@outerlayer/cli 0.2.0 → 0.4.0

package/dist/chunk-OGFGZQA3.js

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { readFileSync } from 'fs';
+import { dirname, join } from 'path';
+import { fileURLToPath } from 'url';
+
+createRequire(import.meta.url);
+function currentCliBuild(entryPath = fileURLToPath(import.meta.url)) {
+  const distDir = dirname(entryPath);
+  const read = (path) => {
+    try {
+      return JSON.parse(readFileSync(path, "utf8"));
+    } catch {
+      return {};
+    }
+  };
+  const id = read(join(distDir, "build-info.json")).id;
+  if (typeof id === "string" && id !== "") return { distDir, buildId: id };
+  const version = read(join(dirname(distDir), "package.json")).version;
+  return { distDir, buildId: `${typeof version === "string" ? version : "unknown"}+unstamped` };
+}
+
+export { currentCliBuild };

package/dist/chunk-QOZKPLVJ.js

@@ -0,0 +1,226 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { existsSync, readdirSync, readFileSync, lstatSync, realpathSync, writeFileSync } from 'fs';
+import { join, resolve, relative, sep, basename, dirname } from 'path';
+
+createRequire(import.meta.url);
+
+// src/runner/image/properties.ts
+var LIFECYCLE = ["onCreateCommand", "updateContentCommand", "postCreateCommand", "postStartCommand"];
+var HONOURED = ["image", "build", "features", "containerEnv", "remoteUser", ...LIFECYCLE];
+var IGNORED_BUILD_KEYS = ["options"];
+var HOST_REFERENCE = /\$\{(?:localEnv|env)[:}]/;
+var DROP = /* @__PURE__ */ Symbol("drop");
+function isHonoured(property) {
+  return HONOURED.includes(property);
+}
+function isObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function featureName(id) {
+  const slash = id.lastIndexOf("/");
+  const cut = id.slice(slash + 1).search(/[:@]/);
+  return cut === -1 ? id : id.slice(0, slash + 1 + cut);
+}
+var DOCKER_FEATURE = "ghcr.io/devcontainers/features/docker-in-docker";
+function asksForDocker(recipe, metadata) {
+  const isDocker = (id) => featureName(id) === DOCKER_FEATURE;
+  if (isObject(recipe.features) && Object.keys(recipe.features).some(isDocker)) return true;
+  return metadata.some((entry) => typeof entry.id === "string" && isDocker(entry.id));
+}
+function sameValue(a, b) {
+  return JSON.stringify(a) === JSON.stringify(b);
+}
+function isFilesOwnEntry(entry, recipe) {
+  if (typeof entry.id === "string") return false;
+  const keys = Object.keys(entry);
+  return keys.length > 0 && keys.every((key) => key in recipe && sameValue(entry[key], recipe[key]));
+}
+function withoutHostReferences(value, path, dropped) {
+  if (typeof value === "string") {
+    if (!HOST_REFERENCE.test(value)) return value;
+    dropped.push(path);
+    return DROP;
+  }
+  if (Array.isArray(value)) {
+    if (!HOST_REFERENCE.test(JSON.stringify(value))) return value;
+    dropped.push(path);
+    return DROP;
+  }
+  if (isObject(value)) {
+    const kept = {};
+    for (const [key, item] of Object.entries(value)) {
+      if (HOST_REFERENCE.test(key)) {
+        dropped.push(`${path}.${key}`);
+        continue;
+      }
+      const clean = withoutHostReferences(item, `${path}.${key}`, dropped);
+      if (clean !== DROP) kept[key] = clean;
+    }
+    return kept;
+  }
+  return value;
+}
+function honouredWithoutHostReferences(entry) {
+  const kept = {};
+  const dropped = [];
+  for (const property of HONOURED) {
+    if (!(property in entry)) continue;
+    const value = entry[property];
+    const clean = withoutHostReferences(
+      property === "build" && isObject(value) ? withoutIgnoredBuildKeys(value) : value,
+      property,
+      dropped
+    );
+    if (clean !== DROP) kept[property] = clean;
+  }
+  return { kept, dropped };
+}
+function withoutIgnoredBuildKeys(build) {
+  return Object.fromEntries(Object.entries(build).filter(([key]) => !IGNORED_BUILD_KEYS.includes(key)));
+}
+function ignoredIn(entry, source) {
+  const found = [];
+  for (const property of Object.keys(entry)) {
+    if (property === "id" || property.startsWith("$") || isHonoured(property)) continue;
+    found.push({ property, source });
+  }
+  if (isObject(entry.build)) {
+    for (const key of IGNORED_BUILD_KEYS) {
+      if (key in entry.build) found.push({ property: `build.${key}`, source });
+    }
+  }
