${adds ? "adds the co-author line to the commit message" : "hands its status on"}.
+here=$(dirname "$0")
+
+# The hooks path git would use without this directory: cut the list of configuration
+# entries the runner passes just before its own core.hooksPath entry, then ask git.
+n=\${GIT_CONFIG_COUNT-0}
+case $n in '' | *[!0-9]*) n=0 ;; esac
+cut=$n
+i=$n
+while [ "$i" -gt 0 ]; do
+  i=$((i - 1))
+  eval "key=\\\${GIT_CONFIG_KEY_$i-}"
+  eval "value=\\\${GIT_CONFIG_VALUE_$i-}"
+  if [ "$key" = core.hooksPath ] && { [ "$value" = "$here" ] || [ "$value" -ef "$here" ]; }; then
+    cut=$i
+    break
+  fi
+done
+path=$(GIT_CONFIG_COUNT=$cut git config --type=path core.hooksPath 2>/dev/null) || path=
+if [ -z "$path" ]; then
+  path=$(git rev-parse --git-common-dir 2>/dev/null)/hooks
+fi
+
+hook=$path/${name}
+status=0
+if [ "$path" -ef "$here" ] || [ ! -f "$hook" ] || [ ! -x "$hook" ]; then
+${READS_STDIN.has(name) ? "  cat >/dev/null\n" : ""}  :
+else
+${adds ? `  "$hook" "$@" || status=$?` : `  exec "$hook" "$@"`}
+fi
+${adds ? `[ "$status" -eq 0 ] || exit "$status"
+${ADD_TRAILER}` : ""}exit 0
+`;
+}
+function writeCommitHooks(buildDir2, coAuthor) {
+  const dir = join(buildDir2, HOOKS_DIR_NAME);
+  mkdirSync(dir, { recursive: true });
+  chmodSync(dir, 493);
+  for (const name of HOOKS) {
+    const path = join(dir, name);
+    writeFileSync(path, script(name));
+    chmodSync(path, 493);
+  }
+  const data = join(dir, CO_AUTHOR_FILE);
+  writeFileSync(data, `${coAuthor.name} <${coAuthor.email}>
+`);
+  chmodSync(data, 420);
+  return dir;
+}
+function linuxSignalName(number) {
+  const names = {
+    1: "SIGHUP",
+    2: "SIGINT",
+    3: "SIGQUIT",
+    4: "SIGILL",
+    5: "SIGTRAP",
+    6: "SIGABRT",
+    7: "SIGBUS",
+    8: "SIGFPE",
+    9: "SIGKILL",
+    10: "SIGUSR1",
+    11: "SIGSEGV",
+    12: "SIGUSR2",
+    13: "SIGPIPE",
+    14: "SIGALRM",
+    15: "SIGTERM",
+    16: "SIGSTKFLT",
+    17: "SIGCHLD",
+    18: "SIGCONT",
+    19: "SIGSTOP",
+    20: "SIGTSTP",
+    21: "SIGTTIN",
+    22: "SIGTTOU",
+    23: "SIGURG",
+    24: "SIGXCPU",
+    25: "SIGXFSZ",
+    26: "SIGVTALRM",
+    27: "SIGPROF",
+    28: "SIGWINCH",
+    29: "SIGIO",
+    30: "SIGPWR",
+    31: "SIGSYS"
+  };
+  return names[number];
+}
+function hostSignalName(number) {
+  return Object.entries(constants$1.signals).find(([, value]) => value === number)?.[0];
+}
+function notEndedByRunnerReason(exit, isolated) {
+  if (exit.signal !== null) {
+    return `the command was killed by ${exit.signal} on the host; the runner did not end it`;
+  }
+  const number = exit.code - 128;
+  const name = isolated ? linuxSignalName(number) : hostSignalName(number);
+  if (name === void 0) return void 0;
+  return `the command exited ${exit.code}, the status of a process killed by ${name}; the runner did not end it`;
+}
+function jobNotEndedByRunnerReason(exit, job) {
+  return notEndedByRunnerReason(exit, job.container !== void 0 || job.microvm !== void 0);
+}
 
 // src/runner/loop.ts
 var QUEUE_ORDER = ["amend", "implement"];
@@ -795,7 +933,12 @@ var TRACKER_REPOSITORY_HOSTS = {
 var HOUSEKEEPING_INTERVAL_MS = 36e5;
 function logOf(state) {
   state.deps.log ??= createRunnerLog(state.deps.now ?? (() => /* @__PURE__ */ new Date()));
-  return state.deps.log;
+  state.attemptLog ??= attemptLogsOf(state).wrap(state.deps.log);
+  return state.attemptLog;
+}
+function attemptLogsOf(state) {
+  state.attemptLogs ??= new AttemptLogBook(state.deps.now);
+  return state.attemptLogs;
 }
 function nowOf(state) {
   return (state.deps.now ?? (() => /* @__PURE__ */ new Date()))();
@@ -811,6 +954,7 @@ function finishDepsOf(state) {
     now: state.deps.now,
     sleep: state.deps.sleep,
     log: logOf(state),
+    attemptLogs: attemptLogsOf(state),
     cliVersion: state.deps.cliVersion,
     // Any job that has a container needs the runtime to stop and remove it, including one a config change left behind.
