@outerlayer/cli 0.2.0 → 0.4.0

package/dist/chunk-BFESLKPP.js

@@ -0,0 +1,61 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { openSync, fstatSync, readSync, closeSync } from 'fs';
+import { join } from 'path';
+
+createRequire(import.meta.url);
+var SESSION_DETECT_TAIL_BYTES = 64 * 1024;
+var SESSION_DETECT_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
+var readTail = (path, maxBytes) => {
+  try {
+    const fd = openSync(path, "r");
+    try {
+      const size = fstatSync(fd).size;
+      const length = Math.min(size, maxBytes);
+      const data = Buffer.alloc(length);
+      readSync(fd, data, 0, length, size - length);
+      return { data, truncated: size > length };
+    } finally {
+      closeSync(fd);
+    }
+  } catch {
+    return void 0;
+  }
+};
+function detectActiveSession(opts) {
+  if (!opts.env.CLAUDECODE) return void 0;
+  const read = opts.readTailImpl ?? readTail;
+  const tail = read(join(opts.home, ".outerlayer", "spool", "events.jsonl"), SESSION_DETECT_TAIL_BYTES);
+  if (!tail || tail.data.length === 0) return void 0;
+  let lines = tail.data.toString("utf8").split("\n");
+  if (tail.truncated) lines = lines.slice(1);
+  const records = [];
+  for (const line of lines) {
+    const text = line.trim();
+    if (!text) continue;
+    try {
+      records.push(JSON.parse(text));
+    } catch {
+      continue;
+    }
+  }
+  const ended = /* @__PURE__ */ new Set();
+  for (const record of records) {
+    if (record.event === "SessionEnd" && typeof record.sessionId === "string" && record.sessionId !== "") {
+      ended.add(record.sessionId);
+    }
+  }
+  let newest;
+  for (const record of records) {
+    if (typeof record.sessionId !== "string" || record.sessionId === "") continue;
+    if (record.event === "SessionEnd" || ended.has(record.sessionId)) continue;
+    if (typeof record.cwd !== "string" || !opts.cwds.includes(record.cwd)) continue;
+    if (typeof record.t !== "string") continue;
+    const tMs = Date.parse(record.t);
+    if (!Number.isFinite(tMs) || opts.nowMs - tMs > SESSION_DETECT_MAX_AGE_MS) continue;
+    newest = record.sessionId;
+  }
+  return newest;
+}
+
+export { detectActiveSession };

package/dist/chunk-BJ3KTMDH.js

@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { statSync, readFileSync, existsSync, mkdirSync, writeFileSync, chmodSync } from 'fs';
+import { join, isAbsolute, dirname } from 'path';
+
+createRequire(import.meta.url);
+function findGitDirs(cwd) {
+  let dir = cwd;
+  for (; ; ) {
+    const gitPath = join(dir, ".git");
+    let stat;
+    try {
+      stat = statSync(gitPath);
+    } catch {
+      stat = void 0;
+    }
+    if (stat?.isDirectory()) return { repoRoot: dir, gitCommonDir: gitPath };
+    if (stat?.isFile()) {
+      try {
+        const content = readFileSync(gitPath, "utf8").trim();
+        const match = /^gitdir:\s*(.+)$/.exec(content);
+        if (match) {
+          const gitdir = isAbsolute(match[1]) ? match[1] : join(dir, match[1]);
+          try {
+            const commondir = readFileSync(join(gitdir, "commondir"), "utf8").trim();
+            return { repoRoot: dir, gitCommonDir: isAbsolute(commondir) ? commondir : join(gitdir, commondir) };
+          } catch {
+            return { repoRoot: dir, gitCommonDir: gitdir };
+          }
+        }
+      } catch {
+      }
+    }
+    const parent = dirname(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+}
+function connectionPath(gitCommonDir) {
+  return join(gitCommonDir, "outerlayer", "connection.json");
+}
+function readRepoConnection(cwd) {
+  try {
+    const dirs = findGitDirs(cwd);
+    if (dirs === void 0) return void 0;
+    const parsed = JSON.parse(readFileSync(connectionPath(dirs.gitCommonDir), "utf8"));
+    if (typeof parsed?.appId !== "string" || parsed.appId === "") return void 0;
+    return parsed;
+  } catch {
+    return void 0;
+  }
+}
+function writeRepoConnection(gitCommonDir, connection) {
+  const path = connectionPath(gitCommonDir);
+  if (!existsSync(dirname(path))) mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, JSON.stringify(connection, null, 2) + "\n", { mode: 384 });
+  try {
+    chmodSync(path, 384);
+  } catch {
+  }
+}
+
+export { findGitDirs, readRepoConnection, writeRepoConnection };

