@outerlayer/cli 0.2.0 → 0.4.1

package/dist/{context-materialize-6WKT3RBQ.js → chunk-XDDW4FRS.js}

@@ -1,17 +1,55 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { readPin, pinExists, writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, SOURCE_CACHE_TTL_SUCCESS_MS, readContextManifest, isLastCheckFresh, manifestFilesPresent, readDegraded, touchLastCheck, clearDegraded, writeContextManifest, writePinIfChanged, readSourceCache, isSourceCacheFresh } from './chunk-A3WLZX2F.js';
-import { parseGoverns, normalizeRepoName, CONTEXT_SOURCE_CONFIG_PATH } from './chunk-KFYJV2ZG.js';
+import { readPin, pinExists, readBuildHold, readContextManifest, manifestFilesPresent, writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, SOURCE_CACHE_TTL_SUCCESS_MS, isLastCheckFresh, readDegraded, touchLastCheck, clearDegraded, writeContextManifest, writePinIfChanged, readSourceCache, isSourceCacheFresh } from './chunk-WIOZAJ2W.js';
+import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-WO2BXCTQ.js';
+import { parseGoverns, normalizeRepoName, CONTEXT_SOURCE_CONFIG_PATH, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-EMY4I27X.js';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
-import { ensureContextExcludes, ensurePreCommitGuardHook } from './chunk-I3ETLSNE.js';
-import { readCloudConfig } from './chunk-TFUIDMOB.js';
+import { defaultFetch } from './chunk-BCLJSQCV.js';
+import { resolveGatewayCredentials } from './chunk-BOLTI6LR.js';
+import { ensureContextExcludes, ensurePreCommitGuardHook } from './chunk-XCCLFVXM.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import './chunk-Z5GEFMRW.js';
 import { execFileSync } from 'child_process';
-import { existsSync, mkdirSync, writeFileSync, chmodSync, unlinkSync, readdirSync, rmSync, lstatSync } from 'fs';
-import { isAbsolute, join, dirname, relative } from 'path';
+import { lstatSync, existsSync, mkdirSync, writeFileSync, chmodSync, unlinkSync, readdirSync, rmSync, readFileSync, copyFileSync } from 'fs';
+import { join, isAbsolute, dirname, relative } from 'path';
 
 createRequire(import.meta.url);
+var CONFIG_PATH = ".outerlayer/config.json";
+var CONTENT_KINDS = /* @__PURE__ */ new Set(["skill", "skill-reference"]);
+function overlayMaintainedSkills(repoRoot, unsafe) {
+  const sources = loadMaintainedFiles().filter((file) => !unsafe(file.path));
+  writeMaintainedFiles(repoRoot, sources);
+  const paths = sources.map((file) => file.path);
+  const configAbs = join(repoRoot, CONFIG_PATH);
+  if (!existsSync(configAbs)) return paths;
+  const config = parseOuterlayerConfig(readFileSync(configAbs, "utf8"));
+  if (!config.ok || !config.config) return paths;
+  const { entries } = classifyTree(sources.map((file) => file.path));
+  const input = {
+    entries,
+    contents: new Map(entries.filter((e) => CONTENT_KINDS.has(e.kind)).map((e) => [e.path, sources.find((f) => f.path === e.path).content])),
+    assetPaths: [],
+    targets: config.config.targets
+  };
+  const compiled = emitTree(input);
+  if (compiled.errors.length > 0) return paths;
+  for (const file of compiled.files) {
+    if (unsafe(file.path)) continue;
+    const abs = join(repoRoot, file.path);
+    mkdirSync(dirname(abs), { recursive: true });
+    if (!existsSync(abs) || readFileSync(abs, "utf8") !== file.content) writeFileSync(abs, file.content);
+    paths.push(file.path);
+  }
+  for (const copy of compiled.copies) {
+    if (unsafe(copy.toPath)) continue;
+    const abs = join(repoRoot, copy.toPath);
+    mkdirSync(dirname(abs), { recursive: true });
+    copyFileSync(join(repoRoot, copy.fromSourcePath), abs);
+    paths.push(copy.toPath);
+  }
+  return paths;
+}
+
+// src/context-materialize.ts
 var defaultGitRunner = (args, opts) => {
   try {
     const stdout = execFileSync("git", args, {
@@ -54,8 +92,11 @@ function gitText(git, cwd, args, timeoutMs) {
 var NOT_GOVERNED_MESSAGE = "this repository's control plane no longer governs it";
 var ADOPTION_MESSAGE = "committed context files shadow the control plane \u2014 remove them in a commit";
 var CANNOT_IDENTIFY_MESSAGE = "this repository is governed, but the control plane cannot be identified \u2014 check OuterLayer connectivity/config";
