@outerlayer/cli 0.2.0 → 0.4.1

package/dist/{chunk-R5KBGVII.js → chunk-5QRP3MVS.js}

@@ -5,7 +5,7 @@ import { existsSync, readFileSync, mkdirSync, copyFileSync, writeFileSync } from
 import { join, dirname, isAbsolute } from 'path';
 
 createRequire(import.meta.url);
-var REGISTERED_EVENTS = ["SessionStart", "SessionEnd", "Stop"];
+var REGISTERED_EVENTS = ["SessionStart", "SessionEnd", "Stop", "PostToolUse"];
 var MARKER = "_outerlayer";
 function settingsPath(scope, opts = {}) {
   const home = opts.home ?? homeFromEnv();
@@ -43,6 +43,12 @@ function tokenizeCommand(command) {
 function quoteBin(bin) {
   return /\s/.test(bin) ? `"${bin}"` : bin;
 }
+function isScriptBin(bin) {
+  return /\.[cm]?js$/i.test(bin);
+}
+function cliCommand(cliBin) {
+  return isScriptBin(cliBin) ? `node ${quoteBin(cliBin)}` : quoteBin(cliBin);
+}
 function isOurBin(bin, cliBin) {
   if (cliBin !== void 0 && normalizeBinPath(bin) === normalizeBinPath(cliBin)) return true;
   const parts = bin.replace(/\\/g, "/").split("/");
@@ -63,30 +69,40 @@ function splitCliInvocation(command, cliBin) {
   if (typeof command !== "string") return null;
   const tokens = tokenizeCommand(command.trim());
   if (!tokens) return null;
-  let i = 0;
   const launcher = (tokens[0] ?? "").replace(/\\/g, "/").split("/").pop() ?? "";
-  if (launcher === "node" || launcher === "node.exe" || launcher === "npx") i = 1;
+  const viaNode = launcher === "node" || launcher === "node.exe";
+  const viaNpx = launcher === "npx";
+  const i = viaNode || viaNpx ? 1 : 0;
   const bin = tokens[i];
   if (!bin || !isOurBin(bin, cliBin)) return null;
-  return { bin, args: tokens.slice(i + 1), viaNpx: launcher === "npx" };
+  return { bin, args: tokens.slice(i + 1), viaNpx, viaNode };
 }
 function parseCliInvocation(command, cliBin) {
   return splitCliInvocation(command, cliBin)?.args ?? null;
 }
 function ourCommandBins(settings) {
-  const bins = [];
+  return unique(ourCommandLaunches(settings).map((l) => l.bin));
+}
+function ourDirectScriptBins(settings) {
+  return unique(ourCommandLaunches(settings).filter((l) => !l.viaNode && isScriptBin(l.bin)).map((l) => l.bin));
+}
+function ourCommandLaunches(settings) {
+  const launches = [];
   const add = (command) => {
     const parsed = splitCliInvocation(command);
     if (!parsed || parsed.viaNpx) return;
     if (!["hook", "hook-wrap", "statusline"].includes(parsed.args[0] ?? "")) return;
     if (parsed.bin.includes("$") || !isAbsolute(parsed.bin)) return;
-    if (!bins.includes(parsed.bin)) bins.push(parsed.bin);
+    launches.push({ bin: parsed.bin, viaNode: parsed.viaNode });
   };
   for (const matchers of Object.values(settings?.hooks ?? {})) {
     for (const matcher of matchers ?? []) for (const h of matcher.hooks ?? []) add(h.command);
   }
   add(settings?.statusLine?.command);
-  return bins;
+  return launches;
+}
+function unique(values) {
+  return [...new Set(values)];
 }
 function parseLifecycleHookCommand(command, cliBin) {
   const args = parseCliInvocation(command, cliBin);
@@ -142,7 +158,7 @@ var SettingsParseError = class extends Error {
 };
 function ourEntry(cliBin, event) {
   return {
-    hooks: [{ type: "command", command: `${quoteBin(cliBin)} hook ${event}`, [MARKER]: true }]
+    hooks: [{ type: "command", command: `${cliCommand(cliBin)} hook ${event}`, [MARKER]: true }]