package/dist/chunk-BKO6JEZI.js

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { mkdirSync, writeFileSync, renameSync, unlinkSync, readFileSync } from 'fs';
+import { join } from 'path';
+
+createRequire(import.meta.url);
+var SAFE_SESSION_ID = /^[A-Za-z0-9_-]+$/;
+function reportedCostDir(home) {
+  return join(home, ".outerlayer", "reported-cost");
+}
+function reportedCostPath(home, sessionId) {
+  return join(reportedCostDir(home), `${sessionId}.json`);
+}
+function recordReportedCost(home, sessionId, costUsd) {
+  if (typeof sessionId !== "string" || !SAFE_SESSION_ID.test(sessionId)) return;
+  if (!Number.isFinite(costUsd) || costUsd < 0) return;
+  if (readReportedCost(home, sessionId) === costUsd) return;
+  const target = reportedCostPath(home, sessionId);
+  const tmp = `${target}.${process.pid}.tmp`;
+  try {
+    mkdirSync(reportedCostDir(home), { recursive: true });
+    writeFileSync(tmp, JSON.stringify({ costUsd, recordedAt: (/* @__PURE__ */ new Date()).toISOString() }));
+    renameSync(tmp, target);
+  } catch {
+    try {
+      unlinkSync(tmp);
+    } catch {
+    }
+  }
+}
+function readReportedCost(home, sessionId) {
+  if (!SAFE_SESSION_ID.test(sessionId)) return null;
+  try {
+    const parsed = JSON.parse(readFileSync(reportedCostPath(home, sessionId), "utf8"));
+    return Number.isFinite(parsed.costUsd) && parsed.costUsd >= 0 ? parsed.costUsd : null;
+  } catch {
+    return null;
+  }
+}
+function applyReportedCost(session, home) {
+  if (session.agent.type !== "claude-code" || session.subagent?.parentSessionId) return;
+  const costUsd = readReportedCost(home, session.id);
+  if (costUsd === null) return;
+  session.totals.agentReportedCostUsd = costUsd;
+}
+
+export { applyReportedCost, recordReportedCost };

