@outerlayer/cli 0.19.1 → 0.22.0

package/dist/{chunk-GGOMT6KF.js → chunk-PHHBYAL6.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EXEC_PORT } from './chunk-X5H2WYMB.js';
+import { EXEC_PORT } from './chunk-BLW6GPBZ.js';
 import { createConnection } from 'net';
 
 createRequire(import.meta.url);

package/dist/{chunk-IF2OSI5T.js → chunk-QOALB6ZD.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-CG36IONK.js';
-import { resolveRepoIdentity } from './chunk-QNLX477Q.js';
+import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-JRCSET55.js';
 import { resolveGatewayCredentials } from './chunk-NTRCK4NH.js';
 import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
+import { resolveRepoIdentity } from './chunk-AEKSX4EY.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { openSync, fstatSync, readSync, closeSync } from 'fs';

package/dist/{chunk-BWSUPRDK.js → chunk-TPKYTORP.js}

@@ -4,6 +4,6 @@ import { createRequire } from 'node:module';
 createRequire(import.meta.url);
 
 // src/runner/protocol.ts
-var RUNNER_PROTOCOL = 20;
+var RUNNER_PROTOCOL = 22;
 
 export { RUNNER_PROTOCOL };

package/dist/{chunk-XNGMQ27R.js → chunk-UD3EXMKB.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EXEC_PORT } from './chunk-X5H2WYMB.js';
+import { EXEC_PORT } from './chunk-BLW6GPBZ.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
-import { RELAY_PORT } from './chunk-BQXFBI7T.js';
+import { RELAY_PORT } from './chunk-V7MQKOZY.js';
 import { spawn, spawnSync } from 'child_process';
 import { writeFileSync, chmodSync, mkdirSync } from 'fs';
 

package/dist/{chunk-7UWVLZXD.js → chunk-USWVXQIH.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { skillDir, FORMER_MAINTAINED_NAMES, isMaintainedCopy } from './chunk-NNLA7LLQ.js';
+import { skillDir, FORMER_MAINTAINED_NAMES, isMaintainedCopy } from './chunk-5OCIHFGE.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { emitTree, ALL_TARGET_IDS, classifyTree } from './chunk-WFSUUUAN.js';
 import { readFileSync, existsSync, unlinkSync, rmdirSync, readdirSync } from 'fs';