   };
 }
 function pruneOurHooks(blocks, cliBin) {
@@ -229,7 +245,7 @@ function wrapHookCommand(cliBin, h, opts = {}) {
   if (isWrapped(h, cliBin)) return h;
   const id = encodeWrappedCommand(h.command);
   const flag = opts.captureOutput ? " --capture-output" : "";
-  return { type: "command", command: `${quoteBin(cliBin)} hook-wrap --id ${id}${flag}`, [WRAP_MARKER]: h.command };
+  return { type: "command", command: `${cliCommand(cliBin)} hook-wrap --id ${id}${flag}`, [WRAP_MARKER]: h.command };
 }
 function unwrapHookCommand(h, cliBin) {
   const original = wrappedOriginalCommand(h, cliBin);
@@ -280,11 +296,11 @@ function repointWrappedHooks(settings, cliBin) {
         const h = matcher.hooks[hi];
         const parsed = splitCliInvocation(h.command, cliBin);
         if (!parsed || parsed.args[0] !== "hook-wrap") continue;
-        if (normalizeBinPath(parsed.bin) === normalizeBinPath(cliBin)) continue;
+        if (normalizeBinPath(parsed.bin) === normalizeBinPath(cliBin) && parsed.viaNode === isScriptBin(cliBin)) continue;
         const original = wrappedOriginalCommand(h, cliBin);
         if (original === null) continue;
         const flag = parsed.args.includes("--capture-output") ? " --capture-output" : "";
-        const desired = `${quoteBin(cliBin)} hook-wrap --id ${encodeWrappedCommand(original)}${flag}`;
+        const desired = `${cliCommand(cliBin)} hook-wrap --id ${encodeWrappedCommand(original)}${flag}`;
         matcher.hooks[hi] = { ...h, command: desired, [WRAP_MARKER]: original };
         changed = true;
       }
@@ -293,10 +309,10 @@ function repointWrappedHooks(settings, cliBin) {
   return { next, changed };
 }
 function statuslineCommand(cliBin) {
-  return `${quoteBin(cliBin)} statusline`;
+  return `${cliCommand(cliBin)} statusline`;
 }
 function statuslineWrapCommand(cliBin, original) {
-  return `${quoteBin(cliBin)} statusline --wrap-id ${encodeWrappedCommand(original)}`;
+  return `${cliCommand(cliBin)} statusline --wrap-id ${encodeWrappedCommand(original)}`;
 }
 function isOurStatuslineSlot(slot, cliBin) {
   if (slot[MARKER] === true) return true;
@@ -377,4 +393,4 @@ function unwrapHooks(settings, cliBin) {
   return { next, changed, unwrapped };
 }
 
-export { AUTO_WRAP_EVENTS, REGISTERED_EVENTS, SettingsParseError, cliBinResolvable, decodeWrappedCommand, isOurHookCommand, isOurStatuslineSlot, listHookCandidates, mergeHooks, mergeStatusline, ourCommandBins, readSettings, removeHooks, removeStatusline, repointWrappedHooks, settingsPath, statuslineWrappedOriginal, unwrapHooks, wrapHooks, wrappedOriginalCommand, writeSettings };
+export { AUTO_WRAP_EVENTS, REGISTERED_EVENTS, SettingsParseError, cliBinResolvable, cliCommand, decodeWrappedCommand, encodeWrappedCommand, isOurHookCommand, isOurHookCommandFor, isOurStatuslineSlot, isWrapped, listHookCandidates, mergeHooks, mergeStatusline, ourCommandBins, ourDirectScriptBins, parseLifecycleHookCommand, readSettings, removeHooks, removeStatusline, repointWrappedHooks, settingsPath, statuslineCommand, statuslineWrappedOriginal, unwrapHooks, wrapHooks, wrappedOriginalCommand, writeSettings };

package/dist/chunk-5Y3QQRUH.js

@@ -0,0 +1,300 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { parseSize, MAX_ALLOW_HOSTS, allowHostProblem } from './chunk-F6GFZXZ3.js';