package/dist/chunk-BOLTI6LR.js

@@ -0,0 +1,37 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { readCloudConfig } from './chunk-EABW6AJQ.js';
+import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
+import { homeFromEnv } from './chunk-VNVZDWO3.js';
+
+createRequire(import.meta.url);
+
+// src/credentials.ts
+var MISSING_HELP = "Run `outerlayer login` to sign in, or set OUTERLAYER_URL / OUTERLAYER_API_KEY / OUTERLAYER_APP_ID. Mint a key in the dashboard: Settings \u2192 API keys.";
+var NO_FACTORY_MESSAGE = "you are logged in, but no factory is chosen for this repository. Run `outerlayer connect` to choose one, or pass --app-id / set OUTERLAYER_APP_ID.";
+var NO_FACTORY_OUTSIDE_REPOSITORY_MESSAGE = "you are logged in, but this directory is not in a git repository, so no factory is chosen. Pass --app-id / set OUTERLAYER_APP_ID, or run this from inside a connected repository.";
+var LOGIN_TOKEN_PREFIX = "olu_";
+function unauthorizedMessage(credential) {
+  return credential.startsWith(LOGIN_TOKEN_PREFIX) ? "not authorized \u2014 the login is expired or was revoked. Run `outerlayer login` to sign in again." : "not authorized \u2014 the API key is unknown, expired, or bound to a different factory. Mint a fresh key: dashboard \u2192 Settings \u2192 API keys.";
+}
+function resolveGatewayCredentials(sources = {}) {
+  const env = sources.env ?? process.env;
+  const config = readCloudConfig(sources.home ?? homeFromEnv(env));
+  const url = sources.url ?? env.OUTERLAYER_URL ?? config.url;
+  const key = sources.apiKey ?? (env.OUTERLAYER_API_KEY || void 0) ?? config.apiKey;
+  const kind = key ? "key" : "login";
+  const credential = key ?? config.accountToken;
+  const cwd = sources.cwd ?? process.cwd();
+  const appId = sources.appId ?? (env.OUTERLAYER_APP_ID || void 0) ?? (kind === "key" ? config.appId : readRepoConnection(cwd)?.appId);
+  if (credential && url && !appId && kind === "login") {
+    const message = findGitDirs(cwd) === void 0 ? NO_FACTORY_OUTSIDE_REPOSITORY_MESSAGE : NO_FACTORY_MESSAGE;
+    return { ok: false, message, url, credential, appId, kind };
+  }
+  if (!url || !credential || !appId) {
+    const missing = [!url && "--url", !credential && "--api-key", !appId && "--app-id"].filter(Boolean).join(", ");
+    return { ok: false, message: `missing ${missing}. ${MISSING_HELP}`, url, credential, appId, kind };
+  }
+  return { ok: true, url, credential, appId, kind };
+}
+
+export { resolveGatewayCredentials, unauthorizedMessage };

