@outerlayer/cli 0.2.0 → 0.4.1

package/dist/{mcp-install-cmd-FDQH6SEN.js → chunk-MQ3IPHIZ.js}

@@ -1,11 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { C } from './chunk-YRYMNBGQ.js';
-import { readCloudConfig } from './chunk-TFUIDMOB.js';
-import './chunk-VNVZDWO3.js';
-import './chunk-Z5GEFMRW.js';
-import { existsSync, readFileSync, writeFileSync } from 'fs';
-import { join } from 'path';
+import { readCloudConfig } from './chunk-EABW6AJQ.js';
+import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs';
+import { join, dirname } from 'path';
 
 createRequire(import.meta.url);
 var McpInstallError = class extends Error {
@@ -14,7 +12,7 @@ function defaultMcpUrl(home) {
   const origin = readCloudConfig(home).url;
   if (!origin) {
     throw new McpInstallError(
-      "no gateway URL: pass --url <your gateway>, or run `outerlayer login --url <your gateway>` first."
+      "no gateway URL: pass --url <your gateway>, or run `outerlayer login` first."
     );
   }
   return `${origin.replace(/\/+$/, "")}/v1/mcp`;
@@ -33,6 +31,35 @@ function buildStdioServerEntry(command, url, appId) {
   if (appId) args.push("--app-id", appId);
   return { type: "stdio", command, args };
 }
+function readMcpDoc(absPath, relPath) {
+  if (!existsSync(absPath)) return {};
+  let doc;
+  try {
+    doc = JSON.parse(readFileSync(absPath, "utf8"));
+  } catch {
+    throw new McpInstallError(`${relPath} exists and is not valid JSON \u2014 fix or remove it, then run the command again`);
+  }
+  if (doc === null || typeof doc !== "object" || Array.isArray(doc)) {
+    throw new McpInstallError(`${relPath} exists and its top level is not a JSON object \u2014 refusing to overwrite`);
+  }
+  return doc;
+}
+function addStdioMcpEntryIfAbsent(repoRoot, name = "outerlayer") {
+  const relPath = existsSync(join(repoRoot, ".outerlayer", "mcp.json")) ? ".outerlayer/mcp.json" : ".mcp.json";
+  const absPath = join(repoRoot, relPath);
+  const doc = readMcpDoc(absPath, relPath);
+  const servers = doc.mcpServers;
+  if (servers !== void 0 && (servers === null || typeof servers !== "object" || Array.isArray(servers))) {
+    throw new McpInstallError(`${relPath} has an "mcpServers" value that is not an object \u2014 refusing to overwrite`);
+  }
+  const existing = servers ?? {};
+  if (name in existing) return { path: relPath, added: false };
+  const entry = buildStdioServerEntry(DEFAULT_MCP_COMMAND, void 0, void 0);
+  mkdirSync(dirname(absPath), { recursive: true });
+  writeFileSync(absPath, `${JSON.stringify({ ...doc, mcpServers: { ...existing, [name]: entry } }, null, 2)}
+`);
+  return { path: relPath, added: true };
+}
 function runMcpInstall(opts = {}) {
   const cwd = opts.cwd ?? process.cwd();
   if (!existsSync(cwd)) throw new McpInstallError(`no such directory: ${cwd}`);
@@ -41,17 +68,7 @@ function runMcpInstall(opts = {}) {
   const url = transport === "http" ? opts.url ?? defaultMcpUrl(opts.home) : opts.url ?? null;
   const relPath = ".mcp.json";
   const absPath = join(cwd, relPath);
-  let doc = {};
-  if (existsSync(absPath)) {
-    try {
-      doc = JSON.parse(readFileSync(absPath, "utf8"));
-    } catch {
-      throw new McpInstallError(`${relPath} exists and is not valid JSON \u2014 fix or remove it before running "mcp install"`);
-    }
-    if (doc === null || typeof doc !== "object" || Array.isArray(doc)) {
-      throw new McpInstallError(`${relPath} exists and its top level is not a JSON object \u2014 refusing to overwrite`);
-    }
-  }
+  const doc = readMcpDoc(absPath, relPath);
   const existingServers = doc.mcpServers && typeof doc.mcpServers === "object" && !Array.isArray(doc.mcpServers) ? doc.mcpServers : {};
   const entry = transport === "http" ? buildServerEntry(url, opts.appId) : buildStdioServerEntry(opts.command ?? DEFAULT_MCP_COMMAND, url ?? void 0, opts.appId);
   const changed = JSON.stringify(existingServers[name] ?? null) !== JSON.stringify(entry);
@@ -72,4 +89,4 @@ function handleMcpInstallError(err) {
   process.exitCode = 1;
 }
 
