@outerlayer/cli 0.2.0 → 0.4.1

package/dist/chunk-BCJNHMZT.js

@@ -0,0 +1,34 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { readLaunchSpoolState, launchesPath } from './chunk-DVDEBNQJ.js';
+
+createRequire(import.meta.url);
+
+// src/launch-filter.ts
+function launchRefusalForSession(sessionId, home) {
+  const spool = readLaunchSpoolState(home);
+  if (spool.ids.has(sessionId)) return void 0;
+  if (spool.unreadable !== void 0) {
+    return `the launch spool at ${launchesPath(home)} could not be read (${spool.unreadable}), so this session's launch could not be checked and nothing it produces may leave the machine. Fix the file's permissions and re-run.`;
+  }
+  if (spool.malformedLines !== void 0) {
+    return `the launch spool at ${launchesPath(home)} has ${spool.malformedLines} damaged line(s), so this session's launch could not be checked and nothing it produces may leave the machine.`;
+  }
+  return `this session was not launched with OUTERLAYER_WORK naming a work item, so nothing it produces may leave the machine. Start the session with OUTERLAYER_WORK set (for example OUTERLAYER_WORK=42), or run this from CI.`;
+}
+var LaunchFilter = class {
+  constructor(launchedSessionIds) {
+    this.launchedSessionIds = launchedSessionIds;
+    /** Sessions dropped for carrying no launch record — for the sync summary. */
+    this.skippedTotal = 0;
+  }
+  /** True when the session should sync. Records skips for reporting. */
+  allows(session) {
+    const key = session.subagent?.parentSessionId ?? session.id;
+    const allowed = typeof key === "string" && this.launchedSessionIds.has(key);
+    if (!allowed) this.skippedTotal += 1;
+    return allowed;
+  }
+};
+
+export { LaunchFilter, launchRefusalForSession };

package/dist/chunk-BCLJSQCV.js

@@ -0,0 +1,56 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { readCloudConfig, cloudConfigPath } from './chunk-EABW6AJQ.js';
+import { signRunnerRequest, signerFor } from './chunk-M5POMKKW.js';
+import { homeFromEnv } from './chunk-VNVZDWO3.js';
+
+createRequire(import.meta.url);
+
+// src/signing-fetch.ts
+function bodyBytes(body) {
+  if (body === void 0 || body === null) return new Uint8Array(0);
+  if (typeof body === "string") return new TextEncoder().encode(body);
+  if (body instanceof Uint8Array) return body;
+  if (body instanceof ArrayBuffer) return new Uint8Array(body);
+  return void 0;
+}
+async function savedKeySigner(headers, home) {
+  const authorization = headers.get("authorization");
+  if (authorization === null || !authorization.startsWith("Bearer ")) return void 0;
+  if (headers.has("signature")) return void 0;
+  if (readCloudConfig(home).apiKey !== authorization.slice("Bearer ".length)) return void 0;
+  try {
+    return await signerFor(cloudConfigPath(home));
+  } catch {
+    return void 0;
+  }
+}
+function signedBy(base, signerOf) {
+  return (async (input, init) => {
+    if (input instanceof Request) return base(input, init);
+    const headers = new Headers(init?.headers);
+    const signer = await signerOf(headers);
+    const body = bodyBytes(init?.body);
+    if (signer === void 0 || body === void 0) return base(input, init);
+    const signature = await signRunnerRequest({ method: init?.method ?? "GET", url: input.toString(), body, signer });
+    for (const [name, value] of Object.entries(signature)) headers.set(name, value);
+    return base(input, { ...init, headers });
+  });
+}
+function signingFetch(base, home = () => homeFromEnv()) {
+  return signedBy(base, (headers) => savedKeySigner(headers, home()));
+}
+function signingFetchFor(base, configPath, apiKey) {
+  return signedBy(base, async (headers) => {
+    const authorization = headers.get("authorization");
+    if (authorization !== `Bearer ${apiKey}` || headers.has("signature")) return void 0;
+    try {
+      return await signerFor(configPath);
+    } catch {
+      return void 0;
+    }
+  });
+}
+var defaultFetch = signingFetch((input, init) => globalThis.fetch(input, init));
+
+export { defaultFetch, signingFetchFor };

