@outerlayer/cli 0.2.0 → 0.4.0

package/dist/{chunk-U32VSRLO.js → chunk-3YPKXE5L.js}

@@ -1,96 +1,29 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { tailTranscript, enrichSessionRepo, CAPTURE_TIERS, scanAll, setRepoRoot, resolveRepoIdentity, inferArtifactKind, bannedPathsForTier, sessionIdFromPath, setCustomScrubbers, setLocalIdentity, scrubDeep, downconvertSession, isHumanUserTurn, turnCountBound, SOURCE_ADAPTERS, EVENT_TYPES, ArtifactTombstoneRecordSchema, ArtifactSpoolRecordSchema } from './chunk-4TNZMO7V.js';
+import { applyContextProvenance, installScrubContext, prepareSessionForUpload, wholeSessionCounts, sliceTurnIo } from './chunk-HE2D4EY5.js';
+import { LaunchFilter } from './chunk-BCJNHMZT.js';
+import { RepoFilter } from './chunk-TBT347UY.js';
+import { hookExecSpoolPath } from './chunk-F7CU5ABH.js';
+import { applyReportedCost } from './chunk-BKO6JEZI.js';
+import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-6Y63SXFO.js';
+import { tailTranscript, enrichSessionRepo, CAPTURE_TIERS, scanAll, setRepoRoot, resolveRepoIdentity, inferArtifactKind, bannedPathsForTier, sessionIdFromPath, SOURCE_ADAPTERS, EVENT_TYPES } from './chunk-G7FSV7JX.js';
 import { C } from './chunk-YRYMNBGQ.js';
-import { readLaunchSpoolState, launchesPath, launchStatusIsDecisive } from './chunk-65WXAANR.js';
+import { readLaunchSpoolState, launchStatusIsDecisive, launchedItemsBySession, launchesPath } from './chunk-DVDEBNQJ.js';
 import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
-import { writeSyncStatus, spoolDir } from './chunk-NXLLURA4.js';
-import { removeJournalHooks } from './chunk-I3ETLSNE.js';
-import { hookExecSpoolPath } from './chunk-YOOSBOKS.js';
-import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-TFUIDMOB.js';
+import { defaultFetch } from './chunk-BCLJSQCV.js';
+import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-BOLTI6LR.js';
+import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-EABW6AJQ.js';
+import { signerFor, signRunnerRequest } from './chunk-M5POMKKW.js';
+import { writeSyncStatus, spoolDir } from './chunk-UFFXNXLQ.js';
+import { removeJournalHooks } from './chunk-XCCLFVXM.js';
+import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { dirname, basename, join } from 'path';
-import { statSync, mkdirSync, appendFileSync, existsSync, readFileSync, readdirSync, openSync, fstatSync, readSync, closeSync, writeFileSync, renameSync, unlinkSync, rmSync } from 'fs';
-import { execFileSync } from 'child_process';
-import { hostname, userInfo } from 'os';
+import { statSync, readFileSync, readdirSync, mkdirSync, writeFileSync, renameSync, existsSync, rmSync } from 'fs';
 import { fileURLToPath } from 'url';
 import { createRequire as createRequire$1 } from 'module';
 
 createRequire(import.meta.url);
-function detectCi(env = process.env) {
-  return env.CI === "true" || env.CI === "1" || !!env.JENKINS_URL;
-}
-function gitGlobalConfig(key) {
-  try {
-    return execFileSync("git", ["config", "--global", key], { encoding: "utf8", timeout: 2e3 }).trim() || void 0;
-  } catch {
-    return void 0;
-  }
-}
-function installScrubContext(home, scrub) {
-  setCustomScrubbers(scrub);
-  setLocalIdentity({
-    name: gitGlobalConfig("user.name"),
-    email: gitGlobalConfig("user.email"),
-    username: (() => {
-      try {
-        return userInfo().username;
-      } catch {
-        return void 0;
-      }
-    })(),
-    hostname: (() => {
-      try {
-        return hostname();
-      } catch {
-        return void 0;
-      }
-    })(),
-    home
-  });
-}
-function applyContextProvenance(session, record) {
-  if (!record) return;
-  if (record.repository !== void 0) session.env.contextSourceRepo = record.repository;
-  if (record.ref !== void 0) session.env.contextSourceRef = record.ref;
-  if (record.sha !== null) session.env.contextSourceSha = record.sha;
-  session.env.contextSourceVerification = record.verification;
-}
-function prepareSessionForUpload(session, tier, envVars = process.env) {
-  setRepoRoot(resolveRepoIdentity(session.env.cwd).repoRoot);
-  scrubDeep(session);
-  session.workerKind ??= detectCi(envVars) ? "ci" : "seat";
-  return downconvertSession(session, tier);
-}
-var MAX_TOOL_IO_CHARS = 64e3;
-function sliceToolIo(value) {
-  const text = typeof value === "string" ? value : JSON.stringify(value);
-  if (typeof text !== "string" || text.length <= MAX_TOOL_IO_CHARS) return value;
-  return `${text.slice(0, MAX_TOOL_IO_CHARS)}\u2026[sliced: ${text.length} chars exceeded the sync per-call cap]`;
-}
-function sliceTurnIo(turn) {
-  return {
-    ...turn,
-    toolCalls: (turn.toolCalls ?? []).map((call) => ({
-      ...call,
-      ...call.input !== void 0 ? { input: sliceToolIo(call.input) } : {},
-      ...call.output !== void 0 ? { output: sliceToolIo(call.output) } : {}
-    }))
-  };
-}
-function wholeSessionCounts(turns) {
-  const allCalls = turns.flatMap((t) => t.toolCalls ?? []);
-  return {
-    // An index BOUND (`1 + max(turn.index)`), not the shipped turn count —
-    // turn indexes are not guaranteed dense from zero, and a late artifact
-    // anchored at its real turn index must still validate against the
-    // summary row this produces (see turnCountBound).
