@outerlayer/cli 0.22.1 → 0.23.0

package/dist/{chunk-5OCIHFGE.js → chunk-HBISTTG3.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { splitRawFile } from './chunk-WFSUUUAN.js';
+import { splitRawFile } from './chunk-RKOTJQVG.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, readdirSync } from 'fs';
 import { join, dirname } from 'path';
@@ -12,17 +12,26 @@ var MAINTAINED_SKILLS = ["outerlayer-evidence", "outerlayer-amend", "outerlayer-
 function templateClassLine(version) {
   return `<!-- yours to edit. Copied once from the default template by outerlayer init ${version}; never overwritten. -->`;
 }
-function maintainedClassLine(version) {
-  return `<!-- maintained by OuterLayer ${version}. Edits are overwritten on the next outerlayer context emit. -->`;
+function maintainedClassLine(version, base) {
+  const command = base === AGENTS_SKILLS_BASE ? "outerlayer init --update" : "outerlayer context emit";
+  return `<!-- maintained by OuterLayer ${version}. Edits are overwritten on the next ${command}. -->`;
+}
+var OUTERLAYER_SKILLS_BASE = ".outerlayer/skills";
+var AGENTS_SKILLS_BASE = ".agents/skills";
+function rewriteSkillPaths(content, base) {
+  return base === OUTERLAYER_SKILLS_BASE ? content : content.split(`${OUTERLAYER_SKILLS_BASE}/`).join(`${base}/`);
+}
+function restoreSkillPaths(content, base) {
+  return base === OUTERLAYER_SKILLS_BASE ? content : content.split(`${base}/`).join(`${OUTERLAYER_SKILLS_BASE}/`);
 }
 function resolvePackRoot(entryPath = fileURLToPath(import.meta.url)) {
   return join(dirname(dirname(entryPath)), "skill-pack");
 }
-function skillDir(skill) {
-  return `.outerlayer/skills/${skill}`;
+function skillDir(skill, base = OUTERLAYER_SKILLS_BASE) {
+  return `${base}/${skill}`;
 }
-function renderSkillFile(skillClass, content, version) {
-  const line = skillClass === "maintained" ? maintainedClassLine(version) : templateClassLine(version);
+function renderSkillFile(skillClass, content, version, base) {
+  const line = skillClass === "maintained" ? maintainedClassLine(version, base) : templateClassLine(version);
   const { frontmatterInner, body } = splitRawFile(content);
   if (frontmatterInner === null) return `${line}
 ${content}`;
@@ -42,7 +51,7 @@ function filesUnder(dir, base = dir) {
 function orderSkillFiles(relPaths) {
   return [...relPaths.filter((p) => p === "SKILL.md"), ...relPaths.filter((p) => p !== "SKILL.md")];
 }
-function loadClass(packRoot, skillClass, names, version) {
+function loadClass(packRoot, skillClass, names, version, base) {
   const files = [];
   for (const skill of names) {
     const dir = join(packRoot, skillClass, skill);
@@ -52,18 +61,18 @@ function loadClass(packRoot, skillClass, names, version) {
       files.push({
         skill,
         skillClass,
-        path: `${skillDir(skill)}/${rel}`,
-        content: rel === "SKILL.md" ? renderSkillFile(skillClass, raw, version) : raw
+        path: `${skillDir(skill, base)}/${rel}`,
+        content: rewriteSkillPaths(rel === "SKILL.md" ? renderSkillFile(skillClass, raw, version, base) : raw, base)
       });
     }
   }
   return files;
 }
-function loadTemplateFiles(packRoot = resolvePackRoot(), version = resolvePackageVersion()) {
-  return loadClass(packRoot, "template", TEMPLATE_SKILLS, version);
+function loadTemplateFiles(packRoot = resolvePackRoot(), version = resolvePackageVersion(), base = OUTERLAYER_SKILLS_BASE) {