-export { DEFAULT_MCP_COMMAND, McpInstallError, buildServerEntry, buildStdioServerEntry, defaultMcpUrl, handleMcpInstallError, runMcpInstall };
+export { DEFAULT_MCP_COMMAND, McpInstallError, addStdioMcpEntryIfAbsent, buildServerEntry, buildStdioServerEntry, defaultMcpUrl, handleMcpInstallError, runMcpInstall };

package/dist/{chunk-D77LS3UI.js → chunk-N5FOE5PS.js}

@@ -1,11 +1,40 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isSameProcess } from './chunk-OZ7C3XUE.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-JJP7YLMN.js';
-import { existsSync, readFileSync, rmSync, mkdirSync, writeFileSync } from 'fs';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
+import { readFileSync, existsSync, rmSync, mkdirSync, writeFileSync } from 'fs';
 import { dirname } from 'path';
+import { execFileSync } from 'child_process';
 
 createRequire(import.meta.url);
+function startTimeOf(pid) {
+  if (process.platform === "linux") return startTimeOfLinux(pid);
+  return startTimeOfPs(pid);
+}
+function startTimeOfLinux(pid) {
+  try {
+    const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
+    const afterComm = stat.slice(stat.lastIndexOf(")") + 1).trim();
+    const fields = afterComm.split(/\s+/);
+    if (fields[0] === "Z" || fields[0] === "X") return null;
+    const starttime = fields[19];
+    return starttime ?? null;
+  } catch {
+    return null;
+  }
+}
+function startTimeOfPs(pid) {
+  try {
+    const out = execFileSync("ps", ["-o", "lstart=", "-p", String(pid)], { encoding: "utf8" }).trim();
+    return out.length > 0 ? out : null;
+  } catch {
+    return null;
+  }
+}
+function isSameProcess(pid, start) {
+  return startTimeOf(pid) === start;
+}
+
+// src/runner/pidfile.ts
 function readPidFile(path) {
   if (!existsSync(path)) return null;
   try {
@@ -39,4 +68,4 @@ function claimPidFile(path, self, isSameProcessFn = isSameProcess) {
   writePidFile(path, self);
 }
 
-export { RunnerAlreadyRunningError, claimPidFile, readPidFile, releasePidFile };
+export { RunnerAlreadyRunningError, claimPidFile, isSameProcess, readPidFile, releasePidFile, startTimeOf };

package/dist/chunk-N6LURUEF.js

@@ -0,0 +1,64 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { C } from './chunk-YRYMNBGQ.js';
+import { readCloudConfig, removeCloudConfigKeys } from './chunk-EABW6AJQ.js';
+import { homeFromEnv } from './chunk-VNVZDWO3.js';
+
+createRequire(import.meta.url);
+
+// src/logout-cmd.ts
+var DEFAULT_DASHBOARD = "https://app.outerlayer.ai";
+var REQUEST_TIMEOUT_MS = 15e3;
+function realLogoutDeps() {
+  return { fetchImpl: fetch, stdout: process.stdout, stderr: process.stderr };
+}
+async function revokeTokenOnDashboard(fetchImpl, dashboard, token) {
+  try {
+    const res = await fetchImpl(`${dashboard.replace(/\/+$/, "")}/api/cli/logout`, {
+      method: "POST",
+      headers: { authorization: `Bearer ${token}` },
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+    });
+    if (res.status >= 500) return "unreachable";
+    return res.status >= 200 && res.status < 300 ? "revoked" : "refused";
+  } catch {
+    return "unreachable";
+  }
+}
+async function runLogoutCommand(deps) {
+  const home = deps.home ?? homeFromEnv();
+  const config = readCloudConfig(home);
+  const token = config.accountToken;
+  if (!token) {
+    deps.stdout.write("Not logged in.\n");
+    return 0;
+  }
+  const outcome = await revokeTokenOnDashboard(deps.fetchImpl, config.dashboard ?? DEFAULT_DASHBOARD, token);
+  try {
+    removeCloudConfigKeys(["accountToken", "dashboard"], home);
+  } catch (err) {
+    deps.stderr.write(
+      `${C.red}\u2717${C.reset} Could not remove the login from the config file: ${err instanceof Error ? err.message : String(err)}. ` + (outcome === "revoked" ? "The token is revoked on the dashboard, but a copy is still on this machine; delete it from the config file.\n" : "The token may still be valid; revoke it on the CLI logins list at /profile/security.\n")
+    );
+    return 1;
+  }
+  if (outcome === "refused") {
+    deps.stderr.write(
+      `${C.red}\u2717${C.reset} Removed the login from this machine, but the dashboard did not confirm the revoke. The token may stay valid until you revoke it on the CLI logins list at /profile/security.
+`
+    );
+    return 1;
+  }
+  if (outcome === "unreachable") {
+    deps.stderr.write(
+      `${C.red}\u2717${C.reset} Removed the login from this machine, but could not reach the dashboard to revoke it. The token may stay valid until you revoke it on the CLI logins list at /profile/security.
+`
+    );
+    return 1;
+  }
+  deps.stdout.write(`${C.green}\u2713${C.reset} Logged out. The token is revoked and removed from this machine.
+`);
+  return 0;
+}
+
+export { realLogoutDeps, revokeTokenOnDashboard, runLogoutCommand };