-    turns: turnCountBound(turns),
-    toolCalls: allCalls.length,
-    errors: allCalls.filter((c) => c.status === "error").length,
-    userTurns: turns.filter(isHumanUserTurn).length
-  };
-}
 var IRRELEVANT = /* @__PURE__ */ new Set(["__tests__", "__mocks__", "node_modules"]);
 function newestSourceMs(dir) {
   let newest = 0;
@@ -198,121 +131,6 @@ function readSqliteWatermark(url, appId, home) {
     return null;
   }
 }
-
-// src/repo-filter.ts
-function toMatcher(pattern) {
-  const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
-  return new RegExp(`^${escaped}$`, "i");
-}
-var RepoFilter = class {
-  constructor(config) {
-    /** Sessions dropped, keyed by repo (or "(no repo)") — for the sync summary. */
-    this.skipped = /* @__PURE__ */ new Map();
-    this.include = (config?.include ?? []).map(toMatcher);
-    this.exclude = (config?.exclude ?? []).map(toMatcher);
-  }
-  get active() {
-    return this.include.length > 0 || this.exclude.length > 0;
-  }
-  /** True when the session should sync. Records skips for reporting. */
-  allows(repo) {
-    const label = repo || "(no repo)";
-    if (repo && this.exclude.some((m) => m.test(repo))) {
-      this.skipped.set(label, (this.skipped.get(label) ?? 0) + 1);
-      return false;
-    }
-    if (this.include.length > 0 && !(repo && this.include.some((m) => m.test(repo)))) {
-      this.skipped.set(label, (this.skipped.get(label) ?? 0) + 1);
-      return false;
-    }
-    return true;
-  }
-  get skippedTotal() {
-    let n = 0;
-    for (const c of this.skipped.values()) n += c;
-    return n;
-  }
-};
-var SESSION_DETECT_TAIL_BYTES = 64 * 1024;
-var SESSION_DETECT_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
-var readTail = (path, maxBytes) => {
-  try {
-    const fd = openSync(path, "r");
-    try {
-      const size = fstatSync(fd).size;
-      const length = Math.min(size, maxBytes);
-      const data = Buffer.alloc(length);
-      readSync(fd, data, 0, length, size - length);
-      return { data, truncated: size > length };
-    } finally {
-      closeSync(fd);
-    }
-  } catch {
-    return void 0;
-  }
-};
-function detectActiveSession(opts) {
-  if (!opts.env.CLAUDECODE) return void 0;
-  const read = opts.readTailImpl ?? readTail;
-  const tail = read(join(opts.home, ".outerlayer", "spool", "events.jsonl"), SESSION_DETECT_TAIL_BYTES);
-  if (!tail || tail.data.length === 0) return void 0;
-  let lines = tail.data.toString("utf8").split("\n");
-  if (tail.truncated) lines = lines.slice(1);
-  const records = [];
-  for (const line of lines) {
-    const text = line.trim();
-    if (!text) continue;
-    try {
-      records.push(JSON.parse(text));
-    } catch {
-      continue;
-    }
-  }
-  const ended = /* @__PURE__ */ new Set();
-  for (const record of records) {
-    if (record.event === "SessionEnd" && typeof record.sessionId === "string" && record.sessionId !== "") {
-      ended.add(record.sessionId);
-    }
-  }
-  let newest;
-  for (const record of records) {
-    if (typeof record.sessionId !== "string" || record.sessionId === "") continue;
-    if (record.event === "SessionEnd" || ended.has(record.sessionId)) continue;
-    if (typeof record.cwd !== "string" || !opts.cwds.includes(record.cwd)) continue;
-    if (typeof record.t !== "string") continue;
-    const tMs = Date.parse(record.t);
-    if (!Number.isFinite(tMs) || opts.nowMs - tMs > SESSION_DETECT_MAX_AGE_MS) continue;
-    newest = record.sessionId;
-  }
-  return newest;
-}
-
-// src/launch-filter.ts
-function launchRefusalForSession(sessionId, home) {
-  const spool = readLaunchSpoolState(home);
-  if (spool.ids.has(sessionId)) return void 0;
-  if (spool.unreadable !== void 0) {
-    return `the launch spool at ${launchesPath(home)} could not be read (${spool.unreadable}), so this session's launch could not be checked and nothing it produces may leave the machine. Fix the file's permissions and re-run.`;
-  }
-  if (spool.malformedLines !== void 0) {
-    return `the launch spool at ${launchesPath(home)} has ${spool.malformedLines} damaged line(s), so this session's launch could not be checked and nothing it produces may leave the machine.`;
-  }
-  return `this session was not launched with OUTERLAYER_WORK naming a work item, so nothing it produces may leave the machine. Start the session with OUTERLAYER_WORK set (for example OUTERLAYER_WORK=42), or run this from CI.`;
-}
-var LaunchFilter = class {
-  constructor(launchedSessionIds) {
-    this.launchedSessionIds = launchedSessionIds;
-    /** Sessions dropped for carrying no launch record — for the sync summary. */
-    this.skippedTotal = 0;
-  }
-  /** True when the session should sync. Records skips for reporting. */
-  allows(session) {
-    const key = session.subagent?.parentSessionId ?? session.id;
-    const allowed = typeof key === "string" && this.launchedSessionIds.has(key);
-    if (!allowed) this.skippedTotal += 1;
-    return allowed;
-  }
-};