package/dist/chunk-CBPPJSAR.js

@@ -0,0 +1,89 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { EXEC_PORT } from './chunk-B2G7JHHB.js';
+import { RELAY_PORT } from './chunk-AUFG23AA.js';
+import { spawn, spawnSync } from 'child_process';
+import { writeFileSync, chmodSync, mkdirSync } from 'fs';
+
+createRequire(import.meta.url);
+var HELPER_PATH = "/opt/outerlayer/bin/outerlayer-guest";
+var KERNEL_FLAG = "outerlayer.relay";
+var DOCKER_FLAG = "outerlayer.docker";
+var DOCKERD_CONFIG = "/run/outerlayer-dockerd.json";
+var DOCKERD_LOG = "/run/dockerd.log";
+var DOCKER_DATA_ROOT = "/build/docker";
+var BUILD_DISK = "/dev/vdb";
+var HOSTNAME = "outerlayer-build";
+var HOSTS = "127.0.0.1 localhost\n::1 localhost ip6-localhost ip6-loopback\n";
+var RESOLV_CONF = "# This microVM has no network device. Names are resolved by the runner's proxy.\n";
+var BUILD_DIRECTORIES = ["/build/tmp", "/build/home", "/build/work"];
+var WORLD_WRITABLE = 1023;
+function relayPortsFrom(cmdline) {
+  const value = new RegExp(`(?:^|\\s)${KERNEL_FLAG.replace(".", "\\.")}=(\\S*)`).exec(cmdline)?.[1];
+  if (value === void 0 || value === "") return [];
+  return value.split(",").map((text) => {
+    const port = Number(text);
+    if (!/^\d+$/.test(text) || port < 1 || port > 65535) throw new Error(`${KERNEL_FLAG} on the kernel command line names ${JSON.stringify(text)}, which is not a port`);
+    return port;
+  });
+}
+function dockerRequestedBy(cmdline) {
+  return new RegExp(`(?:^|\\s)${DOCKER_FLAG.replace(".", "\\.")}=1(?:\\s|$)`).test(cmdline);
+}
+function startDocker(host) {
+  const proxy = `http://127.0.0.1:${RELAY_PORT}`;
+  host.mount({ source: "cgroup2", target: "/sys/fs/cgroup", type: "cgroup2" });
+  host.mkdir(DOCKER_DATA_ROOT, 457);
+  host.writeFile(
+    DOCKERD_CONFIG,
+    `${JSON.stringify({ "data-root": DOCKER_DATA_ROOT, proxies: { "http-proxy": proxy, "https-proxy": proxy, "no-proxy": "localhost,127.0.0.1" } }, null, 2)}
+`
+  );
+  host.spawnDetached(["/bin/sh", "-c", `exec dockerd --config-file ${DOCKERD_CONFIG} >${DOCKERD_LOG} 2>&1`]);
+}
+function runGuestInit(host, cmdline) {
+  const ports = relayPortsFrom(cmdline);
+  host.mount({ source: BUILD_DISK, target: "/build", type: "ext4" });
+  host.chmod("/build", WORLD_WRITABLE);
+  for (const path of BUILD_DIRECTORIES) {
+    host.mkdir(path, WORLD_WRITABLE);
+    host.chmod(path, WORLD_WRITABLE);
+  }
+  host.mount({ source: "/build/tmp", target: "/tmp", bind: true });
+  const files = [
+    ["hosts", HOSTS],
+    ["hostname", `${HOSTNAME}
+`],
+    ["resolv.conf", RESOLV_CONF]
+  ];
+  for (const [name, text] of files) {
+    host.writeFile(`/run/${name}`, text);
+    host.mount({ source: `/run/${name}`, target: `/etc/${name}`, bind: true });
+  }
+  host.writeFile("/proc/sys/kernel/hostname", HOSTNAME);
+  host.mount({ source: "tmpfs", target: "/outerlayer/job", type: "tmpfs", options: "mode=0755" });
+  host.spawnDetached([HELPER_PATH, "relay", ...ports.flatMap((port) => ["--forward", String(port)])]);
+  if (dockerRequestedBy(cmdline)) startDocker(host);
+  host.spawnDetached([HELPER_PATH, "exec-agent", "--port", String(EXEC_PORT)]);
+}
+function realGuestHost() {
+  return {
+    mount(args) {
+      const argv = ["mount", "--target", args.target];
+      if (args.source !== void 0) argv.push("--source", args.source);
+      if (args.type !== void 0) argv.push("--type", args.type);
+      if (args.options !== void 0) argv.push("--options", args.options);
+      if (args.bind === true) argv.push("--bind");
+      const result = spawnSync(HELPER_PATH, argv, { encoding: "utf8" });
+      if (result.status !== 0) throw new Error(`mounting ${args.target} failed: ${result.stderr.trim()}`);
+    },
+    mkdir: (path, mode) => void mkdirSync(path, { recursive: true, mode }),
+    chmod: (path, mode) => chmodSync(path, mode),
+    writeFile: (path, text) => writeFileSync(path, text),
+    spawnDetached(argv) {
+      spawn(argv[0], argv.slice(1), { detached: true, stdio: ["ignore", "inherit", "inherit"] }).unref();
+    }
+  };
+}
+
+export { DOCKERD_LOG, HELPER_PATH, realGuestHost, relayPortsFrom, runGuestInit };