     container: runtimeOf(state)
@@ -1319,7 +1463,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-7S5B2H2P.js');
+  const { postJson: postJson2 } = await import('./work-cmd-5I3J2XQQ.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -1478,9 +1622,10 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity,
     ending: false
   };
   state.jobs.set(dirPath, active);
-  log.line(
-    `claimed ${queue} #${item.number} ${item.trackerKey} (claim ${shortClaim(claimId)}) \u2192 ${relativeToRunner(runnerRoot, dirPath)}`
-  );
+  attemptLogsOf(state).open(item.number, dirPath);
+  const claimLine = `claimed ${queue} #${item.number} ${item.trackerKey} (claim ${shortClaim(claimId)}) \u2192 ${relativeToRunner(runnerRoot, dirPath)}`;
+  log.line(claimLine);
+  attemptLogsOf(state).note(item.number, claimLine);
   const hookLimits = () => hookLimitsFor(state.config, startedAt.getTime(), state.deps.now);
   const tag = `#${item.number}`;
   const containerMode = isBuiltinContainer(state.config.hooks.provision);
@@ -1841,11 +1986,13 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity,
     const took = formatDuration(nowOf(state).getTime() - commandStartedMs);
     if (signal !== null) {
       log.error(`${tag} command killed by ${signal} (${took})`);
+      active.job.commandEndReason = jobNotEndedByRunnerReason({ code: null, signal }, active.job);
       void endJob(state, active, "failed");
       return;
     }
     log.line(`${tag} command exited ${code ?? 0} (${took})`);
     if (code !== null) active.job.exitCode = code;
+    active.job.commandEndReason = jobNotEndedByRunnerReason({ code, signal }, active.job);
     void endJob(state, active, code === 0 ? "ok" : "failed");
   });
 }
@@ -2079,7 +2226,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     const outcome = await onStartUnderMarker({
       configPath,
       own: ownVersionOf(deps),
-      check: update.check ? () => update.check(configPath) : async () => (await import('./check-5C4YDZYV.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
+      check: update.check ? () => update.check(configPath) : async () => (await import('./check-W2JGXN3B.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
     });
@@ -2117,9 +2264,11 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     return [];
   });
   for (const buildId of runningMicroVms) log.line(`stopped microVM build ${buildId}, left running by an earlier runner`);
+  const attemptLogs = attemptLogsOf(state);
   for (const { dirPath, job } of listAdoptableJobs(jobsDir(configPath))) {
     const adopted = { job, dirPath, lastRenewAtMs: nowMs(), cmd: null, cpuSample: null, ending: false };
     state.jobs.set(dirPath, adopted);
+    attemptLogs.open(job.item, dirPath);
     if (job.container !== void 0) {
       const cores = job.container.cpuset === void 0 ? void 0 : parseCpuList(job.container.cpuset);
       if (cores !== void 0) runtimeOf(state).cpus.hold(job.container.buildId, cores);
@@ -2131,18 +2280,20 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
         keepGhConfigCurrent(
           tokens,
           job.container.buildDir,
-          (err) => log.error(`#${job.item} the read token could not be written for gh: ${describeCallFailure(err)}`)
+          (err) => logOf(state).error(`#${job.item} the read token could not be written for gh: ${describeCallFailure(err)}`)
         );
       } catch (err) {
-        log.error(`#${job.item} could not give the adopted build a read token: ${describeCallFailure(err)}`);
+        logOf(state).error(`#${job.item} could not give the adopted build a read token: ${describeCallFailure(err)}`);
       }
     }