 var HOOK_TIMEOUT_MS = 6e5;
 var HOOK_INCOMPLETE_SLACK_MS = 6e4;
 var HOOK_INCOMPLETE_AFTER_MS = HOOK_TIMEOUT_MS + HOOK_INCOMPLETE_SLACK_MS;
@@ -744,8 +562,8 @@ var LiveUploader = class {
     const priorEntry = state.sessions[key];
     if (priorEntry?.ended || priorEntry?.failed) return true;
     const cloudConfig = readCloudConfig(this.home);
-    if (!cloudConfig.url || !cloudConfig.apiKey || !cloudConfig.appId) return false;
     if (cloudConfig.autoSync === false) return false;
+    if (!cloudConfig.url || !(cloudConfig.apiKey || cloudConfig.accountToken)) return false;
     const info = subagentInfo(mirrorPath);
     const tail = tailTranscript(mirrorPath, void 0, {
       isSubagent: info.isSubagent,
@@ -755,6 +573,8 @@ var LiveUploader = class {
     if (!tail.session) return false;
     const session = tail.session;
     enrichSessionRepo(session);
+    const destination = resolveGatewayCredentials({ home: this.home, env: {}, cwd: session.env.cwd ?? "/" });
+    if (!destination.ok) return false;
     const repoFilter = new RepoFilter(cloudConfig.repos);
     if (!repoFilter.allows(session.env.gitRepo)) return false;
     const launchSpool = readLaunchSpoolState(this.home);
@@ -771,6 +591,7 @@ var LiveUploader = class {
     const hookEvents = planHookExecMerge({ home: this.home, fromOffset: 0 }).eventsBySession.get(session.id);
     if (hookEvents && hookEvents.length > 0) appendHookExecEvents(session, hookEvents);
     applyContextProvenance(session, readLatestProvenanceForSession(session.id, this.home));
+    applyReportedCost(session, this.home);
     installScrubContext(this.home, cloudConfig.scrub);
     const prepared = prepareSessionForUpload(session, tier, this.env);
     const ackedTurnIndex = priorEntry?.ackedTurnIndex ?? -1;
@@ -782,18 +603,19 @@ var LiveUploader = class {
     const groups = groupTurns(available, open, wholeCounts);
     const emptyFinalTurn = Math.max(ackedTurnIndex, 0);
     const toSend = groups.length > 0 ? groups : [{ turns: [], delta: { fromTurn: emptyFinalTurn, toTurn: emptyFinalTurn, open: false, counts: wholeCounts } }];
-    const endpoint = new URL("/v1/agents/sync", cloudConfig.url).toString();
+    const endpoint = new URL("/v1/agents/sync", destination.url).toString();
     let currentAcked = ackedTurnIndex;
     for (const group of toSend) {
       const payload = {
         schemaVersion: 1,
         sessions: [{ ...prepared, turns: group.turns, delta: group.delta }]
       };
-      const outcome = await this.sendWithRetry(endpoint, cloudConfig.apiKey, cloudConfig.appId, prepared.id, payload);
+      const outcome = await this.sendWithRetry(endpoint, destination.credential, destination.appId, prepared.id, payload);
       if (outcome === "unauthorized") {
         this.stopped = true;
         this.stderr(
-          `live upload stopped: the API key was refused. No session streams from this daemon until it restarts with a valid key.
+          destination.credential.startsWith("olu_") ? `live upload stopped: the login was refused (expired or revoked). No session streams from this daemon until you run \`outerlayer login\` and it restarts.
+` : `live upload stopped: the API key was refused. No session streams from this daemon until it restarts with a valid key.
 `
         );
         return true;
@@ -828,6 +650,20 @@ var LiveUploader = class {
     const current = readLiveUploadState(this.home);
     writeLiveUploadState({ v: 1, sessions: { ...current.sessions, [key]: entry } }, this.home);
   }
+  /** The headers that sign a request with this host's key, or none when the host has no readable key. A runner
+   * key bound to a host key is refused on every route unless that key signed the request. A login token is
+   * never signed: only the saved factory key is bound to a host key. */
+  async signatureHeaders(endpoint, body, credential) {
+    if (readCloudConfig(this.home).apiKey !== credential) return {};
+    let signer;
+    try {
+      signer = await signerFor(cloudConfigPath(this.home));
+    } catch {
+      return {};
+    }
+    if (signer === void 0) return {};
+    return { ...await signRunnerRequest({ method: "POST", url: endpoint, body: new TextEncoder().encode(body), signer }) };
+  }
   /** Sends one request, retrying a network error or a retryable 5xx forever
    * with exponential backoff (2s → 60s cap) — the daemon runs unattended, so
    * there is no bounded attempt count. A 401 or a permanent 4xx/rejection
@@ -838,9 +674,15 @@ var LiveUploader = class {
     for (; ; ) {
       let response;
       try {
+        const signature = await this.signatureHeaders(endpoint, body, apiKey);
         response = await this.fetchImpl(endpoint, {
           method: "POST",
-          headers: { "content-type": "application/json", authorization: `Bearer ${apiKey}`, "x-outerlayer-app-id": appId },
+          headers: {
+            "content-type": "application/json",
+            authorization: `Bearer ${apiKey}`,
+            "x-outerlayer-app-id": appId,