-var DESIGNATION_AUTH_REJECTED_MESSAGE = "the OuterLayer API key was rejected (401/403) \u2014 check apiKey in ~/.outerlayer/config.json";
+function designationAuthRejectedMessage(credential) {
+  return credential.startsWith("olu_") ? "the OuterLayer login was rejected (401/403) \u2014 run `outerlayer login` to sign in again" : "the OuterLayer API key was rejected (401/403) \u2014 check apiKey in ~/.outerlayer/config.json";
+}
 var PARTIAL_WRITE_MESSAGE = "control-plane content could not be fully written \u2014 running on previous context";
+var OVERLAY_FAILED_MESSAGE = "control-plane content was written but the maintained skills could not be refreshed \u2014 retrying next session";
 var COMMIT_GUARD_FOREIGN_NOT_INSTALLED_MESSAGE = "the materialized-context commit guard is NOT installed \u2014 a pre-commit hook this clone did not write occupies that slot \u2014 resolve the conflict or run `outerlayer hooks install-git`";
 var COMMIT_GUARD_HOOKSPATH_NOT_INSTALLED_MESSAGE = "the materialized-context commit guard is NOT installed \u2014 hooks are managed via core.hooksPath, which this clone never writes to automatically \u2014 adopt it yourself: `outerlayer hooks install-git --print`";
 function guardNotInstalledMessage(guard) {
@@ -100,7 +141,7 @@ async function materializeContext(deps) {
   const home = deps.home ?? homeFromEnv();
   const now = deps.now ?? Date.now;
   const git = deps.git ?? defaultGitRunner;
-  const fetchImpl = deps.fetchImpl ?? fetch;
+  const fetchImpl = deps.fetchImpl ?? defaultFetch;
   const repoRoot = gitText(git, deps.cwd, ["rev-parse", "--show-toplevel"], 2e3);
   if (repoRoot === void 0) {
     return { status: "not-a-repo", sha: null, verification: "none" };
@@ -125,34 +166,53 @@ async function materializeContext(deps) {
     clearDegraded(gitCommonDir);
     return { status: "self", sha: null, verification: "none" };
   };
+  const hold = readBuildHold(gitCommonDir);
+  if (hold !== void 0) {
+    const heldManifest = readContextManifest(gitCommonDir);
+    if (heldManifest !== void 0 && heldManifest.sha === hold.sha && pin?.sha === hold.sha && manifestFilesPresent(repoRoot, heldManifest)) {
+      ensureContextExcludes(gitCommonDir);
+      recordMaintainedOverlay(repoRoot, gitCommonDir, heldManifest);
+      const guardMessage2 = guardNotInstalledMessage(ensurePreCommitGuardHook(repoRoot, gitCommonDir));
+      record(hold.sha, "verified", hold.repository, hold.ref);
+      return {
+        status: "debounced",
+        sha: hold.sha,
+        verification: "verified",
+        ...guardMessage2 ? { message: guardMessage2 } : {}
+      };
+    }
+  }
   const ownRepoName = deriveOwnRepoName(git, repoRoot);
   if (ownRepoName === void 0) {
     return selfOutcome();
   }
-  const designation = await resolveDesignation({ git, fetchImpl, home, now, gitCommonDir, ownRepoName });
+  const designation = await resolveDesignation({ git, fetchImpl, home, cloud: deps.cloud, now, gitCommonDir, ownRepoName, repoRoot });
+  const answered = { designation: "answered" };
   if (designation.status === "self") {
-    return selfOutcome();
+    return { ...selfOutcome(), ...answered };
   }
   if (designation.status === "unknown") {
-    const message = designation.authRejected ? DESIGNATION_AUTH_REJECTED_MESSAGE : CANNOT_IDENTIFY_MESSAGE;
+    const message = designation.authRejected ?? CANNOT_IDENTIFY_MESSAGE;
     if (hasPin) {
       writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind: "designation-unverified", message });
       record(null, "none");
-      return { status: "designation-unverified", message, sha: null, verification: "none" };
+      return { status: "designation-unverified", message, sha: null, verification: "none", designation: "unknown" };
     }
     if (designation.authRejected) {
       writeDegraded(gitCommonDir, { at: new Date(now()).toISOString(), kind: "designation-unverified", message });
     }
     writeSourceCache(gitCommonDir, { checkedAt: new Date(now()).toISOString(), status: "self", ttlMs: SOURCE_CACHE_TTL_RETRY_MS });
-    return { status: "self", sha: null, verification: "none" };
+    return { status: "self", sha: null, verification: "none", designation: "unknown", ...designation.authRejected ? { authRejected: true } : {} };