+  return loadClass(packRoot, "template", TEMPLATE_SKILLS, version, base);
 }
-function loadMaintainedFiles(packRoot = resolvePackRoot(), version = resolvePackageVersion()) {
-  return loadClass(packRoot, "maintained", MAINTAINED_SKILLS, version);
+function loadMaintainedFiles(packRoot = resolvePackRoot(), version = resolvePackageVersion(), base = OUTERLAYER_SKILLS_BASE) {
+  return loadClass(packRoot, "maintained", MAINTAINED_SKILLS, version, base);
 }
 function writeMaintainedFiles(repoRoot, files) {
   const created = [];
@@ -78,15 +87,15 @@ function writeMaintainedFiles(repoRoot, files) {
   }
   return { created, rewritten };
 }
-function maintainedFilesForExistingSkills(repoRoot, files) {
+function maintainedFilesForExistingSkills(repoRoot, files, base = OUTERLAYER_SKILLS_BASE) {
   return files.filter(
-    (file) => existsSync(join(repoRoot, skillDir(file.skill))) || formerNameExists(repoRoot, file.skill) || requiredByBuild(repoRoot, file.skill)
+    (file) => existsSync(join(repoRoot, skillDir(file.skill, base))) || formerNameExists(repoRoot, file.skill, base) || requiredByBuild(repoRoot, file.skill, base)
   );
 }
 function namesCore(text) {
   return text.includes("outerlayer-build");
 }
-function requiredByBuild(repoRoot, skill) {
+function requiredByBuild(repoRoot, skill, base) {
   if (skill !== "outerlayer-build") return false;
   const named = (file) => {
     try {
@@ -95,7 +104,7 @@ function requiredByBuild(repoRoot, skill) {
       return false;
     }
   };
-  if (named(join(repoRoot, skillDir("build"), "SKILL.md"))) return true;
+  if (named(join(repoRoot, skillDir("build", base), "SKILL.md"))) return true;
   const dir = join(repoRoot, ".outerlayer", "validators");
   try {
     return readdirSync(dir).some((name) => name.endsWith(".yaml") && named(join(dir, name)));
@@ -110,15 +119,15 @@ var FORMER_MAINTAINED_NAMES = {
   outerlayer: "outerlayer-cli"
 };
 var MAINTAINED_LINE = /^<!-- maintained by OuterLayer \S+?\. /m;
-function isMaintainedCopy(repoRoot, skill) {
+function isMaintainedCopy(repoRoot, skill, base = OUTERLAYER_SKILLS_BASE) {
   try {
-    return MAINTAINED_LINE.test(readFileSync(join(repoRoot, skillDir(skill), "SKILL.md"), "utf8"));
+    return MAINTAINED_LINE.test(readFileSync(join(repoRoot, skillDir(skill, base), "SKILL.md"), "utf8"));
   } catch {
     return false;
   }
 }
-function formerNameExists(repoRoot, skill) {
-  return Object.entries(FORMER_MAINTAINED_NAMES).some(([former, current]) => current === skill && isMaintainedCopy(repoRoot, former));
+function formerNameExists(repoRoot, skill, base) {
+  return Object.entries(FORMER_MAINTAINED_NAMES).some(([former, current]) => current === skill && isMaintainedCopy(repoRoot, former, base));
 }
 
-export { FORMER_MAINTAINED_NAMES, MAINTAINED_SKILLS, TEMPLATE_SKILLS, isMaintainedCopy, loadMaintainedFiles, loadTemplateFiles, maintainedFilesForExistingSkills, namesCore, resolvePackRoot, skillDir, writeMaintainedFiles };
+export { AGENTS_SKILLS_BASE, FORMER_MAINTAINED_NAMES, MAINTAINED_SKILLS, OUTERLAYER_SKILLS_BASE, TEMPLATE_SKILLS, isMaintainedCopy, loadMaintainedFiles, loadTemplateFiles, maintainedFilesForExistingSkills, namesCore, resolvePackRoot, restoreSkillPaths, rewriteSkillPaths, skillDir, writeMaintainedFiles };

package/dist/chunk-JKNYTNYD.js

@@ -0,0 +1,151 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { AGENTS_SKILLS_BASE, OUTERLAYER_SKILLS_BASE } from './chunk-HBISTTG3.js';