+import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-AUFG23AA.js';
+import { homeFromEnv } from './chunk-VNVZDWO3.js';
+import { existsSync, statSync, accessSync, constants, readFileSync } from 'fs';
+import { hostname } from 'os';
+import { join } from 'path';
+
+createRequire(import.meta.url);
+var BUILTIN_CONTAINER = "builtin:container";
+var BUILTIN_PROCESS = "builtin:process";
+var BUILTIN_VM = "builtin:vm";
+function isBuiltinContainer(hook) {
+  return hook === BUILTIN_CONTAINER;
+}
+function isBuiltinProcess(hook) {
+  return hook === BUILTIN_PROCESS;
+}
+function isBuiltinVm(hook) {
+  return hook === BUILTIN_VM;
+}
+function builtinKind(hook) {
+  return isBuiltinContainer(hook) ? "container" : isBuiltinProcess(hook) ? "process" : isBuiltinVm(hook) ? "vm" : "own";
+}
+var RUNNER_QUEUES = ["implement", "amend"];
+var RunnerConfigError = class extends Error {
+};
+var DEFAULT_CONCURRENCY = 1;
+var DEFAULT_POLL_SECONDS = 60;
+var DEFAULT_TIME_LIMIT_MINUTES = 480;
+var DEFAULT_IDLE_LIMIT_MINUTES = 30;
+var DEFAULT_BUILD = { memory: "8g", cpus: 4, pids: 4096, disk: "40g", variables: [] };
+var BUILD_KEYS = ["memory", "cpus", "pids", "disk", "variables", "destinations", "allowHosts"];
+var VARIABLE_NAME = /^[A-Za-z_][A-Za-z0-9_]{0,254}$/;
+var MAX_VARIABLES = 100;
+function defaultRunnerConfigPath(home = homeFromEnv()) {
+  return join(home, ".outerlayer", "config.json");
+}
+function fail(configPath, key, reason) {
+  throw new RunnerConfigError(`${configPath}: ${key} ${reason}`);
+}
+function readConfigFile(configPath) {
+  if (!existsSync(configPath)) return {};
+  const text = readFileSync(configPath, "utf8");
+  try {
+    return JSON.parse(text);
+  } catch (err) {
+    throw new RunnerConfigError(
+      `${configPath}: is not valid JSON: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+function hasRunnerBlock(configPath) {
+  try {
+    const runner = readConfigFile(configPath).runner;
+    return typeof runner === "object" && runner !== null;
+  } catch {
+    return false;
+  }
+}
+function runnerVmOf(configPath) {
+  try {
+    const vm = readConfigFile(configPath).runnerVm;
+    return typeof vm?.instance === "string" && typeof vm.since === "string" ? { instance: vm.instance, since: vm.since } : void 0;
+  } catch {
+    return void 0;
+  }
+}
+var RUNNER_KEYS = [
+  "host",
+  "queues",
+  "concurrency",
+  "pollSeconds",
+  "timeLimitMinutes",
+  "idleLimitMinutes",
+  "commands",
+  "hooks",
+  "build",
+  "autoUpdate"
+];
+function runnerNumbers() {
+  return [
+    { key: "concurrency", min: 1 },
+    // Below five seconds a runner is asking the gateway a question it has
+    // just been answered. Above one day the gateway refuses every heartbeat
+    // this runner sends (`POST /v1/hosts/heartbeat` caps `pollSeconds` at
+    // 86400), so the host would poll and never appear in `GET /v1/hosts`.
+    { key: "pollSeconds", min: 5, max: 86400 },
+    // A build's item key expires 24 hours after its lease was created, and
+    // the time limit is counted from job start, after the claim and the
+    // provision hook. The runner still syncs and releases once the limit
+    // fires, so the ceiling leaves two hours of the key's life for the
+    // provision hook, the final sync and the release.