package/dist/{chunk-BQXFBI7T.js → chunk-V7MQKOZY.js}

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
+import { TARGET_TUNNEL, TARGET_LEASE, destinationTarget } from './chunk-GISNHSYL.js';
 import { existsSync, unlinkSync, chmodSync } from 'fs';
 import { request as request$1, createServer } from 'http';
 import { request } from 'https';
@@ -293,15 +294,20 @@ async function startDestination(input) {
     for (const socket of sockets) socket.destroy();
     await Promise.all(listeners.map((listener) => new Promise((resolve) => listener.close(() => resolve()))));
   };
-  return { ...served, close };
+  return { ...served, acceptStream: (stream) => void server.emit("connection", stream), close };
 }
 async function startBuildServices(input) {
+  const streamed = input.serve === "stream";
   const tunnel = await input.startTunnel(join(input.buildDir, "tunnel.sock"), {
     ...input.tunnelOptions,
+    ...streamed ? { socket: false } : {},
     ...input.allowHosts === void 0 ? {} : { allowHosts: input.allowHosts },
     recordPath: join(input.jobDir, "tunnel.json")
   });
   const servers = [];
+  const targets = /* @__PURE__ */ new Map();
+  if (streamed) targets.set(TARGET_TUNNEL, (stream) => tunnel.acceptStream(stream));
+  if (streamed && input.lease !== void 0) targets.set(TARGET_LEASE, (stream) => input.lease.accept(stream));
   const closeAll = async () => {
     await Promise.all(servers.map((s) => s.close()));
     await tunnel.close();
@@ -314,30 +320,39 @@ async function startBuildServices(input) {
     for (const [index, destination] of input.destinations.entries()) {
       const server = await startDestination({
         destination,
-        ...input.serve === "tcp" ? {} : { socketPath: destinationSocketPath(input.buildDir, index) },
-        ...input.serve === "socket" ? {} : { port: input.ports?.destinations?.[index] ?? 0 },
+        ...input.serve === "tcp" || streamed ? {} : { socketPath: destinationSocketPath(input.buildDir, index) },
+        ...input.serve === "socket" || streamed ? {} : { port: input.ports?.destinations?.[index] ?? 0 },
         hostEnv: input.hostEnv,
         onUsed: (name) => tunnel.destinationUsed(name),
         ...input.destinationOptions
       });
       servers.push(server);
+      targets.set(destinationTarget(index), (stream) => server.acceptStream(stream));
       if (server.port !== void 0) destinationPorts.push(server.port);
     }
     const builtIns = input.builtIns === void 0 ? [] : builtInDestinations({ gatewayUrl: input.builtIns.gatewayUrl, itemKey: input.builtIns.itemKey, hostEnv: input.hostEnv, claudeUpstream: input.builtIns.claudeUpstream });
     for (const builtIn of builtIns) {
       const server = await startDestination({
         destination: builtIn.destination,
-        ...input.serve === "tcp" ? {} : { socketPath: join(input.buildDir, builtIn.socket) },
-        ...input.serve === "socket" ? {} : { port: input.ports?.builtIns?.[builtIn.destination.name] ?? 0 },
+        ...input.serve === "tcp" || streamed ? {} : { socketPath: join(input.buildDir, builtIn.socket) },
+        ...input.serve === "socket" || streamed ? {} : { port: input.ports?.builtIns?.[builtIn.destination.name] ?? 0 },
         hostEnv: builtIn.hostEnv,
         drop: builtIn.drop,
         onUsed: (name) => tunnel.destinationUsed(name),
         ...input.destinationOptions
       });
       servers.push(server);
+      targets.set(builtIn.destination.name, (stream) => server.acceptStream(stream));
       if (server.port !== void 0) builtInPorts[builtIn.destination.name] = server.port;
     }
-    return { ...tunnel, proxyPort, destinationPorts, builtInPorts, close: closeAll };
+    return { ...tunnel, streams: {
+      accept: (target, stream) => {
+        const serve = targets.get(target);
+        if (serve === void 0) return false;
+        serve(stream);
+        return true;
+      }
+    }, proxyPort, destinationPorts, builtInPorts, close: closeAll };
   } catch (err) {
     await closeAll();
     throw err;
@@ -413,6 +428,16 @@ function parseClaimedRepositories(value) {
   const at = primaryAt === -1 ? 0 : primaryAt;
   return [{ ...parsed[at], primary: true }, ...parsed.filter((_, index) => index !== at).map((entry) => ({ ...entry, primary: false }))];
 }
+function parseUnreachable(value) {
+  if (!Array.isArray(value)) return [];
+  const entries = [];
+  for (const entry of value) {
+    if (typeof entry !== "object" || entry === null) continue;
+    const { repository, reason } = entry;
+    if (typeof repository === "string" && repository !== "" && typeof reason === "string") entries.push({ repository, reason });
+  }
+  return entries;
+}
 function repositoriesOf(input) {
   if (input.repositories !== void 0 && input.repositories.length > 0) return input.repositories;
   if (input.repository === void 0 || input.repository === null || input.repository === "" || input.branch === void 0) return [];
@@ -620,4 +645,4 @@ function withTunnelRecord(environment, record, onlyWhenUsed = false) {
   };
 }
 