package/dist/chunk-BFESLKPP.js

@@ -0,0 +1,61 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { openSync, fstatSync, readSync, closeSync } from 'fs';
+import { join } from 'path';
+
+createRequire(import.meta.url);
+var SESSION_DETECT_TAIL_BYTES = 64 * 1024;
+var SESSION_DETECT_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
+var readTail = (path, maxBytes) => {
+  try {
+    const fd = openSync(path, "r");
+    try {
+      const size = fstatSync(fd).size;
+      const length = Math.min(size, maxBytes);
+      const data = Buffer.alloc(length);
+      readSync(fd, data, 0, length, size - length);
+      return { data, truncated: size > length };
+    } finally {
+      closeSync(fd);
+    }
+  } catch {
+    return void 0;
+  }
+};
+function detectActiveSession(opts) {
+  if (!opts.env.CLAUDECODE) return void 0;
+  const read = opts.readTailImpl ?? readTail;
+  const tail = read(join(opts.home, ".outerlayer", "spool", "events.jsonl"), SESSION_DETECT_TAIL_BYTES);
+  if (!tail || tail.data.length === 0) return void 0;
+  let lines = tail.data.toString("utf8").split("\n");
+  if (tail.truncated) lines = lines.slice(1);
+  const records = [];
+  for (const line of lines) {
+    const text = line.trim();
+    if (!text) continue;
+    try {
+      records.push(JSON.parse(text));
+    } catch {
+      continue;
+    }
+  }
+  const ended = /* @__PURE__ */ new Set();
+  for (const record of records) {
+    if (record.event === "SessionEnd" && typeof record.sessionId === "string" && record.sessionId !== "") {
+      ended.add(record.sessionId);
+    }
+  }
+  let newest;
+  for (const record of records) {
+    if (typeof record.sessionId !== "string" || record.sessionId === "") continue;
+    if (record.event === "SessionEnd" || ended.has(record.sessionId)) continue;
+    if (typeof record.cwd !== "string" || !opts.cwds.includes(record.cwd)) continue;
+    if (typeof record.t !== "string") continue;
+    const tMs = Date.parse(record.t);
+    if (!Number.isFinite(tMs) || opts.nowMs - tMs > SESSION_DETECT_MAX_AGE_MS) continue;
+    newest = record.sessionId;
+  }
+  return newest;
+}
+
+export { detectActiveSession };

package/dist/chunk-BJ3KTMDH.js

@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { statSync, readFileSync, existsSync, mkdirSync, writeFileSync, chmodSync } from 'fs';
+import { join, isAbsolute, dirname } from 'path';
+
+createRequire(import.meta.url);
+function findGitDirs(cwd) {
+  let dir = cwd;
+  for (; ; ) {
+    const gitPath = join(dir, ".git");
+    let stat;
+    try {
+      stat = statSync(gitPath);
+    } catch {
+      stat = void 0;
+    }
+    if (stat?.isDirectory()) return { repoRoot: dir, gitCommonDir: gitPath };
+    if (stat?.isFile()) {
+      try {
+        const content = readFileSync(gitPath, "utf8").trim();
+        const match = /^gitdir:\s*(.+)$/.exec(content);
+        if (match) {
+          const gitdir = isAbsolute(match[1]) ? match[1] : join(dir, match[1]);
+          try {
+            const commondir = readFileSync(join(gitdir, "commondir"), "utf8").trim();
+            return { repoRoot: dir, gitCommonDir: isAbsolute(commondir) ? commondir : join(gitdir, commondir) };
+          } catch {
+            return { repoRoot: dir, gitCommonDir: gitdir };
+          }
+        }
+      } catch {
+      }
+    }
+    const parent = dirname(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+}
+function connectionPath(gitCommonDir) {
+  return join(gitCommonDir, "outerlayer", "connection.json");
+}
+function readRepoConnection(cwd) {
+  try {
+    const dirs = findGitDirs(cwd);
+    if (dirs === void 0) return void 0;
+    const parsed = JSON.parse(readFileSync(connectionPath(dirs.gitCommonDir), "utf8"));
+    if (typeof parsed?.appId !== "string" || parsed.appId === "") return void 0;
+    return parsed;
+  } catch {
+    return void 0;
+  }
+}
+function writeRepoConnection(gitCommonDir, connection) {
+  const path = connectionPath(gitCommonDir);
+  if (!existsSync(dirname(path))) mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, JSON.stringify(connection, null, 2) + "\n", { mode: 384 });
+  try {
+    chmodSync(path, 384);
+  } catch {
+  }
+}
+
+export { findGitDirs, readRepoConnection, writeRepoConnection };