+  for (const property of honouredWithoutHostReferences(entry).dropped) found.push({ property, source });
+  return found;
+}
+function emptyApply() {
+  return { containerEnv: {}, lifecycle: { onCreateCommand: [], updateContentCommand: [], postCreateCommand: [], postStartCommand: [] } };
+}
+function applyEntry(apply, raw, source) {
+  const entry = honouredWithoutHostReferences(raw).kept;
+  if (typeof entry.remoteUser === "string") apply.remoteUser = entry.remoteUser;
+  if (isObject(entry.containerEnv)) {
+    for (const [key, value] of Object.entries(entry.containerEnv)) {
+      if (typeof value === "string") apply.containerEnv[key] = value;
+    }
+  }
+  for (const name of LIFECYCLE) {
+    if (entry[name] !== void 0) apply.lifecycle[name].push({ source, command: entry[name] });
+  }
+}
+function classifyProperties(recipe, metadata) {
+  const ignored = ignoredIn(recipe, "file");
+  const apply = emptyApply();
+  let fileApplied = false;
+  const sanitized = sanitizeRecipe(recipe);
+  for (const entry of metadata) {
+    if (isFilesOwnEntry(entry, sanitized)) {
+      applyEntry(apply, entry, "file");
+      fileApplied = true;
+      continue;
+    }
+    const source = typeof entry.id === "string" ? `feature ${featureName(entry.id)}` : "image label";
+    ignored.push(...ignoredIn(entry, source));
+    applyEntry(apply, entry, source);
+  }
+  if (!fileApplied) applyEntry(apply, recipe, "file");
+  return { docker: asksForDocker(recipe, metadata), honoured: HONOURED.filter((property) => property in recipe), ignored, apply };
+}
+function sanitizeRecipe(recipe) {
+  return honouredWithoutHostReferences(recipe).kept;
+}
+var RecipeError = class extends Error {
+  constructor(code, message, logPath) {
+    super(message);
+    this.code = code;
+    this.logPath = logPath;
+  }
+};
+var DIR_RECIPE = ".devcontainer/devcontainer.json";
+var ROOT_RECIPE = ".devcontainer.json";
+function locateRecipe(checkoutDir) {
+  if (existsSync(join(checkoutDir, DIR_RECIPE))) return { kind: "file", path: DIR_RECIPE };
+  if (existsSync(join(checkoutDir, ROOT_RECIPE))) return { kind: "file", path: ROOT_RECIPE };
+  const named = namedConfigurations(checkoutDir);
+  if (named.length > 0) {
+    throw new RecipeError(
+      "recipe_ambiguous",
+      `the repository has only named devcontainer configurations (${named.join(", ")}); add ${DIR_RECIPE} so the runner knows which to build`
+    );
+  }
+  return { kind: "default" };
+}
+function namedConfigurations(checkoutDir) {
+  const dir = join(checkoutDir, ".devcontainer");
+  if (!existsSync(dir)) return [];
+  return readdirSync(dir).sort().map((entry) => `.devcontainer/${entry}/devcontainer.json`).filter((path) => existsSync(join(checkoutDir, path)));
+}
+var COMMENTS = /("(?:[^"\\]|\\.)*")|\/\/[^\n]*|\/\*[\s\S]*?(?:\*\/|$)/g;
+var TRAILING_COMMAS = /("(?:[^"\\]|\\.)*")|,(\s*[}\]])/g;
+function parseJsonc(text) {
+  const withoutComments = text.replace(COMMENTS, (_match, str) => str ?? "");
+  return JSON.parse(withoutComments.replace(TRAILING_COMMAS, (_match, str, close) => str ?? close ?? ""));
+}
+function readRecipe(checkoutDir, location) {
+  if (location.kind === "default") return {};
+  const parsed = parseJsonc(readFileSync(join(checkoutDir, location.path), "utf8"));
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error(`${location.path} is not a JSON object`);
+  }
+  return parsed;
+}
+function within(dir, path) {
+  const rel = relative(dir, path);
+  return rel !== ".." && !rel.startsWith(`..${sep}`);
+}
+function realish(path) {
+  let existing = path;
+  let rest = "";
+  while (!existsSync(existing)) {
+    rest = join(basename(existing), rest);
+    existing = dirname(existing);
+  }
+  return join(realpathSync(existing), rest);
+}
+function assertBuildable(checkoutDir, location, recipe) {
+  if (location.kind === "default") return;
+  const devcontainerDir = join(checkoutDir, ".devcontainer");
+  if (existsSync(devcontainerDir) && lstatSync(devcontainerDir).isSymbolicLink()) {
+    throw new RecipeError(
+      "recipe_context_outside",
+      ".devcontainer is a symbolic link, so the build could read files outside the repository; commit a real directory"
+    );
+  }
+  if (recipe.dockerComposeFile !== void 0) {
+    throw new RecipeError(