+import { normalizePath, CONTEXT_PIN_FILENAME } from './chunk-RKOTJQVG.js';
+import { existsSync, readdirSync, readFileSync, mkdirSync, writeFileSync, lstatSync, readlinkSync, symlinkSync, rmdirSync } from 'fs';
+import { relative, sep, join } from 'path';
+
+createRequire(import.meta.url);
+var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git"]);
+function toRepoRelative(repoRoot, absPath) {
+  return normalizePath(relative(repoRoot, absPath).split(sep).join("/"));
+}
+function isForeignTree(dir) {
+  return existsSync(join(dir, ".git")) || existsSync(join(dir, CONTEXT_PIN_FILENAME));
+}
+function discoverOuterlayerPaths(repoRoot) {
+  const out = [];
+  walk(repoRoot, repoRoot, false, out);
+  return out.sort();
+}
+function walk(dir, repoRoot, insideOuterlayer, out) {
+  let entries;
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (entry.isSymbolicLink()) continue;
+    const full = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (!insideOuterlayer && SKIP_DIRS.has(entry.name)) continue;
+      if (!insideOuterlayer && isForeignTree(full)) continue;
+      walk(full, repoRoot, insideOuterlayer || entry.name === ".outerlayer", out);
+    } else if (entry.isFile() && insideOuterlayer) {
+      out.push(toRepoRelative(repoRoot, full));
+    }
+  }
+}
+
+// src/layout.ts
+var AGENTS_MD_LAYOUT = 2;
+var FIRST_VERSION_READING_AGENTS_SKILLS = "0.21.0";
+var SKILLS_LINK_PATH = ".claude/skills";
+var SKILLS_LINK_TARGET = "../.agents/skills";
+var CONFIG_PATH = ".outerlayer/config.json";
+function readConfigObject(repoRoot) {
+  try {
+    const doc = JSON.parse(readFileSync(join(repoRoot, CONFIG_PATH), "utf8"));
+    return doc !== null && typeof doc === "object" && !Array.isArray(doc) ? doc : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function declaredLayout(repoRoot) {
+  const layout = readConfigObject(repoRoot)?.layout;
+  return typeof layout === "number" ? layout : void 0;
+}
+var MOVED_SOURCE = /(^|\/)\.outerlayer\/(AGENTS\.md|skills\/)/;
+function isAgentsMdLayout(repoRoot) {
+  if (declaredLayout(repoRoot) !== AGENTS_MD_LAYOUT) return false;
+  return !discoverOuterlayerPaths(repoRoot).some((path) => MOVED_SOURCE.test(path));
+}
+function skillsBaseFor(repoRoot) {
+  return isAgentsMdLayout(repoRoot) ? AGENTS_SKILLS_BASE : OUTERLAYER_SKILLS_BASE;
+}
+var TODAYS_LAYOUT_SOURCE = /(^|\/)\.outerlayer\/(AGENTS\.md|mcp\.json|skills\/|commands\/)/;
+function holdsTodaysLayoutSources(outerlayerPaths) {
+  return outerlayerPaths.some((path) => TODAYS_LAYOUT_SOURCE.test(path));
+}
+function declareAgentsMdLayout(repoRoot) {
+  const abs = join(repoRoot, CONFIG_PATH);
+  let doc = {};
+  if (existsSync(abs)) {
+    const existing = readConfigObject(repoRoot);
+    if (existing === void 0) return false;
+    if (existing.layout === AGENTS_MD_LAYOUT) return true;
+    doc = existing;
+  }
+  mkdirSync(join(repoRoot, ".outerlayer"), { recursive: true });
+  writeFileSync(abs, `${JSON.stringify({ ...doc, layout: AGENTS_MD_LAYOUT }, null, 2)}
+`);
+  return true;
+}
+function filesBelow(repoRoot, rel) {
+  const out = [];
+  let entries;
+  try {
+    entries = readdirSync(join(repoRoot, rel), { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  for (const entry of entries) {
+    const child = `${rel}/${entry.name}`;
+    if (entry.isDirectory()) out.push(...filesBelow(repoRoot, child));
+    else out.push(child);
+  }
+  return out.sort();
+}