+            ...signature
+          },
           body
         });
       } catch {
@@ -860,379 +702,6 @@ var LiveUploader = class {
     }
   }
 };
-function artifactsSpoolPath(home = homeFromEnv()) {
-  return join(home, ".outerlayer", "spool", "artifacts.jsonl");
-}
-function artifactBlobsDir(home = homeFromEnv()) {
-  return join(home, ".outerlayer", "spool", "artifact-blobs");
-}
-function artifactsStatePath(home = homeFromEnv()) {
-  return join(home, ".outerlayer", "spool", "artifacts.state.json");
-}
-var ARTIFACT_RETRY_MAX_AGE_MS = 14 * 24 * 60 * 60 * 1e3;
-function appendArtifactRecord(record, home = homeFromEnv()) {
-  const path = artifactsSpoolPath(home);
-  mkdirSync(dirname(path), { recursive: true });
-  appendFileSync(path, JSON.stringify(record) + "\n");
-}
-function appendArtifactTombstone(artifactId, home = homeFromEnv(), now = () => /* @__PURE__ */ new Date()) {
-  const path = artifactsSpoolPath(home);
-  mkdirSync(dirname(path), { recursive: true });
-  const record = { rec: "artifact-tombstone", artifactId, t: now().toISOString() };
-  appendFileSync(path, JSON.stringify(record) + "\n");
-}
-function walkArtifactSpoolLines(home, visit) {
-  let buf;
-  try {
-    buf = readFileSync(artifactsSpoolPath(home));
-  } catch {
-    return;
-  }
-  let pos = 0;
-  while (pos < buf.length) {
-    const nl = buf.indexOf(10, pos);
-    const textEnd = nl === -1 ? buf.length : nl;
-    const text = buf.subarray(pos, textEnd).toString("utf8").trim();
-    if (text) visit(text, pos);
-    if (nl === -1) break;
-    pos = nl + 1;
-  }
-}
-function isArtifactTombstoned(artifactId, home = homeFromEnv()) {
-  let found = false;
-  walkArtifactSpoolLines(home, (text) => {
-    if (found) return;
-    try {
-      const parsed = ArtifactTombstoneRecordSchema.safeParse(JSON.parse(text));
-      if (parsed.success && parsed.data.artifactId === artifactId) found = true;
-    } catch {
-    }
-  });
-  return found;
-}
-var KNOWN_SPOOL_RECORD_TYPES = /* @__PURE__ */ new Set(["artifact", "artifact-tombstone"]);
-var SHA256_HEX = /^[0-9a-f]{64}$/;
-var MAX_DISPLAYED_REC_TYPE_LENGTH = 100;
-var CONTROL_CHAR_PATTERN = new RegExp(
-  `[${String.fromCharCode(0)}-${String.fromCharCode(31)}${String.fromCharCode(127)}-${String.fromCharCode(159)}]`,
-  "g"
-);
-function sanitizeTerminal(text) {
-  return text.replace(CONTROL_CHAR_PATTERN, "");
-}
-function sanitizeRecType(rec) {
-  const stripped = sanitizeTerminal(rec);
-  return stripped.length > MAX_DISPLAYED_REC_TYPE_LENGTH ? `${stripped.slice(0, MAX_DISPLAYED_REC_TYPE_LENGTH)}\u2026` : stripped;
-}
-function readUnknownRecordEnvelope(json) {
-  if (typeof json !== "object" || json === null) return void 0;
-  const rec = json.rec;
-  const t = json.t;
-  if (typeof rec !== "string" || typeof t !== "string") return void 0;
-  const shaRaw = json.sha256;
-  const sha256 = typeof shaRaw === "string" && SHA256_HEX.test(shaRaw) ? shaRaw : void 0;
-  return { rec, t, sha256 };
-}
-function classifySpoolLine(text) {
-  let json;
-  try {
-    json = JSON.parse(text);
-  } catch {
-    return { kind: "skipped", reason: "not valid JSON" };
-  }
-  const tombstone = ArtifactTombstoneRecordSchema.safeParse(json);
-  if (tombstone.success) return { kind: "tombstone", artifactId: tombstone.data.artifactId };
-  const parsed = ArtifactSpoolRecordSchema.safeParse(json);
-  if (parsed.success) return { kind: "record", record: parsed.data };
-  const envelope = readUnknownRecordEnvelope(json);
-  if (envelope !== void 0 && !KNOWN_SPOOL_RECORD_TYPES.has(envelope.rec)) {
-    const sanitizedRecType = sanitizeRecType(envelope.rec);
-    const recType = sanitizedRecType === "" ? "(empty)" : `"${sanitizedRecType}"`;
-    return {
-      kind: "held",
-      reason: `unrecognized record type ${recType} \u2014 this build's schemas do not recognize it`,
-      ...envelope.sha256 !== void 0 ? { sha256: envelope.sha256 } : {}
-    };
-  }
-  const issue = parsed.error.issues[0];
-  const issueDetail = issue ? ` (${issue.path.length > 0 ? `${issue.path.join(".")}: ` : ""}${sanitizeTerminal(issue.message)})` : "";
-  return { kind: "skipped", reason: `does not match the artifact spool record shape${issueDetail}` };
-}
-function legacySidecarPaths(home) {
-  const dir = join(home, ".outerlayer", "spool");
-  return [
-    join(dir, "artifacts.watermark"),
-    join(dir, "artifacts.uploaded.json"),
-    join(dir, "artifacts.dropped.json"),
-    join(dir, "artifacts.held-offsets.json"),
-    join(dir, "artifacts.pending-first-seen.json")
-  ];
-}
-function readLegacySidecars(home) {
-  const dir = join(home, ".outerlayer", "spool");
-  let watermark = 0;
-  try {
-    const n = parseInt(readFileSync(join(dir, "artifacts.watermark"), "utf8").trim(), 10);
-    if (Number.isFinite(n) && n >= 0) watermark = n;
-  } catch {
-  }
-  const readIdSet = (name) => {
-    try {
-      const raw = JSON.parse(readFileSync(join(dir, name), "utf8"));