package/dist/chunk-BKO6JEZI.js

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { mkdirSync, writeFileSync, renameSync, unlinkSync, readFileSync } from 'fs';
+import { join } from 'path';
+
+createRequire(import.meta.url);
+var SAFE_SESSION_ID = /^[A-Za-z0-9_-]+$/;
+function reportedCostDir(home) {
+  return join(home, ".outerlayer", "reported-cost");
+}
+function reportedCostPath(home, sessionId) {
+  return join(reportedCostDir(home), `${sessionId}.json`);
+}
+function recordReportedCost(home, sessionId, costUsd) {
+  if (typeof sessionId !== "string" || !SAFE_SESSION_ID.test(sessionId)) return;
+  if (!Number.isFinite(costUsd) || costUsd < 0) return;
+  if (readReportedCost(home, sessionId) === costUsd) return;
+  const target = reportedCostPath(home, sessionId);
+  const tmp = `${target}.${process.pid}.tmp`;
+  try {
+    mkdirSync(reportedCostDir(home), { recursive: true });
+    writeFileSync(tmp, JSON.stringify({ costUsd, recordedAt: (/* @__PURE__ */ new Date()).toISOString() }));
+    renameSync(tmp, target);
+  } catch {
+    try {
+      unlinkSync(tmp);
+    } catch {
+    }
+  }
+}
+function readReportedCost(home, sessionId) {
+  if (!SAFE_SESSION_ID.test(sessionId)) return null;
+  try {
+    const parsed = JSON.parse(readFileSync(reportedCostPath(home, sessionId), "utf8"));
+    return Number.isFinite(parsed.costUsd) && parsed.costUsd >= 0 ? parsed.costUsd : null;
+  } catch {
+    return null;
+  }
+}
+function applyReportedCost(session, home) {
+  if (session.agent.type !== "claude-code" || session.subagent?.parentSessionId) return;
+  const costUsd = readReportedCost(home, session.id);
+  if (costUsd === null) return;
+  session.totals.agentReportedCostUsd = costUsd;
+}
+
+export { applyReportedCost, recordReportedCost };

package/dist/chunk-BOLTI6LR.js

@@ -0,0 +1,37 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { readCloudConfig } from './chunk-EABW6AJQ.js';
+import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
+import { homeFromEnv } from './chunk-VNVZDWO3.js';
+
+createRequire(import.meta.url);
+
+// src/credentials.ts
+var MISSING_HELP = "Run `outerlayer login` to sign in, or set OUTERLAYER_URL / OUTERLAYER_API_KEY / OUTERLAYER_APP_ID. Mint a key in the dashboard: Settings \u2192 API keys.";
+var NO_FACTORY_MESSAGE = "you are logged in, but no factory is chosen for this repository. Run `outerlayer connect` to choose one, or pass --app-id / set OUTERLAYER_APP_ID.";
+var NO_FACTORY_OUTSIDE_REPOSITORY_MESSAGE = "you are logged in, but this directory is not in a git repository, so no factory is chosen. Pass --app-id / set OUTERLAYER_APP_ID, or run this from inside a connected repository.";
+var LOGIN_TOKEN_PREFIX = "olu_";
+function unauthorizedMessage(credential) {
+  return credential.startsWith(LOGIN_TOKEN_PREFIX) ? "not authorized \u2014 the login is expired or was revoked. Run `outerlayer login` to sign in again." : "not authorized \u2014 the API key is unknown, expired, or bound to a different factory. Mint a fresh key: dashboard \u2192 Settings \u2192 API keys.";
+}
+function resolveGatewayCredentials(sources = {}) {
+  const env = sources.env ?? process.env;
+  const config = readCloudConfig(sources.home ?? homeFromEnv(env));
+  const url = sources.url ?? env.OUTERLAYER_URL ?? config.url;
+  const key = sources.apiKey ?? (env.OUTERLAYER_API_KEY || void 0) ?? config.apiKey;
+  const kind = key ? "key" : "login";
+  const credential = key ?? config.accountToken;
+  const cwd = sources.cwd ?? process.cwd();
+  const appId = sources.appId ?? (env.OUTERLAYER_APP_ID || void 0) ?? (kind === "key" ? config.appId : readRepoConnection(cwd)?.appId);
+  if (credential && url && !appId && kind === "login") {
+    const message = findGitDirs(cwd) === void 0 ? NO_FACTORY_OUTSIDE_REPOSITORY_MESSAGE : NO_FACTORY_MESSAGE;
+    return { ok: false, message, url, credential, appId, kind };
+  }
+  if (!url || !credential || !appId) {
+    const missing = [!url && "--url", !credential && "--api-key", !appId && "--app-id"].filter(Boolean).join(", ");
+    return { ok: false, message: `missing ${missing}. ${MISSING_HELP}`, url, credential, appId, kind };
+  }
+  return { ok: true, url, credential, appId, kind };
+}
+
+export { resolveGatewayCredentials, unauthorizedMessage };