+      "recipe_needs_docker",
+      "the recipe uses dockerComposeFile; its services need Docker, which a container build does not have"
+    );
+  }
+  const build = recipe.build;
+  if (typeof build !== "object" || build === null) return;
+  const { dockerfile, context } = build;
+  const base = resolve(checkoutDir, location.path, "..");
+  const allowed = join(realpathSync(checkoutDir), ".devcontainer");
+  const contextPath = resolve(base, typeof context === "string" ? context : ".");
+  const paths = [contextPath];
+  if (typeof dockerfile === "string") paths.push(resolve(base, dockerfile));
+  for (const path of paths) {
+    if (!within(devcontainerDir, path) || !within(allowed, realish(path))) {
+      throw new RecipeError(
+        "recipe_context_outside",
+        `the recipe's build reads ${relative(checkoutDir, path) || "."}, outside .devcontainer/; move the build files into .devcontainer/`
+      );
+    }
+  }
+}
+function writeSanitizedRecipe(checkoutDir, location, recipe) {
+  if (location.kind === "default") throw new Error("the default image has no recipe to sanitize");
+  const path = location.path === ROOT_RECIPE ? join(checkoutDir, ".outerlayer-recipe.json") : join(checkoutDir, ".devcontainer", SANITIZED_NAME);
+  writeFileSync(path, `${JSON.stringify(sanitizeRecipe(recipe), null, 2)}
+`);
+  return path;
+}
+var SANITIZED_NAME = "outerlayer-recipe.json";
+
+export { RecipeError, SANITIZED_NAME, assertBuildable, classifyProperties, locateRecipe, readRecipe, writeSanitizedRecipe };

package/dist/chunk-RA3O54FC.js

@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { existsSync, readFileSync } from 'fs';
+import { dirname, join } from 'path';
+import { fileURLToPath } from 'url';
+
+createRequire(import.meta.url);
+var FALLBACK_VERSION = "0.1.0";
+function readJson(path) {
+  if (!existsSync(path)) return null;
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function resolveVersion(entryPath = fileURLToPath(import.meta.url)) {
+  const distDir = dirname(entryPath);
+  const pkg = readJson(join(dirname(distDir), "package.json"));
+  const version = typeof pkg?.version === "string" ? pkg.version : FALLBACK_VERSION;
+  const buildInfo = readJson(join(distDir, "build-info.json"));
+  const buildId = typeof buildInfo?.id === "string" ? buildInfo.id : null;
+  return buildId ? `${version} (build ${buildId})` : version;
+}
+function resolvePackageVersion(entryPath = fileURLToPath(import.meta.url)) {
+  const pkg = readJson(join(dirname(dirname(entryPath)), "package.json"));
+  return typeof pkg?.version === "string" ? pkg.version : FALLBACK_VERSION;
+}
+
+export { resolvePackageVersion, resolveVersion };

package/dist/chunk-TBT347UY.js

@@ -0,0 +1,41 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+
+createRequire(import.meta.url);
+
+// src/repo-filter.ts
+function toMatcher(pattern) {
+  const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+  return new RegExp(`^${escaped}$`, "i");
+}
+var RepoFilter = class {
+  constructor(config) {
+    /** Sessions dropped, keyed by repo (or "(no repo)") — for the sync summary. */
+    this.skipped = /* @__PURE__ */ new Map();
+    this.include = (config?.include ?? []).map(toMatcher);
+    this.exclude = (config?.exclude ?? []).map(toMatcher);
+  }
+  get active() {
+    return this.include.length > 0 || this.exclude.length > 0;
+  }
+  /** True when the session should sync. Records skips for reporting. */
+  allows(repo) {
+    const label = repo || "(no repo)";
+    if (repo && this.exclude.some((m) => m.test(repo))) {
+      this.skipped.set(label, (this.skipped.get(label) ?? 0) + 1);
+      return false;
+    }
+    if (this.include.length > 0 && !(repo && this.include.some((m) => m.test(repo)))) {
+      this.skipped.set(label, (this.skipped.get(label) ?? 0) + 1);
+      return false;
+    }
+    return true;
+  }
+  get skippedTotal() {
+    let n = 0;
+    for (const c of this.skipped.values()) n += c;
+    return n;
+  }
+};
+
+export { RepoFilter };

package/dist/{chunk-NXLLURA4.js → chunk-UFFXNXLQ.js}

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { deadHooksState, huskyPrepareScript, preparePackageManagerCommand } from './chunk-I3ETLSNE.js';
+import { deadHooksState, huskyPrepareScript, preparePackageManagerCommand } from './chunk-XCCLFVXM.js';