package/dist/chunk-CBZB6XY6.js

@@ -0,0 +1,102 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-L2DBRKRA.js';
+import { MIN_ENGINE_MAJOR } from './chunk-7A6RVXPZ.js';
+import { RUNNER_DIR_MODE, runnerDir, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
+import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
+import { dirname } from 'path';
+
+createRequire(import.meta.url);
+var RunnerInitError = class extends Error {
+};
+var UNMARKED_PLACEHOLDER_COMMAND = "echo 'edit runner.commands in this config file: it must start your agent on item $OUTERLAYER_WORK' >&2; exit 1";
+var PLACEHOLDER_MARKER = "outerlayer-placeholder";
+var PLACEHOLDER_COMMAND = `${UNMARKED_PLACEHOLDER_COMMAND} # ${PLACEHOLDER_MARKER}`;
+function isolationNote(machine) {
+  const has = describeMachineDocker(machine);
+  const reach = reachDockerStep(machine);
+  const needs = reach !== void 0 ? `Isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later: ${reach}, then set both hooks to builtin:container.` : machine.platform === "windows" ? `Isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later inside WSL2: install it there, run the runner from a WSL2 shell, and set both hooks to builtin:container.` : `Isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later on Linux or WSL2. Once it is installed, set both hooks to builtin:container.`;
+  return `This machine has ${has}, so builds run as processes under this user (isolation: shared-user), through the tunnel. ${needs}`;
+}
+function processRefusal(machine) {
+  const reach = reachDockerStep(machine);
+  const needs = machine.platform === "darwin" ? "Isolated builds on a Mac run in a Linux VM: run this again with --vm." : reach !== void 0 ? `Isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later: ${reach}, then run this again.` : machine.platform === "windows" ? `Isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later inside WSL2: install it there, then run this again from a WSL2 shell.` : `Isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later on Linux or WSL2: install it, then run this again.`;
+  return `This machine has ${describeMachineDocker(machine)}, so it cannot isolate a build. ${needs} To run builds as processes under this user instead, where a build can read this user's files and the runner's Claude credential, run this again with --allow-process-builds.`;
+}
+function isPlaceholderCommand(command) {
+  return command === UNMARKED_PLACEHOLDER_COMMAND || command.includes(PLACEHOLDER_MARKER);
+}
+function readConfigObject(configPath) {
+  if (!existsSync(configPath)) {
+    throw new RunnerInitError(
+      `${configPath}: no config file. Run \`outerlayer login\` first, then this command.`
+    );
+  }
+  try {
+    return JSON.parse(readFileSync(configPath, "utf8"));
+  } catch (err) {
+    throw new RunnerInitError(`${configPath}: not valid JSON (${err instanceof Error ? err.message : String(err)})`);
+  }
+}
+function parseStdinConfig(configPath, text) {
+  if (existsSync(configPath)) {
+    throw new RunnerInitError(
+      `${configPath}: a config file is already here, so the runner key in it is not replaced. Remove it, or delete the VM and start again.`
+    );
+  }
+  let config;
+  try {
+    config = JSON.parse(text);
+  } catch (err) {
+    throw new RunnerInitError(`the config on stdin is not valid JSON (${err instanceof Error ? err.message : String(err)})`);
+  }
+  if (typeof config.url !== "string" || typeof config.apiKey !== "string" || typeof config.appId !== "string") {
+    throw new RunnerInitError("the config on stdin needs url, apiKey and appId.");
+  }
+  const carried = config.runner;
+  delete config.runner;
+  return { config, carried };
+}
+function runRunnerInit(configPath, opts = {}) {
+  let config;
+  let carried;
+  if (opts.configFromStdin === void 0) {
+    config = readConfigObject(configPath);
+    if (config.runner !== void 0) {
+      throw new RunnerInitError(`${configPath}: a runner block is already here. Edit it, or remove it and run this again.`);
+    }
+  } else {
+    ({ config, carried } = parseStdinConfig(configPath, opts.configFromStdin));
+  }
+  const machine = opts.machine ?? detectMachine();
+  if (opts.requireContainer === true && !supportsContainerBuilds(machine)) {
+    const fix = reachDockerStep(machine) ?? `install Docker Engine ${MIN_ENGINE_MAJOR} or later in the VM`;
+    throw new RunnerInitError(`the VM has ${describeMachineDocker(machine)}, but the runner in it needs container builds: ${fix}, then run this again.`);
+  }
+  const hooks = opts.requireContainer !== true && supportsMicroVmBuilds(machine) ? "builtin:vm" : supportsContainerBuilds(machine) ? "builtin:container" : "builtin:process";
+  if (hooks === "builtin:process" && opts.allowProcess !== true) throw new RunnerInitError(processRefusal(machine));
+  if (opts.configFromStdin !== void 0) mkdirSync(dirname(configPath), { recursive: true, mode: RUNNER_DIR_MODE });
+  mkdirSync(runnerDir(configPath), { recursive: true, mode: RUNNER_DIR_MODE });
+  config.runner = {
+    queues: ["implement", "amend"],
+    concurrency: 1,
+    pollSeconds: 60,
+    timeLimitMinutes: 480,
+    idleLimitMinutes: 30,
+    // A placeholder that fails loudly. A command line that quietly did
+    // nothing would claim an item, run, exit zero, and record `ok` —
+    // every attempt reading as a success that produced nothing.
+    commands: {
+      implement: PLACEHOLDER_COMMAND,
+      amend: PLACEHOLDER_COMMAND
+    },
+    ...carried,
+    hooks: { provision: hooks, cleanup: hooks }
+  };
+  mkdirSync(dirname(configPath), { recursive: true });
+  writeFileSync(configPath, `${JSON.stringify(config, null, 2)}
+`, { mode: RUNNER_FILE_MODE });
+  return { configPath, hooks, ...hooks === "builtin:process" ? { note: isolationNote(machine) } : {} };
+}
+
+export { PLACEHOLDER_MARKER, RunnerInitError, isPlaceholderCommand, readConfigObject, runRunnerInit };