     if (job.build !== void 0 && !runtimeOf(state).tunnels.has(job.build.buildId)) {
       await startHostServices({ runtime: runtimeOf(state), config, build: job.build, jobDir: dirPath, itemKey: job.itemKey, process: job.build.workDir !== void 0 }).catch((err) => {
-        log.error(`the tunnel of #${job.item} could not start again: ${describeCallFailure(err)}`);
+        logOf(state).error(`the tunnel of #${job.item} could not start again: ${describeCallFailure(err)}`);
       });
     }
-    log.line(`adopted job ${job.queue} #${job.item} (claim ${shortClaim(job.claimId)}) \xB7 pid ${job.pid} still running`);
+    const adoptedLine = `adopted job ${job.queue} #${job.item} (claim ${shortClaim(job.claimId)}) \xB7 pid ${job.pid} still running`;
+    log.line(adoptedLine);
+    attemptLogs.note(job.item, adoptedLine);
   }
   for (const { job, released } of await retryFailedReleases(jobsDir(configPath), config, {
     fetchImpl: deps.fetchImpl,
@@ -2182,7 +2333,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
       } catch {
       }
       void watchTick(state, active, now, mtime).catch((err) => {
-        log.error(`#${active.job.item} health check failed: ${describeCallFailure(err)}`);
+        logOf(state).error(`#${active.job.item} health check failed: ${describeCallFailure(err)}`);
       });
     }
   }, deps.watchIntervalMs ?? 3e4);
@@ -2229,6 +2380,9 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     let passes = 0;
     while (state.jobs.size > 0 && !exited) {
       onWaiting?.([...state.jobs.keys()]);
+      for (const active of state.jobs.values()) {
+        attemptLogs.noteChanged(active.job.item, "drain", `stopping: draining, waiting on #${active.job.item} (${active.job.stage ?? "starting"})`);
+      }
       if (passes % DRAIN_LOG_EVERY_PASSES === 0) {
         log.line(
           `stopping: draining, waiting on ${[...state.jobs.values()].map((a) => describeWaiting(a, nowMs())).join(", ")}`

package/dist/{chunk-KK4VBOH6.js → chunk-FBTGMSQF.js}

@@ -1,17 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { autoConnect } from './chunk-WBT5X3NH.js';
-import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { workPageUrl } from './chunk-S76AYB4M.js';
-import { sanitizeTerminal } from './chunk-MQJSXHV7.js';
-import { resolveRepoIdentity } from './chunk-BMYGAGBJ.js';
+import { detectActiveSession, autoConnect } from './chunk-IF2OSI5T.js';
+import { workPageUrl } from './chunk-CG36IONK.js';
+import { sanitizeTerminal } from './chunk-G3IJ3N6F.js';
+import { resolveRepoIdentity } from './chunk-QNLX477Q.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
-import { defaultFetch } from './chunk-ZRL6HKBY.js';
-import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-52NC2FIU.js';
-import { signRunnerRequest } from './chunk-M2ZWWTWZ.js';
+import { defaultFetch } from './chunk-FVMYKL6L.js';
+import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-NTRCK4NH.js';
 import { readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
+import { signRunnerRequest } from './chunk-M2ZWWTWZ.js';
 
 createRequire(import.meta.url);
 
@@ -44,8 +43,8 @@ var TRACKERS = {
     scopeNoun: "project",
     connect: {
       kind: "form",
-      summary: "Read the projects you pick on a site, with a service account. One webhook is created in Jira by an admin.",
-      intro: "Uses a service account's OAuth client credential. Create one under Atlassian administration, then paste it here. Read scope only.",
+      summary: "Read the projects you pick on a site, and file specs as issues, with a service account. One webhook is created in Jira by an admin.",