+    { key: "timeLimitMinutes", min: 1, max: 1320 },
+    { key: "idleLimitMinutes", min: 1 }
+  ];
+}
+function nearestKey(unknown, accepted) {
+  const lower = unknown.toLowerCase();
+  let best;
+  for (const key of accepted) {
+    const distance = editDistance(lower, key.toLowerCase());
+    if (distance <= Math.max(1, Math.floor(key.length / 4)) && (!best || distance < best.distance)) {
+      best = { key, distance };
+    }
+  }
+  return best?.key;
+}
+function editDistance(a, b) {
+  const rows = Array.from({ length: a.length + 1 }, (_unused, i) => [i, ...Array(b.length).fill(0)]);
+  for (let j = 0; j <= b.length; j++) rows[0][j] = j;
+  for (let i = 1; i <= a.length; i++) {
+    for (let j = 1; j <= b.length; j++) {
+      rows[i][j] = Math.min(
+        rows[i - 1][j] + 1,
+        rows[i][j - 1] + 1,
+        rows[i - 1][j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1)
+      );
+    }
+  }
+  return rows[a.length][b.length];
+}
+function checkHooks(config, env = process.env) {
+  const named = [
+    ["runner.hooks.provision", config.hooks.provision],
+    ["runner.hooks.cleanup", config.hooks.cleanup],
+    ["runner.hooks.report", config.hooks.report]
+  ];
+  for (const [key, path] of named) {
+    if (path === void 0) continue;
+    if (isBuiltinContainer(path) || isBuiltinProcess(path) || isBuiltinVm(path)) continue;
+    if (path.includes("$") || path.startsWith("~")) {
+      return `${key}: ${path} \u2014 hooks are executable paths, not shell lines; $HOME and ~ are not expanded`;
+    }
+    if (!existsSync(path)) return `${key}: ${path} does not exist`;
+    if (!statSync(path).isFile()) return `${key}: ${path} is not a file`;
+    try {
+      accessSync(path, constants.X_OK);
+    } catch {
+      return `${key}: ${path} is not executable`;
+    }
+  }
+  return checkDestinationVariables(config, env);
+}
+function checkDestinationVariables(config, env) {
+  const destinations = config.build?.destinations ?? [];
+  for (const [index, destination] of destinations.entries()) {
+    for (const name of destination.header.variables) {
+      if (env[name] === void 0 || env[name] === "") {
+        return `runner.build.destinations[${index}].header: ${name} is not set in the runner's environment`;
+      }
+    }
+  }
+  return void 0;
+}
+function loadRunnerConfig(configPath) {
+  const config = readConfigFile(configPath);
+  if (!config.url || !config.apiKey || !config.appId) {
+    fail(configPath, "url/apiKey/appId", "missing \u2014 pipe a factory key into `outerlayer login` for this config file first; a runner uses a factory key, never a person's login");
+  }
+  const runner = config.runner;
+  if (!runner) {
+    fail(configPath, "runner", "block is missing");
+  }
+  for (const key of Object.keys(runner)) {
+    if (RUNNER_KEYS.includes(key)) continue;
+    const near = nearestKey(key, RUNNER_KEYS);
+    fail(configPath, `runner.${key}`, near ? `is not a key this block accepts; did you mean ${near}?` : "is not a key this block accepts");
+  }
+  for (const { key, min, max = Number.POSITIVE_INFINITY } of runnerNumbers()) {
+    const value = runner[key];
+    if (value === void 0) continue;
+    if (typeof value !== "number" || !Number.isInteger(value) || value < min) {
+      fail(configPath, `runner.${key}`, `must be a whole number of at least ${min}`);
+    }
+    if (value > max) {
+      fail(configPath, `runner.${key}`, `must be at most ${max}`);
+    }
+  }
+  if (runner.autoUpdate !== void 0 && typeof runner.autoUpdate !== "boolean") {
+    fail(configPath, "runner.autoUpdate", "must be true or false");
+  }
+  const queues = runner.queues && runner.queues.length > 0 ? runner.queues : [...RUNNER_QUEUES];
+  for (const queue of queues) {
+    if (!RUNNER_QUEUES.includes(queue)) {