package/dist/{chunk-65WXAANR.js → chunk-DVDEBNQJ.js}

@@ -5,7 +5,7 @@ import { mkdirSync, appendFileSync, readFileSync } from 'fs';
 import { join } from 'path';
 
 createRequire(import.meta.url);
-var HOW_TO_CREATE_AN_ITEM = "outerlayer work add";
+var HOW_TO_CREATE_AN_ITEM = "outerlayer work build --local";
 function parseWorkItemEnv(raw) {
   if (raw === void 0) return { reason: "OUTERLAYER_WORK is not set" };
   const value = raw.trim();
@@ -58,6 +58,21 @@ function launchedItemForSession(sessionId, home, readImpl = readLaunchSpool) {
   }
   return found;
 }
+function launchedItemsBySession(home, readImpl = readLaunchSpool) {
+  const items = /* @__PURE__ */ new Map();
+  const read = readImpl(launchesPath(home));
+  if (read.kind !== "read") return items;
+  for (const line of read.text.split("\n")) {
+    try {
+      const record = JSON.parse(line);
+      if (typeof record.sessionId === "string" && typeof record.item === "number") {
+        items.set(record.sessionId, record.item);
+      }
+    } catch {
+    }
+  }
+  return items;
+}
 function readLaunchSpoolState(home, readImpl = readLaunchSpool) {
   const ids = /* @__PURE__ */ new Set();
   const read = readImpl(launchesPath(home));
@@ -78,4 +93,4 @@ function readLaunchSpoolState(home, readImpl = readLaunchSpool) {
   return { ids, ...malformedLines > 0 ? { malformedLines } : {} };
 }
 
-export { appendLaunchRecord, launchStatusIsDecisive, launchedItemForSession, launchesPath, parseWorkItemEnv, readLaunchSpoolState };
+export { appendLaunchRecord, launchStatusIsDecisive, launchedItemForSession, launchedItemsBySession, launchesPath, parseWorkItemEnv, readLaunchSpoolState };

package/dist/{work-pr-cmd-AZQPWH4H.js → chunk-DVYHCMB2.js}

@@ -1,18 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectActiveSession } from './chunk-U32VSRLO.js';
-import { resolveRepoIdentity } from './chunk-4TNZMO7V.js';
-import './chunk-YRYMNBGQ.js';
-import './chunk-65WXAANR.js';
+import { detectActiveSession } from './chunk-BFESLKPP.js';
+import { resolveRepoIdentity } from './chunk-G7FSV7JX.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
-import './chunk-ZJSNLVCE.js';
-import './chunk-NXLLURA4.js';
-import './chunk-I3ETLSNE.js';
-import './chunk-YOOSBOKS.js';
-import './chunk-R5KBGVII.js';
-import { readCloudConfig } from './chunk-TFUIDMOB.js';
+import { defaultFetch } from './chunk-BCLJSQCV.js';
+import { unauthorizedMessage, resolveGatewayCredentials } from './chunk-BOLTI6LR.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);
 