+function linkClaudeSkills(repoRoot) {
+  const abs = join(repoRoot, SKILLS_LINK_PATH);
+  let stat;
+  try {
+    stat = lstatSync(abs);
+  } catch {
+    stat = void 0;
+  }
+  if (stat?.isSymbolicLink()) {
+    try {
+      return readlinkSync(abs) === SKILLS_LINK_TARGET ? { status: "present" } : { status: "elsewhere" };
+    } catch {
+      return { status: "elsewhere" };
+    }
+  }
+  if (stat !== void 0) {
+    if (!stat.isDirectory()) return { status: "blocked", blocking: [SKILLS_LINK_PATH] };
+    const files = filesBelow(repoRoot, SKILLS_LINK_PATH);
+    if (files.length > 0) return { status: "blocked", blocking: files };
+    removeEmptyTree(abs);
+  }
+  try {
+    mkdirSync(join(repoRoot, ".claude"), { recursive: true });
+    symlinkSync(SKILLS_LINK_TARGET, abs, "dir");
+    return { status: "linked" };
+  } catch (err) {
+    return { status: "failed", reason: err instanceof Error ? err.message : String(err) };
+  }
+}
+function removeEmptyTree(abs) {
+  for (const entry of readdirSync(abs, { withFileTypes: true })) {
+    if (entry.isDirectory()) removeEmptyTree(join(abs, entry.name));
+  }
+  rmdirSync(abs);
+}
+var WINDOWS_LINK_NOTE = "On Windows, git commits a link only when core.symlinks is true. Without it, git writes a text file and Claude Code finds no skills.";
+function describeSkillsLink(outcome) {
+  switch (outcome.status) {
+    case "linked":
+      return `Linked ${SKILLS_LINK_PATH} to ${SKILLS_LINK_TARGET}, so Claude Code finds the skills. ${WINDOWS_LINK_NOTE}`;
+    case "present":
+      return "";
+    case "blocked":
+      return `Left ${SKILLS_LINK_PATH}/ as it is and made no link, because it still holds ${outcome.blocking.join(", ")}.`;
+    case "elsewhere":
+      return `Left ${SKILLS_LINK_PATH} as it is: it is a link to somewhere other than ${SKILLS_LINK_TARGET}.`;
+    case "failed":
+      return `Could not link ${SKILLS_LINK_PATH} to ${SKILLS_LINK_TARGET}: ${outcome.reason}. On Windows, git needs core.symlinks and a permission to create links. The launcher, \`outerlayer claude\`, does not need the link.`;
+  }
+}
+
+export { AGENTS_MD_LAYOUT, FIRST_VERSION_READING_AGENTS_SKILLS, SKILLS_LINK_PATH, declareAgentsMdLayout, describeSkillsLink, discoverOuterlayerPaths, filesBelow, holdsTodaysLayoutSources, isAgentsMdLayout, isForeignTree, linkClaudeSkills, readConfigObject, skillsBaseFor, toRepoRelative };

package/dist/{chunk-CUFFDEF3.js → chunk-KGKFEONR.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { WorkCommandError, postJson } from './chunk-BET347JZ.js';
-import { defaultGitRunner, materializeContext, isStagingWriteFault, lookupGoverningSource } from './chunk-6YBLN4TR.js';
-import { signingFetchFor } from './chunk-QF7WZUU6.js';
-import { unsupportedLayout, layoutRefusalReason, composeDelivery } from './chunk-ZNPE7FW5.js';
+import { WorkCommandError, postJson } from './chunk-C64D7HR3.js';
+import { defaultGitRunner, materializeContext, isStagingWriteFault, lookupGoverningSource } from './chunk-XGPC3IOR.js';
+import { signingFetchFor } from './chunk-QS43O4DR.js';
+import { unsupportedLayout, layoutRefusalReason, composeDelivery } from './chunk-VPEGE3QZ.js';
 import { SHIM_SCRIPT, GOVERNANCE_VARIABLE } from './chunk-HCVLP7XA.js';
 import { readDegraded, readContextManifest, readSourceCache } from './chunk-YQR6E6OV.js';
 import { signerFor } from './chunk-OW52QLK3.js';