+      fail(configPath, "runner.queues", `names an unknown queue "${queue}" \u2014 must be implement or amend`);
+    }
+    if (!runner.commands?.[queue]) {
+      fail(configPath, `runner.commands.${queue}`, "is required for an enabled queue");
+    }
+  }
+  if (!runner.hooks?.provision) fail(configPath, "runner.hooks.provision", "is required");
+  if (!runner.hooks?.cleanup) fail(configPath, "runner.hooks.cleanup", "is required");
+  checkBuiltinHooks(configPath, runner.hooks);
+  const build = resolveBuild(configPath, runner.build);
+  if (config.scrub?.literals !== void 0 && !Array.isArray(config.scrub.literals)) {
+    fail(configPath, "scrub.literals", "must be a list of strings");
+  }
+  if (config.scrub?.patterns !== void 0 && !Array.isArray(config.scrub.patterns)) {
+    fail(configPath, "scrub.patterns", "must be a list of {label, pattern} entries");
+  }
+  return {
+    configPath,
+    url: config.url,
+    apiKey: config.apiKey,
+    appId: config.appId,
+    repos: config.repos,
+    scrub: config.scrub,
+    host: runner.host ?? hostname(),
+    queues,
+    concurrency: runner.concurrency ?? DEFAULT_CONCURRENCY,
+    pollSeconds: runner.pollSeconds ?? DEFAULT_POLL_SECONDS,
+    timeLimitMinutes: runner.timeLimitMinutes ?? DEFAULT_TIME_LIMIT_MINUTES,
+    idleLimitMinutes: runner.idleLimitMinutes ?? DEFAULT_IDLE_LIMIT_MINUTES,
+    commands: runner.commands ?? {},
+    hooks: {
+      provision: runner.hooks.provision,
+      cleanup: runner.hooks.cleanup,
+      report: runner.hooks.report
+    },
+    build,
+    // A host with executables of its own for provision and cleanup chose
+    // its own environment, and an update could change what its hooks run
+    // under; it opts in. The built-in hooks are the runner's own. Provision
+    // and cleanup are built-in together or not at all (checkBuiltinHooks), so
+    // provision alone tells which.
+    autoUpdate: runner.autoUpdate ?? builtinKind(runner.hooks.provision) !== "own"
+  };
+}
+function checkBuiltinHooks(configPath, hooks) {
+  for (const key of ["provision", "cleanup", "report"]) {
+    const value = hooks[key];
+    if (value === void 0 || !value.startsWith("builtin:")) continue;
+    if (key === "report") fail(configPath, "runner.hooks.report", `cannot be ${value}: the report hook stays an executable`);
+    if (!isBuiltinContainer(value) && !isBuiltinProcess(value) && !isBuiltinVm(value)) {
+      fail(configPath, `runner.hooks.${key}`, `names an unknown built-in hook "${value}"; the ones that exist are ${BUILTIN_CONTAINER}, ${BUILTIN_PROCESS} and ${BUILTIN_VM}`);
+    }
+  }
+  const provision = hooks.provision;
+  const cleanup = hooks.cleanup;
+  if (isBuiltinContainer(provision) !== isBuiltinContainer(cleanup) || isBuiltinProcess(provision) !== isBuiltinProcess(cleanup) || isBuiltinVm(provision) !== isBuiltinVm(cleanup)) {
+    fail(configPath, "runner.hooks", `provision and cleanup must both be ${BUILTIN_CONTAINER}, both be ${BUILTIN_PROCESS}, both be ${BUILTIN_VM}, or neither`);
+  }
+}
+function resolveBuild(configPath, block) {
+  if (block === void 0) return { ...DEFAULT_BUILD, variables: [] };
+  if (typeof block !== "object" || block === null || Array.isArray(block)) fail(configPath, "runner.build", "must be an object");
+  const given = block;
+  for (const key of Object.keys(given)) {
+    if (BUILD_KEYS.includes(key)) continue;
+    const near = nearestKey(key, BUILD_KEYS);
+    fail(configPath, `runner.build.${key}`, near ? `is not a key this block accepts; did you mean ${near}?` : "is not a key this block accepts");
+  }
+  for (const key of ["memory", "disk"]) {
+    const value = given[key];
+    if (value === void 0) continue;
+    if (typeof value !== "string" || parseSize(value) === void 0) fail(configPath, `runner.build.${key}`, 'must be a size such as "8g" or "512m"');
+  }