@@ -23,19 +16,9 @@ var RESET = "\x1B[0m";
 var WorkPrCommandError = class extends Error {
 };
 function resolveCredentials(opts) {
-  const home = opts.home ?? homeFromEnv();
-  const env = opts.env ?? process.env;
-  const fileConfig = readCloudConfig(home);
-  const url = opts.url ?? env.OUTERLAYER_URL ?? fileConfig.url;
-  const apiKey = opts.apiKey ?? env.OUTERLAYER_API_KEY ?? fileConfig.apiKey;
-  const appId = opts.appId ?? env.OUTERLAYER_APP_ID ?? fileConfig.appId;
-  if (!url || !apiKey || !appId) {
-    const missing = [!url && "--url", !apiKey && "--api-key", !appId && "--app-id"].filter(Boolean).join(", ");
-    throw new WorkPrCommandError(
-      `missing ${missing}. Run \`outerlayer login --url <your gateway>\` and paste the key at the prompt, or set OUTERLAYER_URL / OUTERLAYER_API_KEY / OUTERLAYER_APP_ID. Mint a key in the dashboard: Settings \u2192 API keys.`
-    );
-  }
-  return { url, apiKey, appId };
+  const resolved = resolveGatewayCredentials(opts);
+  if (!resolved.ok) throw new WorkPrCommandError(resolved.message);
+  return { url: resolved.url, apiKey: resolved.credential, appId: resolved.appId };
 }
 function resolveRepository(repoFlag, cwd) {
   if (repoFlag) return repoFlag;
@@ -69,7 +52,7 @@ async function runWorkPr(opts) {
       "no active session detected. `work pr` declares a pull request from inside the session that opened it."
     );
   }
-  const fetchImpl = opts.fetchImpl ?? fetch;
+  const fetchImpl = opts.fetchImpl ?? defaultFetch;
   const endpoint = new URL("/v1/work-items/pull-requests", creds.url).toString();
   let response;
   try {
@@ -87,7 +70,7 @@ async function runWorkPr(opts) {
   }
   if (response.status === 401) {
     throw new WorkPrCommandError(
-      "not authorized \u2014 the API key is unknown, expired, or bound to a different app. Mint a fresh key: dashboard \u2192 Settings \u2192 API keys."
+      unauthorizedMessage(creds.apiKey)
     );
   }
   let json;

package/dist/{chunk-TFUIDMOB.js → chunk-EABW6AJQ.js}

@@ -30,5 +30,16 @@ function writeCloudConfig(config, home = homeFromEnv()) {
   } catch {
   }
 }
+function removeCloudConfigKeys(keys, home = homeFromEnv()) {
+  const path = cloudConfigPath(home);
+  if (!existsSync(path)) return;
+  const stored = { ...readCloudConfig(home) };
+  for (const key of keys) delete stored[key];
+  writeFileSync(path, JSON.stringify(stored, null, 2) + "\n", { mode: 384 });
+  try {
+    chmodSync(path, 384);
+  } catch {
+  }
+}
 
-export { cloudConfigPath, readCloudConfig, writeCloudConfig };
+export { cloudConfigPath, readCloudConfig, removeCloudConfigKeys, writeCloudConfig };

package/dist/{chunk-KFYJV2ZG.js → chunk-EMY4I27X.js}

@@ -7975,4 +7975,4 @@ function normalizeRepoName(repo) {
 var CONTEXT_PIN_FILENAME = ".outerlayer-pin.json";
 var CONTEXT_PIN_SCHEMA_VERSION = 1;
 