-export { AGENT_CREDENTIAL_MISSING, BUILD_HOME, BUILT_IN_NAMES, CHECKOUT_DIR, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, EVAL_INPUT_DIR, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, RELAY_PORT, authorEnvironment, buildEnvironment, builtInEnvironment, checkEnvironment, checkoutPath, claudeCredential, commitIdentityRecord, containerLocalAddress, destinationEnvironment, headerVariables, isRefusedInConfig, isReservedVariable, lifecycleWorkdir, parseClaimIdentity, parseClaimedRepositories, parseIsolation, primaryOf, proxyEnvironment, repositoriesOf, repositoryPath, resolveDestinations, sharedUserEnvironment, startBuildServices, tokenHeader, withGitConfig, withHooksPath, withProxyWarningHidden, withTokenHeader, withTunnelRecord };
+export { AGENT_CREDENTIAL_MISSING, BUILD_HOME, BUILT_IN_NAMES, CHECKOUT_DIR, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, EVAL_INPUT_DIR, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, RELAY_PORT, authorEnvironment, buildEnvironment, builtInEnvironment, checkEnvironment, checkoutPath, claudeCredential, commitIdentityRecord, containerLocalAddress, destinationEnvironment, headerVariables, isRefusedInConfig, isReservedVariable, lifecycleWorkdir, parseClaimIdentity, parseClaimedRepositories, parseIsolation, parseUnreachable, primaryOf, proxyEnvironment, repositoriesOf, repositoryPath, resolveDestinations, sharedUserEnvironment, startBuildServices, tokenHeader, withGitConfig, withHooksPath, withProxyWarningHidden, withTokenHeader, withTunnelRecord };

package/dist/{chunk-6X4SQ5MY.js → chunk-V7SAQ645.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
+import { resolvePackRoot, loadTemplateFiles, loadMaintainedFiles, TEMPLATE_SKILLS, skillDir, writeMaintainedFiles, MAINTAINED_SKILLS } from './chunk-5OCIHFGE.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolvePackRoot, loadTemplateFiles, loadMaintainedFiles, TEMPLATE_SKILLS, skillDir, writeMaintainedFiles, MAINTAINED_SKILLS } from './chunk-NNLA7LLQ.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
 import { readFileSync, existsSync, mkdirSync, writeFileSync } from 'fs';

package/dist/{chunk-TWF3RICI.js → chunk-VSUXCMMH.js}

@@ -1,14 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { mcpTargetPath, INIT_STDIO_ENTRY, INIT_DOCS_ENTRY, DOCS_MCP_SERVER_NAME } from './chunk-YVZJ6GKF.js';
-import { POLICY_CONTENT, VALIDATOR_FILES, VALIDATORS_DIR, POLICY_PATH } from './chunk-6X4SQ5MY.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
-import { resolvePackRoot, loadTemplateFiles, skillDir } from './chunk-NNLA7LLQ.js';
+import { mcpTargetPath, INIT_STDIO_ENTRY, INIT_DOCS_ENTRY, DOCS_MCP_SERVER_NAME } from './chunk-DIB2WLBL.js';
+import { POLICY_CONTENT, VALIDATOR_FILES, VALIDATORS_DIR, POLICY_PATH } from './chunk-V7SAQ645.js';
+import { resolvePackRoot, skillDir, namesCore, loadTemplateFiles, TEMPLATE_SKILLS } from './chunk-5OCIHFGE.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
+import { hasSymlinkComponent } from './chunk-W3SWJ2TD.js';
 import { cloneIsGoverned } from './chunk-YQR6E6OV.js';
+import { emitTree, ALL_TARGET_IDS, classifyTree, splitRawFile } from './chunk-WFSUUUAN.js';
 import { createHash } from 'crypto';
 import { existsSync, readFileSync } from 'fs';
-import { join } from 'path';
+import { join, dirname } from 'path';
 
