@outerlayer/cli 0.22.1 → 0.22.2

package/skill-pack/maintained/outerlayer-build/SKILL.md

@@ -89,7 +89,9 @@ Given a request instead of a work item, stop and say:
 Optional flag: `--unattended` means no person is present and nothing wakes
 the session after a turn ends. Spawn every agent in the foreground and wait
 for it in the same turn. Run the gate in the foreground with the maximum
-timeout. End the turn only at the final report.
+timeout. A command that outlives that timeout continues in the background:
+wait for it in the foreground before you use its result. End the turn only at
+the final report.
 
 ## State rules
 
@@ -305,7 +307,7 @@ Run them in order.
 
 5. **Pull request.** Run `outerlayer emit step "Pull request" --item "$OUTERLAYER_WORK"`,
    then apply the team's changes for this phase. Read [references/release.md](references/release.md)
-   on entry and run it. A release agent rebases, gates and pushes. Open the
+   on entry and run it. A release agent merges the base branch in, gates and pushes. Open the
    pull request as release.md says: a runner build with `outerlayer work open-pr`,
    which links it, and a local session with `gh pr create` and then
    `outerlayer work pr <number>`. When the build recorded criteria, from the issue or drafted, a fresh agent judges them with

package/skill-pack/maintained/outerlayer-build/references/agent-briefs.md

@@ -45,6 +45,13 @@ Run every long command, such as the full gate, the mutation tool or the
 integration suite, in the foreground with the maximum timeout. Never
 background one, and never end a turn waiting on a notification.
 
+A command that runs past the maximum timeout moves to the background and
+continues. It has not finished. Wait for it in the foreground before you use
+or report its result. For a command named `run-checks`, wait with
+`while pgrep -f '[r]un-checks' >/dev/null; do sleep 15; done`. Keep the
+brackets around the first letter of the name. Without them, `pgrep` on Linux
+finds the waiting shell, and the loop does not stop.
+
 Every agent in a run shares one memory cap. Run only the test files for the
 code you change or check, one at a time. Run a whole package's suite, a
 coverage run, a repository-wide typecheck or the full gate only where this
@@ -181,9 +188,9 @@ The shared rules apply. Your inputs are the state file path, the branch and
 the instructions-file pointer. You run no write command against the tracker
 or the git host beyond the push.
 
-Fetch the base branch, then rebase the branch onto it. Merge instead once the
-branch is pushed and someone else may hold it. Resolve every conflict on the
-branch, never in a web editor.
+Bring the base branch into the branch as
+`.outerlayer/skills/outerlayer-cli/references/merge-base-branch.md` says.
+Resolve every conflict on the branch, never in a web editor.
 
 A migration this branch adds whose version is at or below the newest one on
 the base branch is renamed to the current UTC time, with every reference to

package/skill-pack/maintained/outerlayer-build/references/release.md

@@ -9,10 +9,13 @@ file, not from the transcript.
 
 The orchestrator does not sync, run the gate, push or watch CI itself. Spawn
 one release agent in a fresh context on the "sync and push" brief, with the
-state file path, the branch and the instructions-file pointer. A check that
-fails there has the standing of a red gate and returns to the review phase's
-remaining budget. If its report names files the sync moved that the review had
-already cleared, run one check round on the rebased diff before going on.
+state file path, the branch and the instructions-file pointer. The agent
+brings the base branch in as
+`.outerlayer/skills/outerlayer-cli/references/merge-base-branch.md` says. A
+check that fails there has the standing of a red gate and returns to the
+review phase's remaining budget. If its report names files the sync moved that
+the review had already cleared, run one check round on the merged diff before
+going on.
 
 ## Open the pull request
 

package/skill-pack/maintained/outerlayer-build/references/review-briefs.md

@@ -259,9 +259,12 @@ shared tree while you run, so no mutation may touch it.
 
 1. Run the repository's changed-lines mutation tool once over the whole diff.
    Every survivor it reports is a finding. Never rerun it per file, never
-   lower its budget, and never run a whole suite or a coverage run. A run
-   that ends over budget is reported as over budget with the mutants it
-   scored. One rerun is allowed, and only when the tool reports no result
+   lower its budget, and never run a whole suite or a coverage run. The
+   tool can run longer than your shell's maximum timeout. Then your shell
+   moves it to the background. Wait for it to exit before you write your
+   report. Only the tool's own output can say that a run went over budget.
+   A run that ends over budget is reported as over budget with the mutants
+   it scored. One rerun is allowed, and only when the tool reports no result
    because a workspace dependency could not be resolved: build the
    dependencies, then run once more.
 2. Read the tool's report. For each criterion whose production lines were

package/skill-pack/maintained/outerlayer-cli/SKILL.md

@@ -38,7 +38,7 @@ from the output of `outerlayer work build`.
 4. `outerlayer emit artifact <file> --caption "<what it shows>"` attaches a
    screenshot, recording, report or log as evidence. The `outerlayer-evidence`
    skill says what to capture.
-5. `/outerlayer-amend` answers the review threads a person handed to an agent.
+5. `/outerlayer-amend` answers the review threads a person handed to an agent. It also resolves a merge conflict on a pull request a host built.
 