-      return new Set(Array.isArray(raw) ? raw.filter((v) => typeof v === "string") : []);
-    } catch {
-      return /* @__PURE__ */ new Set();
-    }
-  };
-  let pendingFirstSeen = {};
-  try {
-    const raw = JSON.parse(readFileSync(join(dir, "artifacts.pending-first-seen.json"), "utf8"));
-    if (raw !== null && typeof raw === "object" && !Array.isArray(raw)) {
-      const out = {};
-      for (const [key, value] of Object.entries(raw)) {
-        if (typeof value === "string") out[key] = value;
-      }
-      pendingFirstSeen = out;
-    }
-  } catch {
-  }
-  return {
-    watermark,
-    uploadedIds: readIdSet("artifacts.uploaded.json"),
-    droppedIds: readIdSet("artifacts.dropped.json"),
-    pendingFirstSeen
-  };
-}
-function computeMigratedState(home) {
-  const legacy = readLegacySidecars(home);
-  const state = /* @__PURE__ */ new Map();
-  const tombstoned = /* @__PURE__ */ new Set();
-  const rawRecords = [];
-  walkArtifactSpoolLines(home, (text, offset) => {
-    const classified = classifySpoolLine(text);
-    if (classified.kind === "tombstone") {
-      tombstoned.add(classified.artifactId);
-    } else if (classified.kind === "record") {
-      rawRecords.push({
-        artifactId: classified.record.artifactId,
-        offset,
-        sha256: classified.record.sha256,
-        t: classified.record.t
-      });
-    }
-  });
-  const nowIso = (/* @__PURE__ */ new Date()).toISOString();
-  for (const { artifactId, offset, sha256, t } of rawRecords) {
-    if (offset >= legacy.watermark) continue;
-    if (legacy.uploadedIds.has(artifactId)) {
-      state.set(artifactId, { state: "uploaded", attempts: 1, firstSeen: t || nowIso, sha256, reachedServer: true });
-      continue;
-    }
-    if (legacy.droppedIds.has(artifactId)) {
-      state.set(artifactId, {
-        state: "dropped",
-        attempts: 1,
-        firstSeen: legacy.pendingFirstSeen[artifactId] ?? t ?? nowIso,
-        sha256,
-        reachedServer: false
-      });
-      continue;
-    }
-    if (tombstoned.has(artifactId)) continue;
-    state.set(artifactId, { state: "dropped", attempts: 1, firstSeen: t || nowIso, sha256, reachedServer: true });
-  }
-  return state;
-}
-function readPersistedArtifactSpoolState(home) {
-  let raw;
-  try {
-    raw = readFileSync(artifactsStatePath(home), "utf8");
-  } catch {
-    return { state: /* @__PURE__ */ new Map(), corrupt: false };
-  }
-  try {
-    const parsed = JSON.parse(raw);
-    const records = parsed !== null && typeof parsed === "object" && Array.isArray(parsed.records) ? parsed.records : void 0;
-    if (records === void 0) return { state: /* @__PURE__ */ new Map(), corrupt: true };
-    const state = /* @__PURE__ */ new Map();
-    for (const entry of records) {
-      if (entry === null || typeof entry !== "object") continue;
-      const e = entry;
-      if (typeof e.artifactId !== "string") continue;
-      if (e.state !== "pending" && e.state !== "uploaded" && e.state !== "held" && e.state !== "dropped") continue;
-      state.set(e.artifactId, {
-        state: e.state,
-        attempts: typeof e.attempts === "number" && Number.isFinite(e.attempts) ? e.attempts : 0,
-        firstSeen: typeof e.firstSeen === "string" ? e.firstSeen : (/* @__PURE__ */ new Date(0)).toISOString(),
-        sha256: typeof e.sha256 === "string" ? e.sha256 : "",
-        reachedServer: e.reachedServer === true
-      });
-    }
-    return { state, corrupt: false };
-  } catch {
-    return { state: /* @__PURE__ */ new Map(), corrupt: true };
-  }
-}
-var ARTIFACT_STATE_RESOLVED_CAP = 5e3;
-function writeArtifactSpoolState(state, home = homeFromEnv()) {
-  try {
-    const path = artifactsStatePath(home);
-    mkdirSync(dirname(path), { recursive: true });
-    const tmp = `${path}.tmp`;
-    const pending = [];
-    const resolved = [];
-    for (const pair of state.entries()) {
-      (pair[1].state === "uploaded" || pair[1].state === "dropped" ? resolved : pending).push(pair);
-    }
-    const cappedResolved = resolved.length > ARTIFACT_STATE_RESOLVED_CAP ? resolved.slice(-ARTIFACT_STATE_RESOLVED_CAP) : resolved;
-    const records = [...pending, ...cappedResolved].map(([artifactId, entry]) => ({ artifactId, ...entry }));
-    writeFileSync(tmp, JSON.stringify({ version: 1, records }));
-    renameSync(tmp, path);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function migrateLegacyArtifactSidecars(home = homeFromEnv()) {
-  if (existsSync(artifactsStatePath(home))) return;
-  const paths = legacySidecarPaths(home);
-  if (!paths.some((p) => existsSync(p))) return;
-  writeArtifactSpoolState(computeMigratedState(home), home);
-  for (const p of paths) {
-    try {
-      unlinkSync(p);
-    } catch {
-    }
-  }
-}
-function readEffectiveArtifactSpoolState(home = homeFromEnv()) {
-  const { state: persisted, corrupt } = existsSync(artifactsStatePath(home)) ? readPersistedArtifactSpoolState(home) : { state: computeMigratedState(home), corrupt: false };