+import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync, existsSync, statSync, appendFileSync, openSync, opendirSync, unlinkSync } from 'fs';
 import { spawn, execFileSync } from 'child_process';
 import { createHash } from 'crypto';
-import { join, dirname, isAbsolute, resolve } from 'path';
+import { join, dirname, resolve } from 'path';
 
 createRequire(import.meta.url);
 var SYNC_STALE_AFTER_MS = 6 * 60 * 60 * 1e3;
@@ -354,11 +355,17 @@ function appendFd(path) {
     return "ignore";
   }
 }
-var spawnDetached = (command, args, stderrPath) => {
-  const child = spawn(command, args, { detached: true, stdio: ["ignore", "ignore", appendFd(stderrPath)] });
+var spawnDetached = (command, args, stderrPath, cwd) => {
+  const child = spawn(command, args, {
+    detached: true,
+    stdio: ["ignore", "ignore", appendFd(stderrPath)],
+    ...cwd !== void 0 ? { cwd } : {}
+  });
+  child.on("error", () => {
+  });
   child.unref();
 };
-function maybeAutoSync(event, home = homeFromEnv(), spawnImpl = spawnDetached, now = Date.now()) {
+function maybeAutoSync(event, home = homeFromEnv(), spawnImpl = spawnDetached, now = Date.now(), cwd = process.cwd()) {
   try {
     if (event !== "SessionEnd" && event !== "Stop") return;
     const marker = join(spoolDir(home), "last-auto-sync");
@@ -370,55 +377,114 @@ function maybeAutoSync(event, home = homeFromEnv(), spawnImpl = spawnDetached, n
     if (!existsSync(configPath)) return;
     const config = JSON.parse(readFileSync(configPath, "utf8"));
     if (config.autoSync === false) return;
-    if (!config.url || !config.apiKey || !config.appId) return;
+    if (!config.url) return;
+    if (config.apiKey) {
+      if (!config.appId) return;
+    } else if (!config.accountToken || readRepoConnection(cwd) === void 0) return;
     writeFileSync(marker, String(now));
-    spawnImpl(process.execPath, [process.argv[1], "sync", "--quiet"]);
+    spawnImpl(process.execPath, [process.argv[1], "sync", "--quiet"], void 0, cwd);
   } catch {
   }
 }
-var WORK_ADD_RETRIES = 4;
+var WORK_LINK_RETRIES = 4;
 function hookErrorsContext(home, writtenBytes, seenBytes) {
   if (writtenBytes === 0) return null;
   if (writtenBytes === seenBytes) return null;
   const path = join(spoolDir(home), "hook-errors.log");
-  return `OuterLayer recorded a hook failure since your last session started \u2014 a refused OUTERLAYER_WORK value, or a work-item session link that could not reach the Floor. The log is ${path}.`;
+  return `OuterLayer recorded a hook failure since your last session started \u2014 a refused OUTERLAYER_WORK value, or a work-item session link that could not reach Work. The log is ${path}.`;
 }
-async function handleWorkLaunch(sessionId, home, env, spawnImpl = spawnDetached) {
+async function handleWorkLaunch(sessionId, home, env, spawnImpl = spawnDetached, cwd = process.cwd()) {
   if (!sessionId || env.OUTERLAYER_WORK === void 0) return void 0;
-  const { parseWorkItemEnv, appendLaunchRecord } = await import('./work-launch-LT663PB3.js');
+  const { parseWorkItemEnv, appendLaunchRecord } = await import('./work-launch-YI4CJDAP.js');
   const parsed = parseWorkItemEnv(env.OUTERLAYER_WORK);
   if ("reason" in parsed) {
     logHookError(home, new Error(`OUTERLAYER_WORK ignored: ${parsed.reason}`));
     return `OuterLayer ignored this session's OUTERLAYER_WORK value: ${sanitizeForContext(parsed.reason)}. The session is not attached to a work item and will not upload. Hook failures are logged to ${join(spoolDir(home), "hook-errors.log")}.`;
   }
   appendLaunchRecord({ sessionId, item: parsed.number }, home);
+  const args = [
+    process.argv[1],
+    "work",
+    "link-session",
+    String(parsed.number),
+    "--session-id",
+    sessionId,
+    // The ordinary failure is a gateway that is briefly unreachable — a
+    // laptop that has not joined the network yet, a restart. Nothing else
+    // ever retries this link: the launch record is already written, so
+    // the session uploads whether or not Work ever hears about the
+    // link. Retrying costs nothing here (this process is detached; the
+    // hook has already returned) and cannot double-link, because the
+    // link is keyed by the session id passed above.