+      intro: "Uses a service account's OAuth client credential. Create one under Atlassian administration, then paste it here. Give it read:jira-work, and write:jira-work to file specs. A credential's scopes are fixed when it is created.",
       notice: "After connecting, you get a webhook URL and secret to put on one webhook in Jira. That is the only manual step, and the only time the secret is shown.",
       fields: [
         { name: "siteUrl", label: "Site URL", placeholder: "https://your-team.atlassian.net" },
@@ -422,7 +421,7 @@ async function runWorkLinkSession(opts) {
     return await linkSession(opts);
   } catch (err) {
     if (opts.logFailures) {
-      const { logHookError } = await import('./hook-fast-W5MKHMJT.js');
+      const { logHookError } = await import('./hook-fast-RL5E5OXE.js');
       const reason = err instanceof Error ? err.message : String(err);
       logHookError(opts.home ?? homeFromEnv(opts.env ?? process.env), new Error(`work link-session #${opts.number} failed: ${reason}`));
     }

package/dist/{chunk-MQJSXHV7.js → chunk-G3IJ3N6F.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { ArtifactTombstoneRecordSchema, ArtifactSpoolRecordSchema } from './chunk-N3CUDFCW.js';
+import { ArtifactTombstoneRecordSchema, ArtifactSpoolRecordSchema } from './chunk-7VUK5RFS.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, appendFileSync, writeFileSync, renameSync, unlinkSync, existsSync, readdirSync, readFileSync, statSync } from 'fs';
 import { join, dirname } from 'path';
@@ -273,7 +273,9 @@ function artifactLockIsStale(path, nowMs, isAlive) {
   }
 }
 async function acquireArtifactSpoolLock(home = homeFromEnv(), opts = {}) {
-  const path = artifactsLockPath(home);
+  return acquireSpoolLockAt(artifactsLockPath(home), opts);
+}
+async function acquireSpoolLockAt(path, opts = {}) {
   const waitMs = opts.waitMs ?? ARTIFACT_LOCK_WAIT_MS;
   const sleep = opts.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
   const isAlive = opts.isAlive ?? processIsAlive;
@@ -460,4 +462,4 @@ function resolveArtifactTurnIndex(turns, filename) {
   return found;
 }
 
-export { ARTIFACT_RETRY_MAX_AGE_MS, acquireArtifactSpoolLock, appendArtifactRecord, appendArtifactTombstone, artifactBlobsDir, artifactsSpoolPath, artifactsStatePath, findPendingArtifactRecord, isArtifactTombstoned, localArtifactIds, migrateLegacyArtifactSidecars, neededArtifactShas, planArtifactUpload, readEffectiveArtifactSpoolState, reclaimUnneededArtifactBlobs, resolveArtifactTurnIndex, sanitizeTerminal, writeArtifactSpoolState };
+export { ARTIFACT_RETRY_MAX_AGE_MS, acquireArtifactSpoolLock, acquireSpoolLockAt, appendArtifactRecord, appendArtifactTombstone, artifactBlobsDir, artifactsSpoolPath, artifactsStatePath, findPendingArtifactRecord, isArtifactTombstoned, localArtifactIds, migrateLegacyArtifactSidecars, neededArtifactShas, planArtifactUpload, readEffectiveArtifactSpoolState, reclaimUnneededArtifactBlobs, resolveArtifactTurnIndex, sanitizeTerminal, writeArtifactSpoolState };

package/dist/{chunk-FUB7LRUE.js → chunk-GEMQLBMW.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-GOBOJMOJ.js';
-import { describeCallFailure } from './chunk-6CHIYEZZ.js';
-import { WorkCommandError, getJson } from './chunk-KK4VBOH6.js';
-import { sanitizeTerminal } from './chunk-MQJSXHV7.js';
-import { builtinKind } from './chunk-XGP3VYOG.js';
+import { isPlaceholderCommand } from './chunk-PIZRPNKR.js';
+import { describeCallFailure } from './chunk-XZ4H4X5F.js';
+import { WorkCommandError, getJson } from './chunk-FBTGMSQF.js';
+import { sanitizeTerminal } from './chunk-G3IJ3N6F.js';
+import { builtinKind } from './chunk-P53VEAOF.js';
 import { signerFor } from './chunk-M2ZWWTWZ.js';