package/dist/chunk-OGFGZQA3.js

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { readFileSync } from 'fs';
+import { dirname, join } from 'path';
+import { fileURLToPath } from 'url';
+
+createRequire(import.meta.url);
+function currentCliBuild(entryPath = fileURLToPath(import.meta.url)) {
+  const distDir = dirname(entryPath);
+  const read = (path) => {
+    try {
+      return JSON.parse(readFileSync(path, "utf8"));
+    } catch {
+      return {};
+    }
+  };
+  const id = read(join(distDir, "build-info.json")).id;
+  if (typeof id === "string" && id !== "") return { distDir, buildId: id };
+  const version = read(join(dirname(distDir), "package.json")).version;
+  return { distDir, buildId: `${typeof version === "string" ? version : "unknown"}+unstamped` };
+}
+
+export { currentCliBuild };

package/dist/chunk-QDQEUVUF.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+
+createRequire(import.meta.url);
+
+// src/runner/protocol.ts
+var RUNNER_PROTOCOL = 12;
+
+export { RUNNER_PROTOCOL };

package/dist/chunk-QOZKPLVJ.js

@@ -0,0 +1,226 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { existsSync, readdirSync, readFileSync, lstatSync, realpathSync, writeFileSync } from 'fs';
+import { join, resolve, relative, sep, basename, dirname } from 'path';
+
+createRequire(import.meta.url);
+
+// src/runner/image/properties.ts
+var LIFECYCLE = ["onCreateCommand", "updateContentCommand", "postCreateCommand", "postStartCommand"];
+var HONOURED = ["image", "build", "features", "containerEnv", "remoteUser", ...LIFECYCLE];
+var IGNORED_BUILD_KEYS = ["options"];
+var HOST_REFERENCE = /\$\{(?:localEnv|env)[:}]/;
+var DROP = /* @__PURE__ */ Symbol("drop");
+function isHonoured(property) {
+  return HONOURED.includes(property);
+}
+function isObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function featureName(id) {
+  const slash = id.lastIndexOf("/");
+  const cut = id.slice(slash + 1).search(/[:@]/);
+  return cut === -1 ? id : id.slice(0, slash + 1 + cut);
+}
+var DOCKER_FEATURE = "ghcr.io/devcontainers/features/docker-in-docker";
+function asksForDocker(recipe, metadata) {
+  const isDocker = (id) => featureName(id) === DOCKER_FEATURE;
+  if (isObject(recipe.features) && Object.keys(recipe.features).some(isDocker)) return true;
+  return metadata.some((entry) => typeof entry.id === "string" && isDocker(entry.id));
+}
+function sameValue(a, b) {
+  return JSON.stringify(a) === JSON.stringify(b);
+}
+function isFilesOwnEntry(entry, recipe) {
+  if (typeof entry.id === "string") return false;
+  const keys = Object.keys(entry);
+  return keys.length > 0 && keys.every((key) => key in recipe && sameValue(entry[key], recipe[key]));
+}
+function withoutHostReferences(value, path, dropped) {
+  if (typeof value === "string") {
+    if (!HOST_REFERENCE.test(value)) return value;
+    dropped.push(path);
+    return DROP;
+  }
+  if (Array.isArray(value)) {
+    if (!HOST_REFERENCE.test(JSON.stringify(value))) return value;
+    dropped.push(path);
+    return DROP;
+  }
+  if (isObject(value)) {
+    const kept = {};
+    for (const [key, item] of Object.entries(value)) {
+      if (HOST_REFERENCE.test(key)) {
+        dropped.push(`${path}.${key}`);
+        continue;
+      }
+      const clean = withoutHostReferences(item, `${path}.${key}`, dropped);
+      if (clean !== DROP) kept[key] = clean;
+    }
+    return kept;
+  }
+  return value;
+}