   }
   let repository;
   let ref;
   let unverifiedIdentity;
   let preFetched;
+  let unreadableCandidates = [];
   if (designation.status === "candidates") {
     const sortedCandidates = [...designation.candidates].sort((a, b) => a.repository.localeCompare(b.repository));
     const claimants = [];
+    const unfetched = [];
     for (const candidate of sortedCandidates) {
       const candidateUrl = deps.resolveControlPlaneUrl ? deps.resolveControlPlaneUrl(candidate.repository, candidate.ref, repoRoot) : buildControlPlaneUrl(git, repoRoot, candidate.repository);
       const candidateHost = parseRemoteHost(candidateUrl).host || "unknown-host";
@@ -162,9 +222,15 @@ async function materializeContext(deps) {
         cwd: candidateCacheDir,
         timeoutMs: 1e4
       });
-      if (!candidateFetch.ok) continue;
+      if (!candidateFetch.ok) {
+        unfetched.push(candidate.repository);
+        continue;
+      }
       const candidateSha = gitText(git, candidateCacheDir, ["rev-parse", candidateLocalRef], 2e3);
-      if (candidateSha === void 0) continue;
+      if (candidateSha === void 0) {
+        unfetched.push(candidate.repository);
+        continue;
+      }
       const candidateConfig = readBlobAtPath(git, candidateCacheDir, candidateSha, CONTEXT_SOURCE_CONFIG_PATH);
       const candidateGoverns = candidateConfig === void 0 ? { governs: [] } : parseGoverns(candidateConfig);
       const candidateGovernsList = "error" in candidateGoverns ? [] : candidateGoverns.governs;
@@ -174,7 +240,7 @@ async function materializeContext(deps) {
     }
     if (claimants.length === 0) {
       writeSourceCache(gitCommonDir, { checkedAt: new Date(now()).toISOString(), status: "self", ttlMs: SOURCE_CACHE_TTL_SUCCESS_MS });
-      return selfOutcome();
+      return { ...selfOutcome(), ...answered, ...unfetched.length > 0 ? { unfetched } : {} };
     }
     if (claimants.length > 1) {
       const names = claimants.map((c) => c.repository).sort();
@@ -186,6 +252,7 @@ async function materializeContext(deps) {
       record(lastGood, verification);
       return { status: "conflict", message, sha: lastGood, verification };
     }
+    unreadableCandidates = unfetched;
     const winner = claimants[0];
     writeSourceCache(gitCommonDir, {
       checkedAt: new Date(now()).toISOString(),
@@ -227,6 +294,7 @@ async function materializeContext(deps) {
       const degraded = readDegraded(gitCommonDir);
       const verification = degraded ? "unverified" : "verified";
       ensureContextExcludes(gitCommonDir);
+      recordMaintainedOverlay(repoRoot, gitCommonDir, manifest);
       const guardMessage2 = guardNotInstalledMessage(ensurePreCommitGuardHook(repoRoot, gitCommonDir));
       record(manifest.sha, verification, repository, ref);
       return {
@@ -255,6 +323,7 @@ async function materializeContext(deps) {
         touchLastCheck(gitCommonDir, now());
         clearOrFlagIdentity();
         ensureContextExcludes(gitCommonDir);
+        recordMaintainedOverlay(repoRoot, gitCommonDir, manifest);
         const guardMessage2 = guardNotInstalledMessage(ensurePreCommitGuardHook(repoRoot, gitCommonDir));
         writeSourceCache(gitCommonDir, { checkedAt: new Date(now()).toISOString(), status: "governed", repository, ref, ttlMs: SOURCE_CACHE_TTL_SUCCESS_MS });
         record(remoteSha, "verified", repository, ref);
@@ -335,14 +404,36 @@ async function materializeContext(deps) {
   if (!writeResult.ok) {
     return partialWrite();
   }
-  const deleteResult = manifest ? deleteRemovedFiles(repoRoot, manifest.files, writeResult.writtenPaths) : { skipped: [] };
+  let overlayPaths = [];
+  let overlayFailed = false;
+  try {
+    overlayPaths = overlayMaintainedSkills(repoRoot, (rel) => hasSymlinkComponent(repoRoot, rel));
+  } catch {
+    overlayFailed = true;
+  }
+  const writtenPaths = [.../* @__PURE__ */ new Set([...writeResult.writtenPaths, ...overlayPaths])];
+  const deleteResult = manifest ? deleteRemovedFiles(repoRoot, manifest.files, writtenPaths) : { skipped: [] };
+  if (overlayFailed && deleteResult.skipped.length === 0) {