-export { CONTEXT_PIN_FILENAME, CONTEXT_PIN_SCHEMA_VERSION, CONTEXT_SOURCE_CONFIG_PATH, classifyTree, emitTree, generatedHeaderSource, normalizePath, normalizeRepoName, parseGoverns, parseOuterlayerConfig };
+export { CONTEXT_PIN_FILENAME, CONTEXT_PIN_SCHEMA_VERSION, CONTEXT_SOURCE_CONFIG_PATH, classifyTree, emitTree, generatedHeaderSource, normalizePath, normalizeRepoName, parseGoverns, parseOuterlayerConfig, splitRawFile };

package/dist/{chunk-NTTPJV35.js → chunk-F47JBIAW.js}

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { decodeWrappedCommand } from './chunk-R5KBGVII.js';
+import { recordReportedCost } from './chunk-BKO6JEZI.js';
+import { decodeWrappedCommand } from './chunk-5QRP3MVS.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { readFileSync } from 'fs';
 import { spawn } from 'child_process';
@@ -133,6 +134,7 @@ async function runStatuslineFast(args, opts = {}) {
     const now = (opts.now ?? Date.now)();
     const stdinText = (opts.read ?? readStdin)();
     const stdin = parseStatuslineStdin(stdinText);
+    recordReportedCost(home, stdin.session_id, stdin.cost?.total_cost_usd);
     const state = readStatuslineState(home);
     const ourLine = renderStatusline(stdin, state, now);
     const { wrapId } = parseStatuslineArgs(args);

package/dist/chunk-F6GFZXZ3.js

@@ -0,0 +1,60 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+
+createRequire(import.meta.url);
+
+// src/runner/container/disk.ts
+var UNITS = { "": 1, k: 1024, m: 1024 ** 2, g: 1024 ** 3 };
+function parseSize(text) {
+  const match = /^(\d+(?:\.\d+)?)([kKmMgG]?)$/.exec(text);
+  if (match === null) return void 0;
+  const bytes = Number(match[1]) * UNITS[match[2].toLowerCase()];
+  return bytes > 0 ? bytes : void 0;
+}
+function parseDuKilobytes(output) {
+  const match = /^(\d+)\s/.exec(output);
+  return match === null ? void 0 : Number(match[1]);
+}
+function exceedsDisk(usedKilobytes, limit) {
+  const bytes = parseSize(limit);
+  return usedKilobytes * 1024 > (bytes ?? Number.POSITIVE_INFINITY);
+}
+
+// src/runner/allow-hosts.ts
+var MAX_ALLOW_HOSTS = 500;
+var LABEL = /^(?!-)[a-z0-9-]{1,63}(?<!-)$/;
+var IPV4 = /^(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)$/;
+function isAddress(text) {
+  if (IPV4.test(text)) return true;
+  try {
+    new URL(`http://[${text}]/`);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function isHostName(text) {
+  const labels = text.split(".");
+  return text.length <= 253 && labels.every((label) => LABEL.test(label)) && !/^\d+$/.test(labels.at(-1));
+}
+function allowHostProblem(entry) {
+  if (typeof entry !== "string") return "is not a string";
+  const text = entry.toLowerCase();
+  if (isAddress(text)) return void 0;
+  if (text.startsWith("*.")) {
+    const domain = text.slice(2);
+    if (!isHostName(domain)) return "is not a host name after *.";
+    if (!domain.includes(".")) return "is too broad: a pattern needs a domain with at least two labels after *.";
+    return void 0;
+  }
+  return isHostName(text) ? void 0 : "is not a host name, a *. pattern or an IP address";
+}
+function hostAllowed(host, allowHosts) {
+  const name = host.toLowerCase().replace(/\.$/, "");
+  return allowHosts.some((entry) => {
+    const pattern = entry.toLowerCase();
+    return pattern.startsWith("*.") ? name.endsWith(pattern.slice(1)) : name === pattern;
+  });
+}
+
+export { MAX_ALLOW_HOSTS, allowHostProblem, exceedsDisk, hostAllowed, parseDuKilobytes, parseSize };

package/dist/{chunk-YOOSBOKS.js → chunk-F7CU5ABH.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { decodeWrappedCommand } from './chunk-R5KBGVII.js';
+import { decodeWrappedCommand } from './chunk-5QRP3MVS.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { readFileSync, mkdirSync, appendFileSync, writeFileSync } from 'fs';
 import { spawn } from 'child_process';