 createRequire(import.meta.url);
 var SHIPPED_MANIFEST = "shipped.json";
@@ -25,8 +27,9 @@ function currentStarterFiles(packRoot = resolvePackRoot(), policy = POLICY_CONTE
   });
   return [...templates, ...validators, { path: POLICY_PATH, content: policy }];
 }
+var TEMPLATE_VERSION = /(Copied once from the default template by outerlayer init) [^\s;]+(; never overwritten\.)/;
 function contentHash(content) {
-  return createHash("sha256").update(content.replace(/\r\n/g, "\n")).digest("hex");
+  return createHash("sha256").update(content.replace(/\r\n/g, "\n").replace(TEMPLATE_VERSION, "$1$2")).digest("hex");
 }
 function readShippedManifest(packRoot = resolvePackRoot()) {
   const path = join(packRoot, SHIPPED_MANIFEST);
@@ -95,13 +98,31 @@ function mcpItems(root) {
     return { ...base, state: "edited" };
   });
 }
+function retiredFiles(root, shipped, manifest) {
+  if (!manifest.ok) return [];
+  const current = new Set(shipped.map((f) => f.path));
+  const prefixes = TEMPLATE_SKILLS.map((skill) => `${skillDir(skill)}/`);
+  const retired = [];
+  for (const [path, hashes] of manifest.files) {
+    if (current.has(path) || !prefixes.some((prefix) => path.startsWith(prefix))) continue;
+    const abs = join(root, path);
+    if (!existsSync(abs) || hasSymlinkComponent(root, path)) continue;
+    try {
+      retired.push({ path, state: hashes.has(contentHash(readFileSync(abs, "utf8"))) ? "unedited" : "edited" });
+    } catch {
+    }
+  }
+  return retired.sort((a, b) => a.path.localeCompare(b.path));
+}
 function inspectStarterFiles(root, opts = {}) {
   const packRoot = opts.packRoot ?? resolvePackRoot();
   const manifest = readShippedManifest(packRoot);
-  const files = currentStarterFiles(packRoot).map(
-    (file) => ({ kind: "file", path: file.path, state: fileState(root, file, manifest), file })
-  );
-  return { items: [...files, ...mcpItems(root)], manifest: manifest.ok ? "ok" : manifest.problem };
+  const shipped = currentStarterFiles(packRoot);
+  const files = shipped.map((file) => ({ kind: "file", path: file.path, state: fileState(root, file, manifest), file }));
+  const buildEdited = files.some((f) => f.path === `${skillDir("build")}/SKILL.md` && f.state === "edited");
+  const buildPrefix = `${skillDir("build")}/`;
+  const retired = retiredFiles(root, shipped, manifest).filter((f) => !(buildEdited && f.path.startsWith(buildPrefix)));
+  return { items: [...files, ...mcpItems(root)], retired, manifest: manifest.ok ? "ok" : manifest.problem };
 }
 function itemLabel(item) {
   return item.kind === "file" ? item.path : `${item.path} "${item.server}" server`;
@@ -140,17 +161,19 @@ function checkStarterFiles(cwd, opts = {}) {
   const missing = by("missing");
   const edited = by("edited");
   const unreadable = by("unreadable");
+  const retired = report.retired.filter((f) => f.state === "unedited");
   const parts = [];
   if (current.length > 0) parts.push(`${current.length} current`);
   if (outdated.length > 0) parts.push(`outdated and unedited: ${shownPaths(outdated, report.items).join(", ")}`);
   if (missing.length > 0) parts.push(`missing: ${shownPaths(missing, report.items).join(", ")}`);
+  if (retired.length > 0) parts.push(`no longer shipped, unedited: ${retired.map((f) => f.path).join(", ")}`);
   if (edited.length > 0) parts.push(`edited by you, left as they are: ${edited.map(itemLabel).join(", ")}`);
   if (unreadable.length > 0) parts.push(`${unreadable[0].path} is not valid JSON, so its servers were not read`);
   if (report.manifest !== "ok") {
     parts.push(`this CLI's record of earlier versions is ${report.manifest}, so an outdated file cannot be told from an edited one`);
   }
   const mcpOutdated = outdated.some((i) => i.kind === "mcp" && i.server === "outerlayer");
-  const actionable = outdated.length + missing.length > 0;
+  const actionable = outdated.length + missing.length + retired.length > 0;
   const compare = edited.length > 0 ? ` Compare an edited file with this CLI's version: \`${UPDATE} --dry-run\`.` : "";
   if (!actionable && report.manifest === "ok") {
     return { checks: [{ name: NAME, status: "pass", detail: parts.join("; ") + (compare === "" ? "" : `.${compare}`) }], mcpOutdated };