+    writeContextManifest(gitCommonDir, { schemaVersion: 1, sha, files: writtenPaths, materializedAt: new Date(now()).toISOString() });
+    writeDegraded(gitCommonDir, {
+      at: new Date(now()).toISOString(),
+      kind: "unreachable",
+      message: OVERLAY_FAILED_MESSAGE,
+      repository,
+      ref,
+      lastGoodSha: sha
+    });
+    if (!evidenced) return { status: "unreachable", sha: null, verification: "none" };
+    record(sha, "unverified", repository, ref);
+    return { status: "unreachable", message: OVERLAY_FAILED_MESSAGE, sha, verification: "unverified" };
+  }
   if (deleteResult.skipped.length > 0) {
     return partialWrite();
   }
   const newManifest = {
     schemaVersion: 1,
     sha,
-    files: writeResult.writtenPaths,
+    files: writtenPaths,
     materializedAt: new Date(now()).toISOString()
   };
   writeContextManifest(gitCommonDir, newManifest);
@@ -357,23 +448,40 @@ async function materializeContext(deps) {
     status: "materialized",
     sha,
     verification: "verified",
-    ...guardMessage ? { message: guardMessage } : {}
+    ...guardMessage ? { message: guardMessage } : {},
+    ...unreadableCandidates.length > 0 ? { unfetched: unreadableCandidates } : {}
   };
 }
+function recordMaintainedOverlay(repoRoot, gitCommonDir, manifest) {
+  let overlayPaths;
+  try {
+    overlayPaths = overlayMaintainedSkills(repoRoot, (rel) => hasSymlinkComponent(repoRoot, rel));
+  } catch {
+    return;
+  }
+  const known = new Set(manifest.files);
+  const added = overlayPaths.filter((path) => !known.has(path));
+  if (added.length > 0) writeContextManifest(gitCommonDir, { ...manifest, files: [...manifest.files, ...added] });
+}
 async function resolveDesignation(ctx) {
   const cache = readSourceCache(ctx.gitCommonDir);
   if (cache && isSourceCacheFresh(cache, ctx.now())) {
     return cache.status === "governed" && cache.repository && cache.ref ? { status: "governed", repository: cache.repository, ref: cache.ref } : { status: "self" };
   }
-  let authRejected = false;
-  const config = readCloudConfig(ctx.home);
-  if (config.url && config.apiKey && config.appId) {
+  let authRejected;
+  const destination = resolveGatewayCredentials({
+    home: ctx.home,
+    env: {},
+    cwd: ctx.repoRoot,
+    ...ctx.cloud === void 0 ? {} : { url: ctx.cloud.url, apiKey: ctx.cloud.apiKey, appId: ctx.cloud.appId }
+  });
+  if (destination.ok) {
     const sources = await fetchContextSource(
-      config,
+      { url: destination.url, apiKey: destination.credential, appId: destination.appId },
       ctx.ownRepoName,
       ctx.fetchImpl,
       () => {
-        authRejected = true;
+        authRejected = designationAuthRejectedMessage(destination.credential);
       }
     );
     if (sources !== void 0) {
@@ -586,4 +694,4 @@ function pruneEmptyDirs(dir, stopAt) {
   }
 }
 
-export { defaultGitRunner, materializeContext, parseOwnerRepo, parseRemoteHost };
+export { defaultGitRunner, hasSymlinkComponent, materializeContext, parseOwnerRepo, parseRemoteHost, resolveGitCommonDir };

package/dist/chunk-Y7KJLXYN.js

@@ -0,0 +1,232 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { dashboardBase, isRepositoryLinked, workPageUrl, notLinkedText } from './chunk-SY4GK4SP.js';
+import { sanitizeTerminal } from './chunk-WFJ65NUD.js';
+import { remoteLookupFailed } from './chunk-4C4THABW.js';
+import { resolveGatewayCredentials } from './chunk-BOLTI6LR.js';
+import { findGitDirs, readRepoConnection, writeRepoConnection } from './chunk-BJ3KTMDH.js';
+import { createInterface } from 'readline/promises';
+
+createRequire(import.meta.url);
+var REQUEST_TIMEOUT_MS = 15e3;
+var EXIT_NOT_LINKED = 2;
+var REASON_TEXT = {
+  flag: "you passed --factory",
+  saved: "already connected",
+  linked: "the repository is linked to it",
+  only: "the only factory you can use",
+  prompt: "you chose it"
+};
+var slug = (f) => `${f.organization.name}/${f.name}`;
+function result(code, outcome, reason, text) {
+  return { code, outcome, reason, text: text.endsWith("\n") ? text : `${text}
+` };
+}
+function realConnectDeps() {
+  return { fetchImpl: fetch, env: process.env, prompt: promptOnTerminal, now: () => /* @__PURE__ */ new Date() };
+}