+    "--retry",
+    String(WORK_LINK_RETRIES)
+  ];
+  if (env.OUTERLAYER_JOB_DIR !== void 0) args.push("--no-lease");
   spawnImpl(
     process.execPath,
-    [
-      process.argv[1],
-      "work",
-      "link-session",
-      String(parsed.number),
-      "--session-id",
-      sessionId,
-      // The ordinary failure is a gateway that is briefly unreachable — a
-      // laptop that has not joined the network yet, a restart. Nothing else
-      // ever retries this link: the launch record is already written, so
-      // the session uploads whether or not the Floor ever hears about the
-      // link. Retrying costs nothing here (this process is detached; the
-      // hook has already returned) and cannot double-link, because the
-      // link is keyed by the session id passed above.
-      "--retry",
-      String(WORK_ADD_RETRIES)
-    ],
+    args,
     // The link runs after this hook has exited, so its own failure
     // (offline, revoked key, unknown item number) has nowhere else to be
-    // seen: without this the session uploads later with no Floor link and
+    // seen: without this the session uploads later with no Work link and
     // no trace of why.
-    join(spoolDir(home), "hook-errors.log")
+    join(spoolDir(home), "hook-errors.log"),
+    cwd
   );
   return void 0;
 }
+async function missingRenewalHookContext(home, cwd) {
+  try {
+    const { settingsPath, readSettings, isOurHookCommand } = await import('./settings-J2652U5N.js');
+    const userSettings = readSettings(settingsPath("user", { home }));
+    const projectSettings = readSettings(settingsPath("project", { cwd }));
+    if (userSettings === null && projectSettings === null) return void 0;
+    const registeredIn = (settings) => (settings.hooks?.PostToolUse ?? []).some((block) => (block.hooks ?? []).some((h) => isOurHookCommand(h)));
+    const registered = userSettings !== null && registeredIn(userSettings) || projectSettings !== null && registeredIn(projectSettings);
+    if (registered) return void 0;
+    return "This install has no PostToolUse hook, so this session's work-item lease will never be renewed while it works and may be lost to another worker mid-session. Run `outerlayer init` to register it.";
+  } catch {
+    return void 0;
+  }
+}
+var WORK_LEASE_RENEW_DEBOUNCE_MS = 5 * 60 * 1e3;
+async function maybeRenewWorkLease(event, sessionId, home = homeFromEnv(), env = process.env, spawnImpl = spawnDetached, now = Date.now(), cwd = process.cwd()) {
+  try {
+    if (event !== "PostToolUse") return;
+    if (!sessionId || env.OUTERLAYER_WORK === void 0 || env.OUTERLAYER_JOB_DIR !== void 0) return;
+    const marker = join(spoolDir(home), `work-lease-renew-${sessionId}`);
+    try {
+      if (now - statSync(marker).mtimeMs < WORK_LEASE_RENEW_DEBOUNCE_MS) return;
+    } catch {
+    }
+    const { parseWorkItemEnv } = await import('./work-launch-YI4CJDAP.js');
+    const parsed = parseWorkItemEnv(env.OUTERLAYER_WORK);
+    if ("reason" in parsed) return;
+    writeFileSync(marker, String(now));
+    spawnImpl(
+      process.execPath,
+      [process.argv[1], "work", "link-session", String(parsed.number), "--session-id", sessionId],
+      join(spoolDir(home), "hook-errors.log"),
+      cwd
+    );
+  } catch {
+  }
+}
+async function handleWorkSessionEnd(event, sessionId, home = homeFromEnv(), env = process.env, spawnImpl = spawnDetached, cwd = process.cwd()) {
+  try {
+    if (event !== "SessionEnd") return;
+    if (!sessionId || env.OUTERLAYER_WORK === void 0) return;