+function honouredWithoutHostReferences(entry) {
+  const kept = {};
+  const dropped = [];
+  for (const property of HONOURED) {
+    if (!(property in entry)) continue;
+    const value = entry[property];
+    const clean = withoutHostReferences(
+      property === "build" && isObject(value) ? withoutIgnoredBuildKeys(value) : value,
+      property,
+      dropped
+    );
+    if (clean !== DROP) kept[property] = clean;
+  }
+  return { kept, dropped };
+}
+function withoutIgnoredBuildKeys(build) {
+  return Object.fromEntries(Object.entries(build).filter(([key]) => !IGNORED_BUILD_KEYS.includes(key)));
+}
+function ignoredIn(entry, source) {
+  const found = [];
+  for (const property of Object.keys(entry)) {
+    if (property === "id" || property.startsWith("$") || isHonoured(property)) continue;
+    found.push({ property, source });
+  }
+  if (isObject(entry.build)) {
+    for (const key of IGNORED_BUILD_KEYS) {
+      if (key in entry.build) found.push({ property: `build.${key}`, source });
+    }
+  }
+  for (const property of honouredWithoutHostReferences(entry).dropped) found.push({ property, source });
+  return found;
+}
+function emptyApply() {
+  return { containerEnv: {}, lifecycle: { onCreateCommand: [], updateContentCommand: [], postCreateCommand: [], postStartCommand: [] } };
+}
+function applyEntry(apply, raw, source) {
+  const entry = honouredWithoutHostReferences(raw).kept;
+  if (typeof entry.remoteUser === "string") apply.remoteUser = entry.remoteUser;
+  if (isObject(entry.containerEnv)) {
+    for (const [key, value] of Object.entries(entry.containerEnv)) {
+      if (typeof value === "string") apply.containerEnv[key] = value;
+    }
+  }
+  for (const name of LIFECYCLE) {
+    if (entry[name] !== void 0) apply.lifecycle[name].push({ source, command: entry[name] });
+  }
+}
+function classifyProperties(recipe, metadata) {
+  const ignored = ignoredIn(recipe, "file");
+  const apply = emptyApply();
+  let fileApplied = false;
+  const sanitized = sanitizeRecipe(recipe);
+  for (const entry of metadata) {
+    if (isFilesOwnEntry(entry, sanitized)) {
+      applyEntry(apply, entry, "file");
+      fileApplied = true;
+      continue;
+    }
+    const source = typeof entry.id === "string" ? `feature ${featureName(entry.id)}` : "image label";
+    ignored.push(...ignoredIn(entry, source));
+    applyEntry(apply, entry, source);
+  }
+  if (!fileApplied) applyEntry(apply, recipe, "file");
+  return { docker: asksForDocker(recipe, metadata), honoured: HONOURED.filter((property) => property in recipe), ignored, apply };
+}
+function sanitizeRecipe(recipe) {
+  return honouredWithoutHostReferences(recipe).kept;
+}
+var RecipeError = class extends Error {
+  constructor(code, message, logPath) {
+    super(message);
+    this.code = code;
+    this.logPath = logPath;
+  }
+};
+var DIR_RECIPE = ".devcontainer/devcontainer.json";
+var ROOT_RECIPE = ".devcontainer.json";
+function locateRecipe(checkoutDir) {
+  if (existsSync(join(checkoutDir, DIR_RECIPE))) return { kind: "file", path: DIR_RECIPE };
+  if (existsSync(join(checkoutDir, ROOT_RECIPE))) return { kind: "file", path: ROOT_RECIPE };
+  const named = namedConfigurations(checkoutDir);
+  if (named.length > 0) {
+    throw new RecipeError(
+      "recipe_ambiguous",
+      `the repository has only named devcontainer configurations (${named.join(", ")}); add ${DIR_RECIPE} so the runner knows which to build`