package/dist/chunk-CBPPJSAR.js

@@ -0,0 +1,89 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { EXEC_PORT } from './chunk-B2G7JHHB.js';
+import { RELAY_PORT } from './chunk-AUFG23AA.js';
+import { spawn, spawnSync } from 'child_process';
+import { writeFileSync, chmodSync, mkdirSync } from 'fs';
+
+createRequire(import.meta.url);
+var HELPER_PATH = "/opt/outerlayer/bin/outerlayer-guest";
+var KERNEL_FLAG = "outerlayer.relay";
+var DOCKER_FLAG = "outerlayer.docker";
+var DOCKERD_CONFIG = "/run/outerlayer-dockerd.json";
+var DOCKERD_LOG = "/run/dockerd.log";
+var DOCKER_DATA_ROOT = "/build/docker";
+var BUILD_DISK = "/dev/vdb";
+var HOSTNAME = "outerlayer-build";
+var HOSTS = "127.0.0.1 localhost\n::1 localhost ip6-localhost ip6-loopback\n";
+var RESOLV_CONF = "# This microVM has no network device. Names are resolved by the runner's proxy.\n";
+var BUILD_DIRECTORIES = ["/build/tmp", "/build/home", "/build/work"];
+var WORLD_WRITABLE = 1023;
+function relayPortsFrom(cmdline) {
+  const value = new RegExp(`(?:^|\\s)${KERNEL_FLAG.replace(".", "\\.")}=(\\S*)`).exec(cmdline)?.[1];
+  if (value === void 0 || value === "") return [];
+  return value.split(",").map((text) => {
+    const port = Number(text);
+    if (!/^\d+$/.test(text) || port < 1 || port > 65535) throw new Error(`${KERNEL_FLAG} on the kernel command line names ${JSON.stringify(text)}, which is not a port`);
+    return port;
+  });
+}
+function dockerRequestedBy(cmdline) {
+  return new RegExp(`(?:^|\\s)${DOCKER_FLAG.replace(".", "\\.")}=1(?:\\s|$)`).test(cmdline);
+}
+function startDocker(host) {
+  const proxy = `http://127.0.0.1:${RELAY_PORT}`;
+  host.mount({ source: "cgroup2", target: "/sys/fs/cgroup", type: "cgroup2" });
+  host.mkdir(DOCKER_DATA_ROOT, 457);
+  host.writeFile(
+    DOCKERD_CONFIG,
+    `${JSON.stringify({ "data-root": DOCKER_DATA_ROOT, proxies: { "http-proxy": proxy, "https-proxy": proxy, "no-proxy": "localhost,127.0.0.1" } }, null, 2)}
+`
+  );
+  host.spawnDetached(["/bin/sh", "-c", `exec dockerd --config-file ${DOCKERD_CONFIG} >${DOCKERD_LOG} 2>&1`]);
+}
+function runGuestInit(host, cmdline) {
+  const ports = relayPortsFrom(cmdline);
+  host.mount({ source: BUILD_DISK, target: "/build", type: "ext4" });
+  host.chmod("/build", WORLD_WRITABLE);
+  for (const path of BUILD_DIRECTORIES) {
+    host.mkdir(path, WORLD_WRITABLE);
+    host.chmod(path, WORLD_WRITABLE);
+  }
+  host.mount({ source: "/build/tmp", target: "/tmp", bind: true });
+  const files = [
+    ["hosts", HOSTS],
+    ["hostname", `${HOSTNAME}
+`],
+    ["resolv.conf", RESOLV_CONF]
+  ];
+  for (const [name, text] of files) {
+    host.writeFile(`/run/${name}`, text);
+    host.mount({ source: `/run/${name}`, target: `/etc/${name}`, bind: true });
+  }
+  host.writeFile("/proc/sys/kernel/hostname", HOSTNAME);
+  host.mount({ source: "tmpfs", target: "/outerlayer/job", type: "tmpfs", options: "mode=0755" });
+  host.spawnDetached([HELPER_PATH, "relay", ...ports.flatMap((port) => ["--forward", String(port)])]);
+  if (dockerRequestedBy(cmdline)) startDocker(host);
+  host.spawnDetached([HELPER_PATH, "exec-agent", "--port", String(EXEC_PORT)]);
+}
+function realGuestHost() {
+  return {
+    mount(args) {
+      const argv = ["mount", "--target", args.target];
+      if (args.source !== void 0) argv.push("--source", args.source);
+      if (args.type !== void 0) argv.push("--type", args.type);
+      if (args.options !== void 0) argv.push("--options", args.options);
+      if (args.bind === true) argv.push("--bind");
+      const result = spawnSync(HELPER_PATH, argv, { encoding: "utf8" });
+      if (result.status !== 0) throw new Error(`mounting ${args.target} failed: ${result.stderr.trim()}`);
+    },
+    mkdir: (path, mode) => void mkdirSync(path, { recursive: true, mode }),
+    chmod: (path, mode) => chmodSync(path, mode),
+    writeFile: (path, text) => writeFileSync(path, text),
+    spawnDetached(argv) {
+      spawn(argv[0], argv.slice(1), { detached: true, stdio: ["ignore", "inherit", "inherit"] }).unref();
+    }
+  };
+}
+
+export { DOCKERD_LOG, HELPER_PATH, realGuestHost, relayPortsFrom, runGuestInit };