+    const { parseWorkItemEnv } = await import('./work-launch-YI4CJDAP.js');
+    const parsed = parseWorkItemEnv(env.OUTERLAYER_WORK);
+    if ("reason" in parsed) return;
+    spawnImpl(
+      process.execPath,
+      [process.argv[1], "work", "link-session", String(parsed.number), "--session-id", sessionId, "--ended"],
+      join(spoolDir(home), "hook-errors.log"),
+      cwd
+    );
+  } catch {
+  }
+}
 function syncHealthContext(home) {
   if (!existsSync(join(home, ".outerlayer", "config.json"))) return null;
   const health = assessSyncHealth(readSyncStatus(home));
@@ -479,7 +545,7 @@ function clearHealFailureMarker(home, repoRoot) {
   }
 }
 function deadHooksAutoHealContext(cwd, home) {
-  if (findGitRoot(cwd) === void 0) return null;
+  if (findGitDirs(cwd) === void 0) return null;
   const state = deadHooksState(cwd);
   if (!state.dead || state.repoRoot === void 0 || state.hooksDir === void 0) return null;
   const hooksDirLabel = sanitizeForContext(state.hooksDir);
@@ -510,41 +576,9 @@ var PIN_FILENAME = ".outerlayer-pin.json";
 function sourceCachePath(gitCommonDir) {
   return join(gitCommonDir, "outerlayer", "source.json");
 }
-function findGitRoot(cwd) {
-  let dir = cwd;
-  for (; ; ) {
-    const gitPath = join(dir, ".git");
-    let stat;
-    try {
-      stat = statSync(gitPath);
-    } catch {
-      stat = void 0;
-    }
-    if (stat?.isDirectory()) return { repoRoot: dir, gitCommonDir: gitPath };
-    if (stat?.isFile()) {
-      try {
-        const content = readFileSync(gitPath, "utf8").trim();
-        const match = /^gitdir:\s*(.+)$/.exec(content);
-        if (match) {
-          const gitdir = isAbsolute(match[1]) ? match[1] : join(dir, match[1]);
-          try {
-            const commondir = readFileSync(join(gitdir, "commondir"), "utf8").trim();
-            return { repoRoot: dir, gitCommonDir: isAbsolute(commondir) ? commondir : join(gitdir, commondir) };
-          } catch {
-            return { repoRoot: dir, gitCommonDir: gitdir };
-          }
-        }
-      } catch {
-      }
-    }
-    const parent = dirname(dir);
-    if (parent === dir) return void 0;
-    dir = parent;
-  }
-}
 function contextPossiblyGoverned(cwd, home = homeFromEnv()) {
   try {
-    const found = findGitRoot(cwd);
+    const found = findGitDirs(cwd);
     if (found === void 0) return false;
     const { repoRoot, gitCommonDir } = found;
     if (existsSync(join(repoRoot, PIN_FILENAME))) return true;
@@ -566,8 +600,6 @@ function contextPossiblyGoverned(cwd, home = homeFromEnv()) {
 }
 async function runHookFast(event, home = homeFromEnv(), read = readStdin, env = process.env, spawnImpl = spawnDetached) {
   try {
-    const dir = spoolDir(home);
-    mkdirSync(dir, { recursive: true });
     const stdin = read();
     let payload = {};
     try {
@@ -576,6 +608,11 @@ async function runHookFast(event, home = homeFromEnv(), read = readStdin, env =
       payload = {};
     }
     const resolvedEvent = String(event ?? payload.hook_event_name ?? "unknown");
+    if (resolvedEvent === "PostToolUse" && (env.OUTERLAYER_WORK === void 0 || env.OUTERLAYER_JOB_DIR !== void 0)) {
+      return;
+    }
+    const dir = spoolDir(home);
+    mkdirSync(dir, { recursive: true });
     const record = {
       t: (/* @__PURE__ */ new Date()).toISOString(),
       event: resolvedEvent,
@@ -585,19 +622,23 @@ async function runHookFast(event, home = homeFromEnv(), read = readStdin, env =
     };