-  const state = new Map(persisted);
-  const tombstonedIds = /* @__PURE__ */ new Set();
-  walkArtifactSpoolLines(home, (text) => {
-    const classified = classifySpoolLine(text);
-    if (classified.kind === "tombstone") tombstonedIds.add(classified.artifactId);
-  });
-  if (tombstonedIds.size > 0) {
-    walkArtifactSpoolLines(home, (text) => {
-      const classified = classifySpoolLine(text);
-      if (classified.kind !== "record") return;
-      const { record } = classified;
-      if (!tombstonedIds.has(record.artifactId)) return;
-      const existing = state.get(record.artifactId);
-      if (existing === void 0 || existing.state === "held" || existing.state === "pending") {
-        state.set(record.artifactId, {
-          state: "dropped",
-          attempts: existing?.attempts ?? 0,
-          firstSeen: existing?.firstSeen ?? record.t,
-          sha256: record.sha256,
-          reachedServer: false
-        });
-      }
-    });
-  }
-  return { state, corrupt };
-}
-function planArtifactUpload(opts = {}) {
-  const home = opts.home ?? homeFromEnv();
-  const { state: effective, corrupt } = readEffectiveArtifactSpoolState(home);
-  const state = new Map(effective);
-  const candidates = [];
-  const skipped = [];
-  const held = [];
-  const tombstonedIds = /* @__PURE__ */ new Set();
-  walkArtifactSpoolLines(home, (text) => {
-    const classified = classifySpoolLine(text);
-    if (classified.kind === "tombstone") tombstonedIds.add(classified.artifactId);
-  });
-  walkArtifactSpoolLines(home, (text, offset) => {
-    const classified = classifySpoolLine(text);
-    if (classified.kind === "tombstone") return;
-    if (classified.kind === "skipped") {
-      skipped.push({ offset, reason: classified.reason });
-      return;
-    }
-    if (classified.kind === "held") {
-      held.push({ offset, reason: classified.reason, ...classified.sha256 !== void 0 ? { sha256: classified.sha256 } : {} });
-      return;
-    }
-    const { record } = classified;
-    if (tombstonedIds.has(record.artifactId)) return;
-    const existing = state.get(record.artifactId);
-    if (existing === void 0 || existing.state === "held" || existing.state === "pending") {
-      candidates.push({ record });
-    }
-  });
-  return { candidates, state, skipped, held, corrupt };
-}
-function neededArtifactShas(home, finalState) {
-  const needed = /* @__PURE__ */ new Set();
-  walkArtifactSpoolLines(home, (text) => {
-    const classified = classifySpoolLine(text);
-    if (classified.kind === "held") {
-      if (classified.sha256 !== void 0) needed.add(classified.sha256);
-      return;
-    }
-    if (classified.kind !== "record") return;
-    const entry = finalState.get(classified.record.artifactId);
-    if (entry === void 0 || entry.state === "held" || entry.state === "pending") needed.add(classified.record.sha256);
-  });
-  return needed;
-}
-function reclaimUnneededArtifactBlobs(home, neededShas) {
-  let names;
-  try {
-    names = readdirSync(artifactBlobsDir(home));
-  } catch {
-    return 0;
-  }
-  let reclaimed = 0;
-  for (const name of names) {
-    if (!SHA256_HEX.test(name) || neededShas.has(name)) continue;
-    try {
-      unlinkSync(join(artifactBlobsDir(home), name));
-      reclaimed += 1;
-    } catch {
-    }
-  }
-  return reclaimed;
-}
-function localArtifactIds(home = homeFromEnv()) {
-  const ids = /* @__PURE__ */ new Set();
-  walkArtifactSpoolLines(home, (text) => {
-    const classified = classifySpoolLine(text);
-    if (classified.kind === "record") ids.add(classified.record.artifactId);
-  });
-  return ids;
-}
-function findPendingArtifactRecord(artifactId, home = homeFromEnv()) {
-  let found;
-  walkArtifactSpoolLines(home, (text) => {
-    if (found !== void 0) return;
-    const classified = classifySpoolLine(text);
-    if (classified.kind === "record" && classified.record.artifactId === artifactId) found = classified.record;
-  });
-  if (found === void 0) return void 0;
-  const { state } = readEffectiveArtifactSpoolState(home);
-  const entry = state.get(artifactId);
-  if (entry !== void 0 && entry.state !== "held" && entry.state !== "pending") return void 0;
-  return { record: found };
-}
-function resolveArtifactTurnIndex(turns, filename) {
-  let found;
-  for (const turn of turns) {
-    for (const call of turn.toolCalls ?? []) {
-      const haystack = [
-        call.name,
-        typeof call.input === "string" ? call.input : call.input === void 0 ? "" : JSON.stringify(call.input),
-        typeof call.output === "string" ? call.output : call.output === void 0 ? "" : JSON.stringify(call.output),
-        call.file ?? ""
-      ].join("\n");
-      if (haystack.includes("emit artifact") && haystack.includes(filename)) found = turn.index;
-    }
-  }
-  return found;
-}
 
 // src/skip-verdict.ts
 var RESUME_WINDOW_MS = 14 * 24 * 60 * 60 * 1e3;
@@ -1246,41 +715,12 @@ function statusUnknown(verdict) {
 function mightStillShip(verdict) {
   return verdict !== "final";