 import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential } from './chunk-BQXFBI7T.js';
 

package/dist/{chunk-Y5GE76XC.js → chunk-HOKXGFDR.js}

@@ -1,23 +1,22 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { checkStarterFiles, contextIsGoverned } from './chunk-ESC6UR76.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-KK4VBOH6.js';
-import { isLinkedRepository } from './chunk-S76AYB4M.js';
-import { sanitizeTerminal } from './chunk-MQJSXHV7.js';
+import { checkStarterFiles, contextIsGoverned } from './chunk-TWF3RICI.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-FBTGMSQF.js';
+import { isLinkedRepository } from './chunk-CG36IONK.js';
+import { sanitizeTerminal } from './chunk-G3IJ3N6F.js';
+import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-PSN33ERW.js';
 import { readStatuslineState, STATE_FRESH_MS } from './chunk-DSF2FWAZ.js';
-import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-BMYGAGBJ.js';
+import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-QNLX477Q.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { readSettings, settingsPath, isOurStatuslineSlot, statuslineWrappedOriginal, REGISTERED_EVENTS, isOurHookCommand, ourCommandBins, cliBinResolvable, ourDirectScriptBins, wrappedOriginalCommand } from './chunk-5QRP3MVS.js';
-import { readPin, readContextManifest, readDegraded, readSourceCache } from './chunk-LXAY4A2G.js';
-import { checkFormerSkillNames } from './chunk-T4Y6SCG3.js';
-import { defaultFetch } from './chunk-ZRL6HKBY.js';
-import { resolveGatewayCredentials } from './chunk-52NC2FIU.js';
-import { readCloudConfig } from './chunk-EABW6AJQ.js';
-import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-ULSIJGLS.js';
-import { hookCommandEscapesControlPlane, CONTROL_PLANE_DIR_VARIABLE } from './chunk-G2YNJIGF.js';
-import { deadHooksState, preparePackageManagerCommand, contextExcludesPresent } from './chunk-XCCLFVXM.js';
+import { checkFormerSkillNames } from './chunk-7UWVLZXD.js';
+import { defaultFetch } from './chunk-FVMYKL6L.js';
+import { resolveGatewayCredentials } from './chunk-NTRCK4NH.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
+import { hookCommandEscapesControlPlane, CONTROL_PLANE_DIR_VARIABLE } from './chunk-G2YNJIGF.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
+import { readDeliveryRecord, readDegraded, readSourceCache } from './chunk-YQR6E6OV.js';
+import { deadHooksState, preparePackageManagerCommand } from './chunk-TUSYOL2O.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync, existsSync, accessSync, constants, statSync, readdirSync, realpathSync } from 'fs';
 import { join, dirname, resolve, delimiter } from 'path';
@@ -194,7 +193,7 @@ function runDoctor(env = {}) {
     ...starter?.checks ?? [],
     ...laptop ? checkRenamedSkills(env.cwd) : [],
     ...starter !== void 0 && !starter.mcpOutdated ? checkMcpCommand(env.cwd, env.processEnv) : [],
-    ...checkContextSource(home, env.cwd),
+    ...checkContextSource(env.cwd),
     ...checkGovernsList(env.cwd),
     ...checkControlPlaneHooks(env.cwd),
     ...checkInstalledCli(home, env.cwd ?? process.cwd())
@@ -202,7 +201,7 @@ function runDoctor(env = {}) {
 }
 function checkRenamedSkills(cwd) {
   const dirs = findGitDirs(cwd ?? process.cwd());
-  if (dirs === void 0 || contextIsGoverned(dirs.repoRoot, dirs.gitCommonDir)) return [];
+  if (dirs === void 0 || contextIsGoverned(dirs.gitCommonDir)) return [];
   return checkFormerSkillNames(dirs.repoRoot);
 }
 function checkInstalledCli(home, cwd) {
@@ -670,17 +669,17 @@ function defaultClaudeInstalls() {
 function contextDegradedFix(kind) {
   switch (kind) {
     case "unreachable":