+async function promptOnTerminal(question, io = { input: process.stdin, output: process.stderr }) {
+  const rl = createInterface(io);
+  try {
+    let text = `
+${question.message}
+`;
+    question.options.forEach((o, i) => {
+      text += `  ${i + 1}) ${o.label}
+`;
+    });
+    for (; ; ) {
+      const answer = (await rl.question(`${text}Choose 1-${question.options.length}: `)).trim();
+      if (answer === "") return void 0;
+      const picked = question.options[Number(answer) - 1];
+      if (picked !== void 0) return picked.value;
+      text = "";
+    }
+  } catch {
+    return void 0;
+  } finally {
+    rl.close();
+  }
+}
+function parseFactories(body) {
+  const rows = body?.data;
+  if (!Array.isArray(rows)) return void 0;
+  const out = [];
+  for (const row of rows) {
+    const org = row?.organization;
+    if (typeof row?.id !== "string" || typeof row.name !== "string" || typeof org?.id !== "string" || typeof org.name !== "string") return void 0;
+    out.push({
+      id: row.id,
+      name: sanitizeTerminal(row.name),
+      displayName: sanitizeTerminal(typeof row.displayName === "string" ? row.displayName : row.name),
+      organization: {
+        id: org.id,
+        name: sanitizeTerminal(org.name),
+        displayName: sanitizeTerminal(typeof org.displayName === "string" ? org.displayName : org.name)
+      },
+      linked: typeof row.linked === "boolean" ? row.linked : null
+    });
+  }
+  return out;
+}
+function listText(factories, repository) {
+  return factories.map((f) => `  ${slug(f)}  ${f.displayName}${f.linked === true ? ` (linked to ${repository})` : ""}`).join("\n");
+}
+async function fetchFactories(deps, url, token, repository) {
+  let res;
+  try {
+    res = await deps.fetchImpl(`${url.replace(/\/+$/, "")}/v1/me/factories?${new URLSearchParams({ repository }).toString()}`, {
+      method: "GET",
+      headers: { authorization: `Bearer ${token}` },
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+    });
+  } catch (err) {
+    const message = `could not reach ${url}: ${err instanceof Error ? err.message : String(err)}`;
+    return { ok: false, result: result(1, "failed", message, message) };
+  }
+  if (res.status === 401) {
+    const message = "the gateway refused the login. Run `outerlayer login` to sign in again.";
+    return { ok: false, result: result(1, "failed", message, message) };
+  }
+  if (!res.ok) {
+    const message = `${url} answered HTTP ${res.status} when listing your factories`;
+    return { ok: false, result: result(1, "failed", message, message) };
+  }
+  const factories = parseFactories(await res.json().catch(() => null));
+  if (factories === void 0) {
+    const message = `${url} answered, but the reply is not a list of factories. Check the gateway address with \`outerlayer doctor\`, then run \`outerlayer connect\` again.`;
+    return { ok: false, result: result(1, "failed", `${url} did not answer with a factory list`, message) };
+  }
+  return { ok: true, factories };
+}
+async function choose(flags, deps, factories, saved, repository) {
+  if (flags.factory !== void 0) {
+    const wanted = flags.factory.toLowerCase();
+    const named = factories.find((f) => f.id.toLowerCase() === wanted || slug(f).toLowerCase() === wanted);
+    if (named) return { factory: named, reason: "flag" };
+    const message = `no factory you can use is named "${flags.factory}". Choose one with --factory:
+${listText(factories, repository)}`;
+    return result(1, "failed", `--factory ${flags.factory} names no factory you can use`, message);
+  }
+  const remembered = saved && factories.find((f) => f.id === saved.appId);
+  if (remembered) return { factory: remembered, reason: "saved" };
+  const linked = factories.filter((f) => f.linked === true);
+  if (linked.length === 1) return { factory: linked[0], reason: "linked" };
+  if (factories.length === 1) return { factory: factories[0], reason: "only" };
+  if (!deps.isTerminal) {
+    const why = linked.length > 1 ? `${repository} is linked to more than one factory you can use` : `you can use more than one factory, and none is the only one ${repository} is linked to`;
+    const message = `${why}, and there is no terminal to ask on.