package/dist/{chunk-USWVXQIH.js → chunk-MQ743JX3.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { skillDir, FORMER_MAINTAINED_NAMES, isMaintainedCopy } from './chunk-5OCIHFGE.js';
+import { skillDir, FORMER_MAINTAINED_NAMES, isMaintainedCopy } from './chunk-HBISTTG3.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { emitTree, ALL_TARGET_IDS, classifyTree } from './chunk-WFSUUUAN.js';
+import { emitTree, ALL_TARGET_IDS, classifyTree } from './chunk-RKOTJQVG.js';
 import { readFileSync, existsSync, unlinkSync, rmdirSync, readdirSync } from 'fs';
 import { join, dirname, relative, sep } from 'path';
 
@@ -70,7 +70,7 @@ function checkFormerSkillNames(repoRoot) {
     checks.push({
       name: "Renamed skills",
       status: "warn",
-      detail: `copies under earlier names: ${retired.map(skillDir).join(", ")}`,
+      detail: `copies under earlier names: ${retired.map((former) => skillDir(former)).join(", ")}`,
       fix: `Run \`${cliInvocation()} context emit\` to replace them with the current names, then commit.`
     });
   }

package/dist/{chunk-XR56WEA5.js → chunk-OGMZJWWD.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { RecipeError, BUILDKIT_IMAGE } from './chunk-3W333NFO.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
-import { compareVersions } from './chunk-AEKSX4EY.js';
+import { compareVersions } from './chunk-CBCKD6DO.js';
 import { ensureHostKey } from './chunk-OW52QLK3.js';
 import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-IHNQWF6F.js';
 import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-URWYRAIC.js';

package/dist/chunk-QS43O4DR.js

@@ -0,0 +1,113 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
+import { readCloudConfig, cloudConfigPath } from './chunk-EABW6AJQ.js';
+import { cliInvocation } from './chunk-CRB3POP4.js';
+import { homeFromEnv } from './chunk-VNVZDWO3.js';
+import { resolvePackageVersion } from './chunk-RA3O54FC.js';
+import { signRunnerRequest, signerFor } from './chunk-OW52QLK3.js';
+
+createRequire(import.meta.url);
+
+// src/credentials.ts
+var MISSING_HELP = `Run \`${cliInvocation()} login\` to sign in, or set OUTERLAYER_URL / OUTERLAYER_API_KEY / OUTERLAYER_APP_ID. Mint a key in the dashboard: Settings \u2192 API keys.`;
+var NO_FACTORY_MESSAGE = `you are logged in, but no factory is chosen for this repository. Run \`${cliInvocation()} connect\` to choose one, or pass --app-id / set OUTERLAYER_APP_ID.`;
+var NO_FACTORY_OUTSIDE_REPOSITORY_MESSAGE = "you are logged in, but this directory is not in a git repository, so no factory is chosen. Pass --app-id / set OUTERLAYER_APP_ID, or run this from inside a connected repository.";
+var LOGIN_TOKEN_PREFIX = "olu_";
+function unauthorizedMessage(credential) {
+  return credential.startsWith(LOGIN_TOKEN_PREFIX) ? `not authorized \u2014 the login is expired or was revoked. Run \`${cliInvocation()} login\` to sign in again.` : "not authorized \u2014 the API key is unknown, expired, or bound to a different factory. Mint a fresh key: dashboard \u2192 Settings \u2192 API keys.";
+}
+function resolveGatewayCredentials(sources = {}) {
+  const env = sources.env ?? process.env;
+  const config = readCloudConfig(sources.home ?? homeFromEnv(env));
+  const url = sources.url ?? env.OUTERLAYER_URL ?? config.url;
+  const key = sources.apiKey ?? (env.OUTERLAYER_API_KEY || void 0) ?? config.apiKey;
+  const kind = key ? "key" : "login";
+  const credential = key ?? config.accountToken;