+  if (given.cpus !== void 0 && (typeof given.cpus !== "number" || !Number.isFinite(given.cpus) || given.cpus <= 0)) {
+    fail(configPath, "runner.build.cpus", "must be a number above 0");
+  }
+  if (given.pids !== void 0 && (typeof given.pids !== "number" || !Number.isInteger(given.pids) || given.pids < 1)) {
+    fail(configPath, "runner.build.pids", "must be a whole number of at least 1");
+  }
+  const variables = [];
+  if (given.variables !== void 0) {
+    if (!Array.isArray(given.variables)) fail(configPath, "runner.build.variables", "must be a list of variable names");
+    if (given.variables.length > MAX_VARIABLES) fail(configPath, "runner.build.variables", `names ${given.variables.length} variables; a release records at most ${MAX_VARIABLES}`);
+    for (const name of given.variables) {
+      if (typeof name !== "string" || !VARIABLE_NAME.test(name)) fail(configPath, "runner.build.variables", `names ${JSON.stringify(name)}, which is not a variable name`);
+      if (isRefusedInConfig(name)) fail(configPath, "runner.build.variables", `names ${name}, which the runner sets itself`);
+      if (!variables.includes(name)) variables.push(name);
+    }
+  }
+  const destinations = given.destinations === void 0 ? [] : resolveDestinations(given.destinations, variables, isReservedVariable, (key, reason) => fail(configPath, key, reason));
+  let allowHosts;
+  if (given.allowHosts !== void 0) {
+    if (!Array.isArray(given.allowHosts)) fail(configPath, "runner.build.allowHosts", "must be a list of host names");
+    if (given.allowHosts.length > MAX_ALLOW_HOSTS) fail(configPath, "runner.build.allowHosts", `names ${given.allowHosts.length} hosts; at most ${MAX_ALLOW_HOSTS}`);
+    allowHosts = [];
+    for (const entry of given.allowHosts) {
+      const problem = allowHostProblem(entry);
+      if (problem !== void 0) fail(configPath, "runner.build.allowHosts", `names ${JSON.stringify(entry)}, which ${problem}`);
+      const host = entry.toLowerCase();
+      if (!allowHosts.includes(host)) allowHosts.push(host);
+    }
+  }
+  return {
+    memory: given.memory ?? DEFAULT_BUILD.memory,
+    cpus: given.cpus ?? DEFAULT_BUILD.cpus,
+    pids: given.pids ?? DEFAULT_BUILD.pids,
+    disk: given.disk ?? DEFAULT_BUILD.disk,
+    variables,
+    ...destinations.length === 0 ? {} : { destinations },
+    ...allowHosts === void 0 ? {} : { allowHosts }
+  };
+}
+
+export { RunnerConfigError, builtinKind, checkHooks, defaultRunnerConfigPath, hasRunnerBlock, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, loadRunnerConfig, resolveBuild, runnerVmOf };

package/dist/chunk-774HEQL6.js

@@ -0,0 +1,178 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { RecipeError } from './chunk-QOZKPLVJ.js';
+import { spawn } from 'child_process';
+import { existsSync, mkdirSync, createWriteStream, readFileSync } from 'fs';
+import { join, dirname } from 'path';
+import { createRequire as createRequire$1 } from 'module';
+import { fileURLToPath } from 'url';
+
+createRequire(import.meta.url);
+var PACKAGE = "@devcontainers/cli";
+function buildRootFromDist(moduleDir = dirname(fileURLToPath(import.meta.url))) {
+  try {
+    const info = JSON.parse(readFileSync(join(moduleDir, "build-info.json"), "utf8"));
+    return typeof info.root === "string" ? info.root : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function resolveDevcontainerCli(opts = {}) {
+  const resolve = opts.resolve ?? createRequire$1(import.meta.url).resolve;
+  try {
+    const bin = join(dirname(resolve(`${PACKAGE}/package.json`)), "devcontainer.js");
+    if (existsSync(bin)) return { command: process.execPath, args: [bin] };
+  } catch {
+  }
+  const buildRoot = opts.buildRoot ?? buildRootFromDist();
+  const fallback = buildRoot === void 0 ? void 0 : join(buildRoot, "node_modules", PACKAGE);