+Run \`outerlayer connect --factory <org>/<factory>\` with one of:
+${listText(factories, repository)}`;
+    return result(1, "failed", "more than one factory fits; pass --factory", message);
+  }
+  let pool = factories;
+  const orgs = new Map(factories.map((f) => [f.organization.id, f.organization]));
+  if (orgs.size > 1) {
+    const org = await deps.prompt({
+      message: "Which organization?",
+      options: [...orgs.values()].map((o) => ({ label: `${o.displayName} (${o.name})`, value: o.id }))
+    });
+    pool = factories.filter((f) => f.organization.id === org);
+  }
+  const picked = pool.length === 0 ? void 0 : await deps.prompt({
+    message: `Which factory should ${repository} use?`,
+    options: pool.map((f) => ({
+      label: `${f.displayName} (${slug(f)})${f.linked === true ? ` - linked to ${repository}` : ""}`,
+      value: f.id
+    }))
+  });
+  const factory = pool.find((f) => f.id === picked);
+  if (!factory) return result(1, "failed", "no factory was chosen", "no factory was chosen. Run `outerlayer connect` again, or pass --factory <org>/<factory>.");
+  return { factory, reason: "prompt" };
+}
+async function runConnect(flags, deps) {
+  const creds = resolveGatewayCredentials({ home: deps.home, env: deps.env, cwd: deps.cwd });
+  if (creds.credential === void 0) {
+    const message = "no saved credential. Run `outerlayer login` to sign in, then run `outerlayer connect` again.";
+    return { ...result(1, "skipped", "no credential; run `outerlayer login` first", message), next: "Run `outerlayer login`, then `outerlayer init` again." };
+  }
+  if (creds.kind === "key") {
+    if (flags.factory !== void 0 && flags.factory !== creds.appId) {
+      const message2 = `a factory key decides the factory${creds.appId ? ` (${creds.appId})` : ""}, so --factory ${flags.factory} cannot apply. Remove --factory, or sign in with \`outerlayer login\` and unset the key.`;
+      return result(1, "failed", "--factory names a factory other than the key's", message2);
+    }
+    const message = `Your factory key decides the factory${creds.appId ? ` (${creds.appId})` : ""}, so there is nothing to connect. No file was changed.`;
+    return result(0, "done", "the factory key decides the factory", message);
+  }
+  if (findGitDirs(deps.cwd) === void 0) {
+    return result(1, "skipped", "not in a git repository", "connect chooses a factory for a repository, and this directory is not in a git repository. Run it inside one.");
+  }
+  const repository = deps.resolveRepository(deps.cwd);
+  if (repository === void 0 && remoteLookupFailed(deps.cwd)) {
+    const message = "git did not answer when asked for this repository's remote, so connect cannot tell which repository it is. Run `git remote -v` here, then run `outerlayer connect` again.";
+    return result(1, "failed", "git could not read this repository's remote", message);
+  }
+  if (repository === void 0) {
+    return result(1, "skipped", "this repository has no git remote", "this repository has no git remote, so connect cannot tell which repository it is. Add one (`git remote add origin <url>`), then run `outerlayer connect` again.");
+  }
+  if (creds.url === void 0) {
+    const message = "no gateway address is saved. Run `outerlayer login` to sign in.";
+    return result(1, "failed", message, message);
+  }
+  const listed = await fetchFactories(deps, creds.url, creds.credential, repository);
+  if (!listed.ok) return listed.result;
+  const { factories } = listed;
+  if (factories.length === 0) {
+    const message = `you can use no factory yet. Create one in the dashboard: ${dashboardBase(deps.home)}/orgs`;
+    return result(1, "failed", "no factory to choose from; create one in the dashboard", message);
+  }
+  const dirs = findGitDirs(deps.cwd);
+  const saved = readRepoConnection(deps.cwd);
+  const choice = await choose(flags, deps, factories, saved, repository);
+  if ("code" in choice) return choice;
+  const { factory, reason } = choice;
+  if (saved?.appId !== factory.id) {
+    try {
+      writeRepoConnection(dirs.gitCommonDir, {
+        appId: factory.id,
+        organization: { name: factory.organization.name, displayName: factory.organization.displayName },
+        factory: { name: factory.name, displayName: factory.displayName },
+        savedAt: deps.now().toISOString()
+      });
+    } catch (err) {
+      const message = `could not save the connection under ${dirs.gitCommonDir}: ${err instanceof Error ? err.message : String(err)}`;
+      return result(1, "failed", "could not save the connection", message);
+    }
+  }
+  const connected = `Connected ${repository} to factory "${factory.displayName}" in ${factory.organization.displayName} (${REASON_TEXT[reason]}).