+    );
+  }
+  return { kind: "default" };
+}
+function namedConfigurations(checkoutDir) {
+  const dir = join(checkoutDir, ".devcontainer");
+  if (!existsSync(dir)) return [];
+  return readdirSync(dir).sort().map((entry) => `.devcontainer/${entry}/devcontainer.json`).filter((path) => existsSync(join(checkoutDir, path)));
+}
+var COMMENTS = /("(?:[^"\\]|\\.)*")|\/\/[^\n]*|\/\*[\s\S]*?(?:\*\/|$)/g;
+var TRAILING_COMMAS = /("(?:[^"\\]|\\.)*")|,(\s*[}\]])/g;
+function parseJsonc(text) {
+  const withoutComments = text.replace(COMMENTS, (_match, str) => str ?? "");
+  return JSON.parse(withoutComments.replace(TRAILING_COMMAS, (_match, str, close) => str ?? close ?? ""));
+}
+function readRecipe(checkoutDir, location) {
+  if (location.kind === "default") return {};
+  const parsed = parseJsonc(readFileSync(join(checkoutDir, location.path), "utf8"));
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error(`${location.path} is not a JSON object`);
+  }
+  return parsed;
+}
+function within(dir, path) {
+  const rel = relative(dir, path);
+  return rel !== ".." && !rel.startsWith(`..${sep}`);
+}
+function realish(path) {
+  let existing = path;
+  let rest = "";
+  while (!existsSync(existing)) {
+    rest = join(basename(existing), rest);
+    existing = dirname(existing);
+  }
+  return join(realpathSync(existing), rest);
+}
+function assertBuildable(checkoutDir, location, recipe) {
+  if (location.kind === "default") return;
+  const devcontainerDir = join(checkoutDir, ".devcontainer");
+  if (existsSync(devcontainerDir) && lstatSync(devcontainerDir).isSymbolicLink()) {
+    throw new RecipeError(
+      "recipe_context_outside",
+      ".devcontainer is a symbolic link, so the build could read files outside the repository; commit a real directory"
+    );
+  }
+  if (recipe.dockerComposeFile !== void 0) {
+    throw new RecipeError(
+      "recipe_needs_docker",
+      "the recipe uses dockerComposeFile; its services need Docker, which a container build does not have"
+    );
+  }
+  const build = recipe.build;
+  if (typeof build !== "object" || build === null) return;
+  const { dockerfile, context } = build;
+  const base = resolve(checkoutDir, location.path, "..");
+  const allowed = join(realpathSync(checkoutDir), ".devcontainer");
+  const contextPath = resolve(base, typeof context === "string" ? context : ".");
+  const paths = [contextPath];
+  if (typeof dockerfile === "string") paths.push(resolve(base, dockerfile));
+  for (const path of paths) {
+    if (!within(devcontainerDir, path) || !within(allowed, realish(path))) {
+      throw new RecipeError(
+        "recipe_context_outside",
+        `the recipe's build reads ${relative(checkoutDir, path) || "."}, outside .devcontainer/; move the build files into .devcontainer/`
+      );
+    }
+  }
+}
+function writeSanitizedRecipe(checkoutDir, location, recipe) {
+  if (location.kind === "default") throw new Error("the default image has no recipe to sanitize");
+  const path = location.path === ROOT_RECIPE ? join(checkoutDir, ".outerlayer-recipe.json") : join(checkoutDir, ".devcontainer", SANITIZED_NAME);
+  writeFileSync(path, `${JSON.stringify(sanitizeRecipe(recipe), null, 2)}
+`);
+  return path;
+}
+var SANITIZED_NAME = "outerlayer-recipe.json";
+
+export { RecipeError, SANITIZED_NAME, assertBuildable, classifyProperties, locateRecipe, readRecipe, writeSanitizedRecipe };