-      return `Check network/VPN access to the control plane, then run \`${cliInvocation()} context materialize\`.`;
+      return `Check network/VPN access to the control plane, then start Claude Code with \`${cliInvocation()} claude\`.`;
     case "no-access":
       return "Check your git credentials (SSH key or token) and org/SSO access to the control plane, then retry.";
     case "designation-unverified":
-      return `Check OuterLayer cloud connectivity/config (~/.outerlayer/config.json), then run \`${cliInvocation()} context materialize\`.`;
+      return `Check OuterLayer cloud connectivity/config (~/.outerlayer/config.json), then start Claude Code with \`${cliInvocation()} claude\`.`;
     case "not-governed":
-      return "Expected after the control plane was removed, or after this repository stopped being linked to its factory. Otherwise link the repository to the factory and, in the factory's Settings, choose the control plane in the Repositories list with Use as control plane.";
+      return "A record from an earlier CLI. It is cleared the next time `outerlayer claude` asks which control plane governs this repository.";
     case "adoption-conflict":
-      return `Remove the committed AGENTS.md/.claude/.outerlayer files in a commit, then run \`${cliInvocation()} context materialize\`.`;
+      return "A record from an earlier CLI. Committed AGENTS.md or .claude files no longer block the control plane, and the record is cleared the next time `outerlayer claude` asks which control plane governs this repository.";
     case "conflict":
-      return `This record is stale: a gateway that stores the control plane never reports two. Run \`${cliInvocation()} context materialize\` again.`;
+      return `This record is stale: a gateway that stores the control plane never reports two. Start Claude Code with \`${cliInvocation()} claude\` to clear it.`;
   }
 }
 function checkGovernsList(cwd) {
@@ -756,16 +755,10 @@ function checkControlPlaneHooks(cwd) {
     }
   ];
 }
-function checkContextSource(home, cwd) {
+function checkContextSource(cwd) {
   const dir = cwd ?? process.cwd();
-  let repoRoot;
   let gitCommonDir;
   try {
-    repoRoot = execFileSync("git", ["-C", dir, "rev-parse", "--show-toplevel"], {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"],
-      timeout: 2e3
-    }).trim();
     gitCommonDir = execFileSync("git", ["-C", dir, "rev-parse", "--path-format=absolute", "--git-common-dir"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
@@ -774,72 +767,31 @@ function checkContextSource(home, cwd) {
   } catch {
     return [];
   }
-  if (!repoRoot || !gitCommonDir) return [];
-  const pin = readPin(repoRoot);
-  const manifest = readContextManifest(gitCommonDir);
+  if (!gitCommonDir) return [];
+  const delivery = readDeliveryRecord(gitCommonDir);
   const degraded = readDegraded(gitCommonDir);
-  const sourceCache = readSourceCache(gitCommonDir);
-  const looksGoverned = pin !== void 0 || sourceCache?.status === "governed";
-  if (!pin && !manifest && !degraded && !looksGoverned) return [];
+  const governed = readSourceCache(gitCommonDir)?.status === "governed";
+  if (!governed && delivery === void 0 && !degraded) return [];
   const checks = [];
   const name = "Context source";
-  if (pin && manifest && pin.sha !== manifest.sha) {
+  if (delivery !== void 0 && existsSync(delivery.dir)) {
+    checks.push({ name, status: degraded ? "warn" : "pass", detail: `control plane delivered at ${delivery.sha.slice(0, 7)}` });
+  } else if (governed) {
     checks.push({
       name,
       status: "warn",
-      detail: `pin (${pin.sha.slice(0, 7)}) and manifest (${manifest.sha.slice(0, 7)}) disagree`,