+`;
+  const why = `connected to ${slug(factory)}: ${REASON_TEXT[reason]}`;
+  const linked = await isRepositoryLinked(deps.fetchImpl, creds.url, creds.credential, factory.id, repository);
+  const chosen = { repository, factory: slug(factory) };
+  if (linked === false) {
+    const linkUrl = workPageUrl(deps.home, factory.organization.name, factory.name);
+    return { ...result(EXIT_NOT_LINKED, "done", why, connected + notLinkedText(factory.displayName, repository, linkUrl)), ...chosen, linked, linkUrl };
+  }
+  const changeIt = "Run `outerlayer connect --factory <org>/<factory>` to change it.";
+  const text = linked === null ? `${connected}Could not check whether ${sanitizeTerminal(repository)} is linked to ${factory.displayName}.
+${changeIt}` : connected + changeIt;
+  return { ...result(0, "done", why, text), ...chosen, linked };
+}
+function connectDocument(r) {
+  return {
+    status: r.outcome,
+    reason: r.reason,
+    ...r.repository === void 0 ? {} : { repository: r.repository, factory: r.factory },
+    ...r.linked === void 0 ? {} : { linked: r.linked },
+    ...r.linkUrl === void 0 ? {} : { linkUrl: r.linkUrl }
+  };
+}
+async function runConnectCommand(flags, deps, out) {
+  const r = await runConnect(flags, deps);
+  if (flags.json) {
+    out.stdout.write(`${JSON.stringify(connectDocument(r), null, 2)}
+`);
+    out.stderr.write(r.outcome === "done" ? r.text : `\u2717 ${r.text}`);
+    return r.code;
+  }
+  (r.code === 0 ? out.stdout : out.stderr).write(r.outcome === "done" ? r.text : `\u2717 ${r.text}`);
+  return r.code;
+}
+
+export { promptOnTerminal, realConnectDeps, runConnect, runConnectCommand };

package/dist/chunk-YFHIIH4B.js

@@ -0,0 +1,102 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-3TFPDVTI.js';
+import { MIN_ENGINE_MAJOR } from './chunk-HZRNMGLF.js';
+import { RUNNER_DIR_MODE, runnerDir, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
+import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
+import { dirname } from 'path';
+
+createRequire(import.meta.url);
+var RunnerInitError = class extends Error {
+};
+var UNMARKED_PLACEHOLDER_COMMAND = "echo 'edit runner.commands in this config file: it must start your agent on item $OUTERLAYER_WORK' >&2; exit 1";
+var PLACEHOLDER_MARKER = "outerlayer-placeholder";
+var PLACEHOLDER_COMMAND = `${UNMARKED_PLACEHOLDER_COMMAND} # ${PLACEHOLDER_MARKER}`;
+function isolationNote(machine) {
+  const has = describeMachineDocker(machine);
+  const reach = reachDockerStep(machine);
+  const needs = reach !== void 0 ? `Isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later: ${reach}, then set both hooks to builtin:container.` : machine.platform === "windows" ? `Isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later inside WSL2: install it there, run the runner from a WSL2 shell, and set both hooks to builtin:container.` : `Isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later on Linux or WSL2. Once it is installed, set both hooks to builtin:container.`;
+  return `This machine has ${has}, so builds run as processes under this user (isolation: shared-user), through the tunnel. ${needs}`;
+}
+function processRefusal(machine) {
+  const reach = reachDockerStep(machine);
+  const needs = machine.platform === "darwin" ? "Isolated builds on a Mac run in a Linux VM: run this again with --vm." : reach !== void 0 ? `Isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later: ${reach}, then run this again.` : machine.platform === "windows" ? `Isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later inside WSL2: install it there, then run this again from a WSL2 shell.` : `Isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later on Linux or WSL2: install it, then run this again.`;