+  if (fallback !== void 0 && existsSync(join(fallback, "devcontainer.js"))) {
+    return { command: process.execPath, args: [join(fallback, "devcontainer.js")] };
+  }
+  throw new RecipeError(
+    "devcontainer_cli_missing",
+    `the devcontainer CLI is not installed: looked beside this package and in ${fallback ?? "the checkout this build came from (unknown)"}. Run yarn install in that checkout.`
+  );
+}
+function devcontainerBuildInvocation(cli, req) {
+  return {
+    command: cli.command,
+    args: [
+      ...cli.args,
+      "build",
+      "--workspace-folder",
+      req.workspace,
+      "--config",
+      req.config,
+      "--image-name",
+      req.imageName,
+      ...Object.entries(req.labels).flatMap(([key, value]) => ["--label", `${key}=${value}`]),
+      "--log-format",
+      "text"
+    ]
+  };
+}
+
+// src/runner/image/docker.ts
+var CHILD_ENVIRONMENT_NAMES = [
+  "PATH",
+  "HOME",
+  "USER",
+  "LOGNAME",
+  "TMPDIR",
+  "LANG",
+  "LC_ALL",
+  "DOCKER_HOST",
+  "DOCKER_CONFIG",
+  "DOCKER_CONTEXT",
+  "DOCKER_CERT_PATH",
+  "DOCKER_TLS_VERIFY",
+  "DOCKER_API_VERSION",
+  "DOCKER_BUILDKIT",
+  "XDG_RUNTIME_DIR",
+  "XDG_CONFIG_HOME",
+  "XDG_DATA_HOME",
+  "XDG_CACHE_HOME",
+  "XDG_STATE_HOME"
+];
+function childEnvironment(base) {
+  const env = {};
+  for (const name of CHILD_ENVIRONMENT_NAMES) {
+    const value = base[name];
+    if (value !== void 0) env[name] = value;
+  }
+  return env;
+}
+var spawnRun = (command, args, opts = {}) => new Promise((resolve) => {
+  let log;
+  if (opts.logPath !== void 0) {
+    mkdirSync(dirname(opts.logPath), { recursive: true });
+    log = createWriteStream(opts.logPath, { flags: "a" });
+  }
+  let stdout = "";
+  let stderr = "";
+  let settled = false;
+  const finish = (status, extra = "") => {
+    if (settled) return;
+    settled = true;
+    const result = { status, stdout, stderr: stderr + extra };
+    if (log === void 0) {
+      resolve(result);
+      return;
+    }
+    if (extra) log.write(extra);
+    log.end(() => resolve(result));
+  };
+  const child = spawn(command, args, {
+    env: { ...childEnvironment(process.env), ...opts.env },
+    stdio: [opts.input === void 0 ? "ignore" : "pipe", "pipe", "pipe"]
+  });
+  child.stdout.on("data", (chunk) => {
+    stdout += chunk.toString();
+    log?.write(chunk);
+  });
+  child.stderr.on("data", (chunk) => {
+    stderr += chunk.toString();
+    log?.write(chunk);
+  });
+  child.on("error", (err) => finish(127, `${command}: ${err.message}
+`));
+  child.on("close", (code, signal) => finish(code ?? (signal ? 128 : 1)));
+  if (opts.input !== void 0) {
+    child.stdin.on("error", () => void 0);
+    child.stdin.end(opts.input);
+  }
+});
+function toInfo(row) {
+  return { id: row.Id, createdAt: row.Created, labels: row.Config?.Labels ?? {} };
+}
+var lines = (text) => [...new Set(text.split("\n").map((l) => l.trim()).filter(Boolean))];
+function createDockerHost(deps = {}) {
+  const run = deps.run ?? spawnRun;
+  const cli = deps.cli ?? resolveDevcontainerCli;
+  const inspectMany = async (refs) => {
+    const result = await run("docker", ["image", "inspect", ...refs]);
+    return result.status === 0 ? JSON.parse(result.stdout).map(toInfo) : [];
+  };
+  return {
+    async inspect(ref) {
+      return (await inspectMany([ref]))[0] ?? null;
+    },
+    async list(repository) {
+      const ids = await run("docker", [
+        "image",
+        "ls",
+        "--all",
+        "--no-trunc",
+        "--quiet",
+        "--filter",
+        `label=ai.outerlayer.repository=${repository}`
+      ]);
+      const found = lines(ids.stdout);
+      return found.length === 0 ? [] : inspectMany(found);
+    },
+    async inUse() {
+      const containers = lines((await run("docker", ["ps", "--all", "--no-trunc", "--quiet"])).stdout);