 }
-var MAX_SESSION_REPOS = 100;
-function sessionReposPath(home = homeFromEnv()) {
-  return join(home, ".outerlayer", "spool", "session-repos.json");
-}
-function readSessionRepos(home = homeFromEnv()) {
-  const path = sessionReposPath(home);
-  if (!existsSync(path)) return [];
-  try {
-    const parsed = JSON.parse(readFileSync(path, "utf8"));
-    if (!Array.isArray(parsed)) return [];
-    return parsed.filter(
-      (r) => typeof r === "object" && r !== null && typeof r.repoRoot === "string" && typeof r.gitRepo === "string" && typeof r.lastSeenAt === "string"
-    );
-  } catch {
-    return [];
-  }
-}
-function recordSessionRepos(observed, now = /* @__PURE__ */ new Date(), home = homeFromEnv()) {
-  if (observed.length === 0) return;
-  const byRoot = new Map(readSessionRepos(home).map((r) => [r.repoRoot, r]));
-  const at = now.toISOString();
-  for (const { repoRoot, gitRepo } of observed) {
-    if (!repoRoot) continue;
-    byRoot.set(repoRoot, { repoRoot, gitRepo, lastSeenAt: at });
-  }
-  const rows = [...byRoot.values()].sort((a, b) => a.lastSeenAt < b.lastSeenAt ? 1 : a.lastSeenAt > b.lastSeenAt ? -1 : 0).slice(0, MAX_SESSION_REPOS);
-  try {
-    const path = sessionReposPath(home);
-    mkdirSync(dirname(path), { recursive: true });
-    writeFileSync(path, JSON.stringify(rows, null, 2) + "\n");
-  } catch {
-  }
-}
 
 // src/sync-cmd.ts
+var ITEM_KEY_PREFIX = "olitem_";
+function isItemKey(token) {
+  return token.startsWith(ITEM_KEY_PREFIX);
+}
 function isLoopbackUrl(url) {
   try {
     const host = new URL(url).hostname.toLowerCase().replace(/^\[|\]$/g, "");
@@ -1464,21 +904,26 @@ async function runSync(opts = {}) {
     throw err;
   }
 }
+function parseWorkItemNumber(raw) {
+  const match = /^\d+$/.exec(raw ?? "");
+  return match ? Number(match[0]) : void 0;
+}
 async function runSyncInner(opts, stats) {
   const envVars = opts.env ?? process.env;
   const home = opts.home ?? homeFromEnv(envVars);
   const fileConfig = readCloudConfig(home);
-  const url = opts.url ?? envVars.OUTERLAYER_URL ?? fileConfig.url;
-  const apiKey = opts.apiKey ?? envVars.OUTERLAYER_API_KEY ?? fileConfig.apiKey;
-  const appId = opts.appId ?? envVars.OUTERLAYER_APP_ID ?? fileConfig.appId;
-  stats.url = url;
-  stats.appId = appId;
+  const resolved = resolveGatewayCredentials({ ...opts, home, env: envVars });
+  stats.url = resolved.url;
+  stats.appId = resolved.appId;
   const tier = resolveTier(opts.tier ?? envVars.OUTERLAYER_TIER ?? fileConfig.tier);
   const dryRun = opts.dryRun ?? false;
   const repoFilter = new RepoFilter(fileConfig.repos);
   const launchSpool = readLaunchSpoolState(home);
   const launchedSessionIds = launchSpool.ids;
   const launchFilter = new LaunchFilter(launchedSessionIds);
+  const itemScope = resolved.credential !== void 0 && isItemKey(resolved.credential) ? { item: parseWorkItemNumber(envVars.OUTERLAYER_WORK), sessionItems: launchedItemsBySession(home) } : void 0;
+  const inItemScope = (sessionId) => itemScope === void 0 || itemScope.item !== void 0 && itemScope.sessionItems.get(sessionId) === itemScope.item;
+  const connectionScoped = resolved.kind === "login" && opts.appId === void 0 && !envVars.OUTERLAYER_APP_ID;
   const runNowMs = Date.now();
   const launchSkipVerdict = (mtimeMs) => unlaunchedVerdict({ launchStatusDecisive: launchStatusIsDecisive(launchSpool), idleMs: runNowMs - mtimeMs });
   const launchSkipReason = () => {
@@ -1489,7 +934,9 @@ async function runSyncInner(opts, stats) {
     return "not launched with OUTERLAYER_WORK";
   };
   const artifactHoldReason = (sessionId) => {
-    if (launchedSessionIds.has(sessionId)) return void 0;
+    if (launchedSessionIds.has(sessionId)) {
+      return inItemScope(sessionId) ? void 0 : "its session was launched for another work item";
+    }
     if (launchSpool.unreadable !== void 0) {
       return "the launch spool could not be read this run, so no artifact may leave the machine";
     }
@@ -1515,12 +962,8 @@ async function runSyncInner(opts, stats) {
       );
   }
   installScrubContext(home, fileConfig.scrub);
-  if (!url || !apiKey || !appId) {
-    const missing = [!url && "--url", !apiKey && "--api-key", !appId && "--app-id"].filter(Boolean).join(", ");
-    throw new SyncConfigError(
-      `missing ${missing}. Run \`outerlayer login --url <your gateway>\` and paste the key at the prompt, or set OUTERLAYER_URL / OUTERLAYER_API_KEY / OUTERLAYER_APP_ID. Mint a key in the dashboard: Settings \u2192 API keys.`
-    );
-  }
+  if (!resolved.ok) throw new SyncConfigError(resolved.message);
+  const { url, credential: apiKey, appId } = resolved;
   {
     const sinceMs = opts.all ? 0 : readWatermark(url, appId, home);
     const hookPlan = planHookExecMerge({ home });
@@ -1559,7 +1002,7 @@ async function runSyncInner(opts, stats) {
     }
     const liveUploads = readLiveUploadState(home).sessions;
     const collected = [];
-    const observedRepos = /* @__PURE__ */ new Map();