 ## Several repositories
 
@@ -76,6 +76,13 @@ ended, which session ran in it, and what the runner did around the agent. The
 steps, and what each outcome and reason means, are in
 [references/find-out-why-a-build-ended.md](references/find-out-why-a-build-ended.md).
 
+## Merging the base branch
+
+A build merges the base branch into its branch before the pull request opens.
+A run that resolves a merge conflict does the same on an open pull request.
+Both follow one procedure in
+[references/merge-base-branch.md](references/merge-base-branch.md).
+
 ## Reading work items
 
 When the OuterLayer MCP server is configured in this repository, its

package/skill-pack/maintained/outerlayer-cli/references/merge-base-branch.md

@@ -0,0 +1,54 @@
+# Merge the base branch into a branch
+
+Use this procedure when a branch must take in its base branch: a build's
+last sync before the pull request opens, and a run that resolves a merge
+conflict on a pull request already open. It is the one written procedure
+for both.
+
+Merge the base branch. Never rebase, and never force-push. A merge keeps the
+commits a reviewer already read and keeps review comments on their lines.
+
+1. Fetch the base branch. Use the pull request's base, which the item's
+   `outerlayer work status --item "$OUTERLAYER_WORK" --json` names in
+   `pullRequests[].conflict.baseBranch`, or the repository's default branch
+   when the pull request has no conflict record.
+
+       git fetch origin <base>
+
+2. Record the base commit you merge. Read it after the fetch.
+
+       git rev-parse origin/<base>
+
+3. Merge it into the checked-out branch, and stop before git commits.
+
+       git merge origin/<base> --no-commit --no-ff
+
+   If git reports `Already up to date`, the branch holds the base already.
+   Stop: there is nothing to push. If the merge has no conflict, go to step 5.
+
+4. Resolve each conflict so that the result keeps the intent of both sides.
+   List the conflicting files with `git diff --name-only --diff-filter=U`.
+   For each file, read the base commits that changed it
+   (`git log --oneline HEAD..origin/<base> -- <file>`) and the work item's
+   spec. Do not pick one side to make the conflict go away. Mark a file
+   resolved with `git add <file>` only when its code and its tests agree
+   with both sides.
+
+5. Run the repository's pre-push gate in the foreground, with the maximum
+   timeout. It names its own command in the repository's instructions file.
+   Wait for it to end. If the gate fails, fix the cause and run it again once.
+   A second failure is a hand-off, not a third try.
+
+6. Commit the merge. Name the base sha from step 2 in the message, so a reader
+   can find the exact base commit.
+
+       git commit -m "Merge <base> at <base sha> into <branch>"
+
+7. Push the branch. The hooks run, and you never bypass them. A push goes to
+   the pull request's own branch only.
+
+## When you cannot resolve it
+
+Abort the merge with `git merge --abort`. The branch returns to the state it
+had before step 3. Push nothing. Hand the item to a person in the way the
+calling skill says.