-      fix: `Run \`${cliInvocation()} context materialize\` to reconcile.`
+      detail: delivery === void 0 ? "a control plane governs this repository, and no copy of it has been delivered to this machine" : `the delivered control plane is no longer at ${delivery.dir}`,
+      fix: `Start Claude Code with \`${cliInvocation()} claude\`.`
     });
-  } else if (pin ?? manifest) {
-    const sha = (pin ?? manifest).sha;
-    checks.push({ name, status: degraded ? "warn" : "pass", detail: `materialized at ${sha.slice(0, 7)}` });
   }
   if (degraded) {
     checks.push({
       name: "Context source degradation",
-      status: degraded.kind === "adoption-conflict" || degraded.kind === "conflict" ? "fail" : "warn",
+      status: degraded.kind === "conflict" ? "fail" : "warn",
       detail: degraded.message,
       fix: contextDegradedFix(degraded.kind)
     });
   }
-  if ((pin || manifest) && !contextExcludesPresent(gitCommonDir)) {
-    checks.push({
-      name: "Context exclude block",
-      status: "warn",
-      detail: "materialized paths are not excluded in .git/info/exclude",
-      fix: `Run \`${cliInvocation()} context materialize\` to repair it.`
-    });
-  }
-  if (pin && !readCloudConfig(home).url) {
-    checks.push({
-      name,
-      status: "warn",
-      detail: "a pin exists but OuterLayer cloud sync isn't configured \u2014 the designation cannot be confirmed",
-      fix: `Run \`${cliInvocation()} login\` to connect.`
-    });
-  }
-  if (looksGoverned) {
-    let tracked = "";
-    try {
-      tracked = execFileSync("git", ["-C", repoRoot, "ls-files", "--", "AGENTS.md", ".claude", ".outerlayer"], {
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "ignore"],
-        timeout: 2e3
-      }).trim();
-    } catch {
-      tracked = "";
-    }
-    if (tracked) {
-      const paths = tracked.split("\n");
-      const sample = paths.slice(0, 3).join(", ") + (paths.length > 3 ? ", \u2026" : "");
-      checks.push({
-        name,
-        status: "fail",
-        detail: `committed context files shadow the control plane: ${sample}`,
-        fix: `Remove the committed AGENTS.md/.claude/.outerlayer files in a commit, then run \`${cliInvocation()} context materialize\`.`
-      });
-    }
-  }
   return checks;
 }
 var PROTECT_DEFAULT_BRANCH_DOCS = "https://docs.outerlayer.ai/github-app-and-build-tokens#protect-the-default-branch";
@@ -1217,7 +1169,7 @@ function doctorExitCode(checks) {
 
 // src/doctor-report.ts
 async function gatherDoctorChecks() {
-  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-FXDG4NPJ.js');
+  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-CLSGABD5.js');
   const configPath = defaultRunnerConfigPath();
   const checks = runDoctor({ runnerHost: hasRunnerBlock(configPath) });
   const credential = await credentialChecks();
@@ -1229,7 +1181,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-2NQQML6P.js');
+    const { runnerHostChecks } = await import('./doctor-DHUM5DBB.js');
     const hooks = (() => {
       try {
         return loadRunnerConfig(configPath).hooks;
@@ -1264,7 +1216,7 @@ async function gatherDoctorChecks() {
       const { existsSync: existsSync3 } = await import('fs');
       if (process.platform !== "linux" || !existsSync3("/run/systemd/system")) return void 0;
       const { inspectService, realInspectProbes } = await import('./inspect-6UYAAXH7.js');
-      const { DEFAULT_UNIT_NAME } = await import('./install-CBWIEF3R.js');
+      const { DEFAULT_UNIT_NAME } = await import('./install-4SEFIIW2.js');
       const { dirname: dirname2 } = await import('path');
       return inspectService(DEFAULT_UNIT_NAME, dirname2(configPath), realInspectProbes());
     })();