     appendFileSync(join(dir, "events.jsonl"), JSON.stringify(record) + "\n");
     markHookFired(resolvedEvent, home);
-    maybeAutoSync(resolvedEvent, home, spawnImpl);
     const sessionCwd = typeof payload.cwd === "string" ? payload.cwd : process.cwd();
+    maybeAutoSync(resolvedEvent, home, spawnImpl, Date.now(), sessionCwd);
+    const hookSessionId = typeof payload.session_id === "string" ? payload.session_id : void 0;
+    await maybeRenewWorkLease(resolvedEvent, hookSessionId, home, env, spawnImpl, Date.now(), sessionCwd);
+    await handleWorkSessionEnd(resolvedEvent, hookSessionId, home, env, spawnImpl, sessionCwd);
     let materializeMessage;
     let deadHooksMessage;
     let workLaunchMessage;
     let hookErrorsMessage;
+    let renewalHookMessage;
     if (resolvedEvent === "SessionStart") {
       const hookErrorsBytes = fileSizeBytes(join(dir, "hook-errors.log"));
       const hookErrorsSeen = hookErrorsSeenBytes(home);
       recordHookErrorsSeen(home, hookErrorsBytes);
       if (contextPossiblyGoverned(sessionCwd, home)) {
         try {
-          const { materializeContext: materialize } = await import('./context-materialize-6WKT3RBQ.js');
+          const { materializeContext: materialize } = await import('./context-materialize-G2FUFC72.js');
           const sessionId = typeof payload.session_id === "string" ? payload.session_id : "unknown";
           const result = await materialize({ cwd: sessionCwd, sessionId, home });
           materializeMessage = result.message;
@@ -612,20 +653,23 @@ async function runHookFast(event, home = homeFromEnv(), read = readStdin, env =
       }
       try {
         const sessionId = typeof payload.session_id === "string" ? payload.session_id : void 0;
-        workLaunchMessage = await handleWorkLaunch(sessionId, home, env, spawnImpl);
+        workLaunchMessage = await handleWorkLaunch(sessionId, home, env, spawnImpl, sessionCwd);
       } catch (err) {
         logHookError(home, err);
       }
       if (workLaunchMessage === void 0) {
         hookErrorsMessage = hookErrorsContext(home, hookErrorsBytes, hookErrorsSeen) ?? void 0;
       }
+      if (env.OUTERLAYER_WORK !== void 0 && env.OUTERLAYER_JOB_DIR === void 0 && workLaunchMessage === void 0) {
+        renewalHookMessage = await missingRenewalHookContext(home, sessionCwd);
+      }
     }
     writeSessionStartContext(
       resolvedEvent,
       home,
       sessionCwd,
       (out) => process.stdout.write(out),
-      [materializeMessage, deadHooksMessage, workLaunchMessage, hookErrorsMessage].filter(
+      [materializeMessage, deadHooksMessage, workLaunchMessage, hookErrorsMessage, renewalHookMessage].filter(
         (s) => s !== void 0
       )
     );
@@ -647,4 +691,4 @@ function logHookError(home, err) {
   }
 }
 
-export { AUTO_SYNC_DEBOUNCE_MS, SYNC_STALE_AFTER_MS, WORK_ADD_RETRIES, assessSyncHealth, checkInstalledCliStaleness, contextPossiblyGoverned, formatAgo, handleWorkLaunch, hookFiredMarkerPath, installedCliDistDir, maybeAutoSync, readSyncStatus, refreshCommand, runHookFast, sanitizeForContext, spoolDir, workspaceRootOf, writeSyncStatus };
+export { AUTO_SYNC_DEBOUNCE_MS, SYNC_STALE_AFTER_MS, WORK_LEASE_RENEW_DEBOUNCE_MS, WORK_LINK_RETRIES, assessSyncHealth, checkInstalledCliStaleness, contextPossiblyGoverned, formatAgo, handleWorkLaunch, handleWorkSessionEnd, hookFiredMarkerPath, installedCliDistDir, maybeAutoSync, maybeRenewWorkLease, readSyncStatus, refreshCommand, runHookFast, sanitizeForContext, spoolDir, workspaceRootOf, writeSyncStatus };