@@ -158,5 +181,81 @@ function checkStarterFiles(cwd, opts = {}) {
   const fix = actionable ? `Run \`${UPDATE}\` to update the outdated files and write the missing ones. It never changes a file you edited.${compare}` : "Reinstall the CLI: `npm install -g @outerlayer/cli`, or run it with `npx -y @outerlayer/cli`.";
   return { checks: [{ name: NAME, status: "warn", detail: parts.join("; "), fix }], mcpOutdated };
 }
+var BUILD_PHASES = ["Intake", "Criteria", "Implement", "Review", "Pull request", "Evidence"];
+var CHANGES_HEADING = "## Changes for this repository";
+var NAME2 = "Build skill";
+function changeHeadings(text) {
+  const lines = text.split(/\r?\n/);
+  const start = lines.findIndex((line) => line.trim() === CHANGES_HEADING);
+  if (start === -1) return [];
+  const headings = [];
+  for (const line of lines.slice(start + 1)) {
+    if (/^## /.test(line)) break;
+    const match = /^### (.+?)\s*$/.exec(line);
+    if (match) headings.push(match[1]);
+  }
+  return headings;
+}
+function skillsFolders() {
+  const probe = `${skillDir("probe")}/SKILL.md`;
+  const compiled = emitTree({
+    entries: classifyTree([probe]).entries,
+    contents: /* @__PURE__ */ new Map([[probe, "---\nname: probe\ndescription: probe\n---\n"]]),
+    assetPaths: [],
+    targets: [...ALL_TARGET_IDS]
+  });
+  return [...new Set(compiled.files.map((file) => dirname(dirname(file.path))))].sort();
+}
+function shortBuild() {
+  const file = loadTemplateFiles().find((f) => f.path === `${skillDir("build")}/SKILL.md`);
+  if (file === void 0) return "";
+  return splitRawFile(file.content).body.split("\n").filter((line) => !line.startsWith("<!--")).join("\n").trim();
+}
+var read = (abs) => {
+  try {
+    return readFileSync(abs, "utf8");
+  } catch {
+    return void 0;
+  }
+};
+function checkBuildSkill(repoRoot) {
+  const folders = [".outerlayer/skills", ...skillsFolders()];
+  const source = `${folders[0]}/build/SKILL.md`;
+  const builds = (existsSync(join(repoRoot, source)) ? [source] : folders.slice(1).map((f) => `${f}/build/SKILL.md`)).map((path) => ({ path, text: read(join(repoRoot, path)) })).filter((b) => b.text !== void 0);
+  const checks = [];
+  const detached = builds.filter((b) => !namesCore(b.text));
+  if (detached.length > 0) {
+    checks.push({
+      name: NAME2,
+      status: "warn",
+      detail: `${detached.map((b) => b.path).join(", ")} does not name outerlayer-build, so it gets no updates from the core`,
+      fix: `Move to the short build, and put your own changes under the name of the phase each applies to:
+
+${shortBuild()}`
+    });
+  }
+  for (const build of builds.filter((b) => namesCore(b.text))) {
+    const unknown = changeHeadings(build.text).filter((heading) => !BUILD_PHASES.includes(heading));
+    if (unknown.length === 0) continue;
+    checks.push({
+      name: NAME2,
+      status: "warn",
+      detail: `${build.path} has ${unknown.map((h) => `"${h}"`).join(", ")} under "Changes for this repository", which matches no phase`,
+      fix: `Rename each heading to a phase: ${BUILD_PHASES.join(", ")}.`
+    });
+  }
+  const lacking = folders.filter(
+    (folder) => namesCore(read(join(repoRoot, folder, "build", "SKILL.md")) ?? "") && !existsSync(join(repoRoot, folder, "outerlayer-build", "SKILL.md"))
+  );
+  if (lacking.length > 0) {
+    checks.push({
+      name: NAME2,
+      status: "warn",
+      detail: `${lacking.join(", ")} holds build with no outerlayer-build beside it`,
+      fix: `Run \`${cliInvocation()} context emit\` to write outerlayer-build, then commit.`
+    });
+  }
+  return checks;
+}
 
-export { canonical, checkStarterFiles, contextIsGoverned, inspectStarterFiles };
+export { canonical, checkBuildSkill, checkStarterFiles, contentHash, contextIsGoverned, inspectStarterFiles, readShippedManifest, skillsFolders };

package/dist/{chunk-FVMYKL6L.js → chunk-VWLOQ6FI.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { readCloudConfig, cloudConfigPath } from './chunk-EABW6AJQ.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { signRunnerRequest, signerFor } from './chunk-M2ZWWTWZ.js';
+import { signRunnerRequest, signerFor } from './chunk-KDHYLBRR.js';
 
 createRequire(import.meta.url);