+    const observedRepos = /* @__PURE__ */ new Set();
     let heldMinMtimeMs = Number.POSITIVE_INFINITY;
     let passableMaxMtimeMs = 0;
     const neverShipSessionIds = /* @__PURE__ */ new Set();
@@ -1588,11 +1031,23 @@ async function runSyncInner(opts, stats) {
           noteSkipped(session.id, entry.mtimeMs, launchSkipVerdict(entry.mtimeMs));
           return;
         }
+        if (connectionScoped) {
+          const sessionFactory = readRepoConnection(session.env.cwd ?? "/")?.appId;
+          if (sessionFactory !== appId) {
+            const cwd = session.env.cwd ?? "/";
+            const connectable = sessionFactory === void 0 && findGitDirs(cwd) !== void 0;
+            noteSkipped(session.id, entry.mtimeMs, connectable ? "unknown" : "reversible");
+            return;
+          }
+        }
+        const scopeKey = session.subagent?.parentSessionId ?? session.id;
+        if (!inItemScope(scopeKey)) {
+          noteSkipped(session.id, entry.mtimeMs, "unknown");
+          return;
+        }
         {
           const identity = resolveRepoIdentity(session.env.cwd);
-          if (identity.repoRoot) {
-            observedRepos.set(identity.repoRoot, identity.gitRepo ?? "");
-          }
+          if (identity.repoRoot) observedRepos.add(identity.repoRoot);
         }
         const hookEvents = hookPlan.eventsBySession.get(session.id);
         if (hookEvents && hookEvents.length > 0) {
@@ -1600,6 +1055,7 @@ async function runSyncInner(opts, stats) {
           mergedHookEndKeys.set(session.id, session.subagent?.parentSessionId ?? session.id);
         }
         applyContextProvenance(session, contextSourceBySessionId.get(session.id));
+        applyReportedCost(session, home);
         const gated = prepareSessionForUpload(session, tier, envVars);
         const liveEntry = liveUploads[gated.id];
         const daemonIsStreaming = liveEntry !== void 0 && !liveEntry.ended && !liveEntry.failed;
@@ -1651,8 +1107,7 @@ async function runSyncInner(opts, stats) {
     if (launchStatusIsDecisive(launchSpool)) stats.skippedNotLaunched = launchFilter.skippedTotal;
     else stats.held = launchFilter.skippedTotal;
     if (!opts.dryRun) {
-      recordSessionRepos([...observedRepos].map(([repoRoot, gitRepo]) => ({ repoRoot, gitRepo })), /* @__PURE__ */ new Date(), home);
-      for (const repoRoot of observedRepos.keys()) removeJournalHooks(repoRoot);
+      for (const repoRoot of observedRepos) removeJournalHooks(repoRoot);
     }
     collected.sort((a, b) => a.mtimeMs - b.mtimeMs);
     const items = collected.flatMap((item) => chunkOversizedSession(item));
@@ -1814,7 +1269,7 @@ async function runSyncInner(opts, stats) {
         output: output2
       };
     }
-    const fetchImpl = opts.fetchImpl ?? fetch;
+    const fetchImpl = opts.fetchImpl ?? defaultFetch;
     const endpoint = new URL("/v1/agents/sync", url).toString();
     let synced = 0;
     let blobsSent = 0;
@@ -1896,7 +1351,7 @@ ${C.yellow}!${C.reset} batch ${shippedBatches + 1}/${batches.length} hit ${cause
       if (response.status === 401) {
         failureContext();
         throw new SyncTransportError(
-          "not authorized \u2014 the API key is unknown, expired, or bound to a different app. Mint a fresh key: dashboard \u2192 Settings \u2192 API keys.",
+          unauthorizedMessage(apiKey),
           401
         );
       }
@@ -2082,7 +1537,7 @@ ${C.yellow}!${C.reset} batch ${shippedBatches + 1}/${batches.length} accounting
         }
         if (status === 401) {
           unauthorized = new SyncTransportError(
-            "not authorized \u2014 the API key is unknown, expired, or bound to a different app. Mint a fresh key: dashboard \u2192 Settings \u2192 API keys.",
+            unauthorizedMessage(apiKey),
             401
           );
           heldCount += 1;
@@ -2163,7 +1618,10 @@ ${C.yellow}!${C.reset} batch ${shippedBatches + 1}/${batches.length} accounting
           );
         }
       } else {
-        writeCloudConfig({ url, apiKey, appId }, home);
+        writeCloudConfig(
+          { url, apiKey: resolved.kind === "key" ? apiKey : void 0, appId: resolved.kind === "key" ? appId : void 0 },
+          home
+        );
       }
     }
     let output;
@@ -2222,4 +1680,4 @@ ${C.yellow}!${C.reset} batch ${shippedBatches + 1}/${batches.length} accounting
   }
 }
 
-export { CHUNK_PART_TARGET_BYTES, LiveUploader, RETRYABLE_STATUSES, RepoFilter, SyncConfigError, SyncTransportError, appendArtifactRecord, appendArtifactTombstone, artifactBlobsDir, artifactsSpoolPath, detectActiveSession, detectCi, findPendingArtifactRecord, isArtifactTombstoned, isLoopbackUrl, launchRefusalForSession, localArtifactIds, readEffectiveArtifactSpoolState, resolveTier, runSync, staleBuildRefusal, staleBuildWarning };
+export { CHUNK_PART_TARGET_BYTES, LiveUploader, RETRYABLE_STATUSES, SyncConfigError, SyncTransportError, isLoopbackUrl, resolveTier, runSync, staleBuildRefusal, staleBuildWarning };