+  return `This machine has ${describeMachineDocker(machine)}, so it cannot isolate a build. ${needs} To run builds as processes under this user instead, where a build can read this user's files and the runner's Claude credential, run this again with --allow-process-builds.`;
+}
+function isPlaceholderCommand(command) {
+  return command === UNMARKED_PLACEHOLDER_COMMAND || command.includes(PLACEHOLDER_MARKER);
+}
+function readConfigObject(configPath) {
+  if (!existsSync(configPath)) {
+    throw new RunnerInitError(
+      `${configPath}: no config file. Run \`outerlayer login\` first, then this command.`
+    );
+  }
+  try {
+    return JSON.parse(readFileSync(configPath, "utf8"));
+  } catch (err) {
+    throw new RunnerInitError(`${configPath}: not valid JSON (${err instanceof Error ? err.message : String(err)})`);
+  }
+}
+function parseStdinConfig(configPath, text) {
+  if (existsSync(configPath)) {
+    throw new RunnerInitError(
+      `${configPath}: a config file is already here, so the runner key in it is not replaced. Remove it, or delete the VM and start again.`
+    );
+  }
+  let config;
+  try {
+    config = JSON.parse(text);
+  } catch (err) {
+    throw new RunnerInitError(`the config on stdin is not valid JSON (${err instanceof Error ? err.message : String(err)})`);
+  }
+  if (typeof config.url !== "string" || typeof config.apiKey !== "string" || typeof config.appId !== "string") {
+    throw new RunnerInitError("the config on stdin needs url, apiKey and appId.");
+  }
+  const carried = config.runner;
+  delete config.runner;
+  return { config, carried };
+}
+function runRunnerInit(configPath, opts = {}) {
+  let config;
+  let carried;
+  if (opts.configFromStdin === void 0) {
+    config = readConfigObject(configPath);
+    if (config.runner !== void 0) {
+      throw new RunnerInitError(`${configPath}: a runner block is already here. Edit it, or remove it and run this again.`);
+    }
+  } else {
+    ({ config, carried } = parseStdinConfig(configPath, opts.configFromStdin));
+  }
+  const machine = opts.machine ?? detectMachine();
+  if (opts.requireContainer === true && !supportsContainerBuilds(machine)) {
+    const fix = reachDockerStep(machine) ?? `install Docker Engine ${MIN_ENGINE_MAJOR} or later in the VM`;
+    throw new RunnerInitError(`the VM has ${describeMachineDocker(machine)}, but the runner in it needs container builds: ${fix}, then run this again.`);
+  }
+  const hooks = opts.requireContainer !== true && supportsMicroVmBuilds(machine) ? "builtin:vm" : supportsContainerBuilds(machine) ? "builtin:container" : "builtin:process";
+  if (hooks === "builtin:process" && opts.allowProcess !== true) throw new RunnerInitError(processRefusal(machine));
+  if (opts.configFromStdin !== void 0) mkdirSync(dirname(configPath), { recursive: true, mode: RUNNER_DIR_MODE });
+  mkdirSync(runnerDir(configPath), { recursive: true, mode: RUNNER_DIR_MODE });
+  config.runner = {
+    queues: ["implement", "amend"],
+    concurrency: 1,
+    pollSeconds: 60,
+    timeLimitMinutes: 480,
+    idleLimitMinutes: 30,
+    // A placeholder that fails loudly. A command line that quietly did
+    // nothing would claim an item, run, exit zero, and record `ok` —
+    // every attempt reading as a success that produced nothing.
+    commands: {
+      implement: PLACEHOLDER_COMMAND,
+      amend: PLACEHOLDER_COMMAND
+    },
+    ...carried,
+    hooks: { provision: hooks, cleanup: hooks }
+  };
+  mkdirSync(dirname(configPath), { recursive: true });
+  writeFileSync(configPath, `${JSON.stringify(config, null, 2)}
+`, { mode: RUNNER_FILE_MODE });
+  return { configPath, hooks, ...hooks === "builtin:process" ? { note: isolationNote(machine) } : {} };
+}
+
+export { PLACEHOLDER_MARKER, RunnerInitError, isPlaceholderCommand, readConfigObject, runRunnerInit };