+      if (containers.length === 0) return [];
+      return lines((await run("docker", ["inspect", "--format", "{{.Image}}", ...containers])).stdout);
+    },
+    async buildDockerfile(req) {
+      const labels = Object.entries(req.labels).flatMap(([key, value]) => ["--label", `${key}=${value}`]);
+      const result = await run("docker", ["build", "--tag", req.tag, ...labels, "--file", "-", req.context], {
+        logPath: req.logPath,
+        input: req.dockerfile
+      });
+      return result.status;
+    },
+    async devcontainerBuild(req) {
+      const { command, args } = devcontainerBuildInvocation(cli(), req);
+      return (await run(command, args, { logPath: req.logPath })).status;
+    },
+    async remove(id) {
+      const result = await run("docker", ["rmi", id]);
+      if (result.status !== 0) throw new Error(result.stderr.trim() || `docker rmi ${id} exited ${result.status}`);
+    }
+  };
+}
+
+export { childEnvironment, createDockerHost, resolveDevcontainerCli, spawnRun };

package/dist/{work-pr-cmd-AZQPWH4H.js → chunk-7WERLFVR.js}

@@ -1,18 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectActiveSession } from './chunk-U32VSRLO.js';
-import { resolveRepoIdentity } from './chunk-4TNZMO7V.js';
-import './chunk-YRYMNBGQ.js';
-import './chunk-65WXAANR.js';
+import { detectActiveSession } from './chunk-BFESLKPP.js';
+import { resolveRepoIdentity } from './chunk-4C4THABW.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
-import './chunk-ZJSNLVCE.js';
-import './chunk-NXLLURA4.js';
-import './chunk-I3ETLSNE.js';
-import './chunk-YOOSBOKS.js';
-import './chunk-R5KBGVII.js';
-import { readCloudConfig } from './chunk-TFUIDMOB.js';
+import { defaultFetch } from './chunk-BCLJSQCV.js';
+import { unauthorizedMessage, resolveGatewayCredentials } from './chunk-BOLTI6LR.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);
 
@@ -23,19 +16,9 @@ var RESET = "\x1B[0m";
 var WorkPrCommandError = class extends Error {
 };
 function resolveCredentials(opts) {
-  const home = opts.home ?? homeFromEnv();
-  const env = opts.env ?? process.env;
-  const fileConfig = readCloudConfig(home);
-  const url = opts.url ?? env.OUTERLAYER_URL ?? fileConfig.url;
-  const apiKey = opts.apiKey ?? env.OUTERLAYER_API_KEY ?? fileConfig.apiKey;
-  const appId = opts.appId ?? env.OUTERLAYER_APP_ID ?? fileConfig.appId;
-  if (!url || !apiKey || !appId) {
-    const missing = [!url && "--url", !apiKey && "--api-key", !appId && "--app-id"].filter(Boolean).join(", ");
-    throw new WorkPrCommandError(
-      `missing ${missing}. Run \`outerlayer login --url <your gateway>\` and paste the key at the prompt, or set OUTERLAYER_URL / OUTERLAYER_API_KEY / OUTERLAYER_APP_ID. Mint a key in the dashboard: Settings \u2192 API keys.`
-    );
-  }
-  return { url, apiKey, appId };
+  const resolved = resolveGatewayCredentials(opts);
+  if (!resolved.ok) throw new WorkPrCommandError(resolved.message);
+  return { url: resolved.url, apiKey: resolved.credential, appId: resolved.appId };
 }
 function resolveRepository(repoFlag, cwd) {
   if (repoFlag) return repoFlag;
@@ -69,7 +52,7 @@ async function runWorkPr(opts) {
       "no active session detected. `work pr` declares a pull request from inside the session that opened it."
     );
   }
-  const fetchImpl = opts.fetchImpl ?? fetch;
+  const fetchImpl = opts.fetchImpl ?? defaultFetch;
   const endpoint = new URL("/v1/work-items/pull-requests", creds.url).toString();
   let response;
   try {
@@ -87,7 +70,7 @@ async function runWorkPr(opts) {
   }
   if (response.status === 401) {
     throw new WorkPrCommandError(
-      "not authorized \u2014 the API key is unknown, expired, or bound to a different app. Mint a fresh key: dashboard \u2192 Settings \u2192 API keys."
+      unauthorizedMessage(creds.apiKey)
     );
   }
   let json;