package/dist/chunk-NTRCK4NH.js

@@ -1,38 +0,0 @@
-#!/usr/bin/env node
-import { createRequire } from 'node:module';
-import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
-import { readCloudConfig } from './chunk-EABW6AJQ.js';
-import { cliInvocation } from './chunk-CRB3POP4.js';
-import { homeFromEnv } from './chunk-VNVZDWO3.js';
-
-createRequire(import.meta.url);
-
-// src/credentials.ts
-var MISSING_HELP = `Run \`${cliInvocation()} login\` to sign in, or set OUTERLAYER_URL / OUTERLAYER_API_KEY / OUTERLAYER_APP_ID. Mint a key in the dashboard: Settings \u2192 API keys.`;
-var NO_FACTORY_MESSAGE = `you are logged in, but no factory is chosen for this repository. Run \`${cliInvocation()} connect\` to choose one, or pass --app-id / set OUTERLAYER_APP_ID.`;
-var NO_FACTORY_OUTSIDE_REPOSITORY_MESSAGE = "you are logged in, but this directory is not in a git repository, so no factory is chosen. Pass --app-id / set OUTERLAYER_APP_ID, or run this from inside a connected repository.";
-var LOGIN_TOKEN_PREFIX = "olu_";
-function unauthorizedMessage(credential) {
-  return credential.startsWith(LOGIN_TOKEN_PREFIX) ? `not authorized \u2014 the login is expired or was revoked. Run \`${cliInvocation()} login\` to sign in again.` : "not authorized \u2014 the API key is unknown, expired, or bound to a different factory. Mint a fresh key: dashboard \u2192 Settings \u2192 API keys.";
-}
-function resolveGatewayCredentials(sources = {}) {
-  const env = sources.env ?? process.env;
-  const config = readCloudConfig(sources.home ?? homeFromEnv(env));
-  const url = sources.url ?? env.OUTERLAYER_URL ?? config.url;
-  const key = sources.apiKey ?? (env.OUTERLAYER_API_KEY || void 0) ?? config.apiKey;
-  const kind = key ? "key" : "login";
-  const credential = key ?? config.accountToken;
-  const cwd = sources.cwd ?? process.cwd();
-  const appId = sources.appId ?? (env.OUTERLAYER_APP_ID || void 0) ?? (kind === "key" ? config.appId : readRepoConnection(cwd)?.appId);
-  if (credential && url && !appId && kind === "login") {
-    const message = findGitDirs(cwd) === void 0 ? NO_FACTORY_OUTSIDE_REPOSITORY_MESSAGE : NO_FACTORY_MESSAGE;
-    return { ok: false, message, url, credential, appId, kind };
-  }
-  if (!url || !credential || !appId) {
-    const missing = [!url && "--url", !credential && "a login or OUTERLAYER_API_KEY", !appId && "--app-id"].filter(Boolean).join(", ");
-    return { ok: false, message: `missing ${missing}. ${MISSING_HELP}`, url, credential, appId, kind };
-  }
-  return { ok: true, url, credential, appId, kind };
-}
-
-export { resolveGatewayCredentials, unauthorizedMessage };

package/dist/chunk-QF7WZUU6.js

@@ -1,56 +0,0 @@
-#!/usr/bin/env node
-import { createRequire } from 'node:module';
-import { readCloudConfig, cloudConfigPath } from './chunk-EABW6AJQ.js';
-import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { signRunnerRequest, signerFor } from './chunk-OW52QLK3.js';
-
-createRequire(import.meta.url);
-
-// src/signing-fetch.ts
-function bodyBytes(body) {
-  if (body === void 0 || body === null) return new Uint8Array(0);
-  if (typeof body === "string") return new TextEncoder().encode(body);
-  if (body instanceof Uint8Array) return body;
-  if (body instanceof ArrayBuffer) return new Uint8Array(body);
-  return void 0;
-}
-async function savedKeySigner(headers, home) {
-  const authorization = headers.get("authorization");
-  if (authorization === null || !authorization.startsWith("Bearer ")) return void 0;
-  if (headers.has("signature")) return void 0;
-  if (readCloudConfig(home).apiKey !== authorization.slice("Bearer ".length)) return void 0;
-  try {
-    return await signerFor(cloudConfigPath(home));
-  } catch {
-    return void 0;
-  }
-}
-function signedBy(base, signerOf) {
-  return (async (input, init) => {
-    if (input instanceof Request) return base(input, init);
-    const headers = new Headers(init?.headers);
-    const signer = await signerOf(headers);
-    const body = bodyBytes(init?.body);
-    if (signer === void 0 || body === void 0) return base(input, init);
-    const signature = await signRunnerRequest({ method: init?.method ?? "GET", url: input.toString(), body, signer });
-    for (const [name, value] of Object.entries(signature)) headers.set(name, value);
-    return base(input, { ...init, headers });
-  });
-}
-function signingFetch(base, home = () => homeFromEnv()) {
-  return signedBy(base, (headers) => savedKeySigner(headers, home()));
-}
-function signingFetchFor(base, configPath, apiKey) {
-  return signedBy(base, async (headers) => {
-    const authorization = headers.get("authorization");
-    if (authorization !== `Bearer ${apiKey}` || headers.has("signature")) return void 0;
-    try {
-      return await signerFor(configPath);
-    } catch {
-      return void 0;
-    }
-  });
-}
-var defaultFetch = signingFetch((input, init) => globalThis.fetch(input, init));
-
-export { defaultFetch, signingFetchFor };