+  const cwd = sources.cwd ?? process.cwd();
+  const appId = sources.appId ?? (env.OUTERLAYER_APP_ID || void 0) ?? (kind === "key" ? config.appId : readRepoConnection(cwd)?.appId);
+  if (credential && url && !appId && kind === "login") {
+    const message = findGitDirs(cwd) === void 0 ? NO_FACTORY_OUTSIDE_REPOSITORY_MESSAGE : NO_FACTORY_MESSAGE;
+    return { ok: false, message, url, credential, appId, kind };
+  }
+  if (!url || !credential || !appId) {
+    const missing = [!url && "--url", !credential && "a login or OUTERLAYER_API_KEY", !appId && "--app-id"].filter(Boolean).join(", ");
+    return { ok: false, message: `missing ${missing}. ${MISSING_HELP}`, url, credential, appId, kind };
+  }
+  return { ok: true, url, credential, appId, kind };
+}
+
+// src/signing-fetch.ts
+function bodyBytes(body) {
+  if (body === void 0 || body === null) return new Uint8Array(0);
+  if (typeof body === "string") return new TextEncoder().encode(body);
+  if (body instanceof Uint8Array) return body;
+  if (body instanceof ArrayBuffer) return new Uint8Array(body);
+  return void 0;
+}
+async function savedKeySigner(headers, home) {
+  const authorization = headers.get("authorization");
+  if (authorization === null || !authorization.startsWith("Bearer ")) return void 0;
+  if (headers.has("signature")) return void 0;
+  if (readCloudConfig(home).apiKey !== authorization.slice("Bearer ".length)) return void 0;
+  try {
+    return await signerFor(cloudConfigPath(home));
+  } catch {
+    return void 0;
+  }
+}
+function signedBy(base, signerOf) {
+  return (async (input, init) => {
+    if (input instanceof Request) return base(input, init);
+    const headers = new Headers(init?.headers);
+    const signer = await signerOf(headers);
+    const body = bodyBytes(init?.body);
+    if (signer === void 0 || body === void 0) return base(input, init);
+    const signature = await signRunnerRequest({ method: init?.method ?? "GET", url: input.toString(), body, signer });
+    for (const [name, value] of Object.entries(signature)) headers.set(name, value);
+    return base(input, { ...init, headers });
+  });
+}
+function signingFetch(base, home = () => homeFromEnv()) {
+  return signedBy(base, (headers) => savedKeySigner(headers, home()));
+}
+function signingFetchFor(base, configPath, apiKey) {
+  return signedBy(base, async (headers) => {
+    const authorization = headers.get("authorization");
+    if (authorization !== `Bearer ${apiKey}` || headers.has("signature")) return void 0;
+    try {
+      return await signerFor(configPath);
+    } catch {
+      return void 0;
+    }
+  });
+}
+function cliUserAgent(version = resolvePackageVersion()) {
+  return `outerlayer-cli/${version}`;
+}
+function withHeader(headers, name, value) {
+  if (headers instanceof Headers) {
+    if (headers.has(name)) return headers;
+    const copy = new Headers(headers);
+    copy.set(name, value);
+    return copy;
+  }
+  if (Array.isArray(headers)) {
+    return headers.some(([key]) => key.toLowerCase() === name) ? headers : [...headers, [name, value]];
+  }
+  const record = headers ?? {};
+  return Object.keys(record).some((key) => key.toLowerCase() === name) ? record : { ...record, [name]: value };
+}
+function withCliUserAgent(base, userAgent = () => cliUserAgent()) {
+  return ((input, init) => {
+    if (input instanceof Request) return base(input, init);
+    return base(input, { ...init, headers: withHeader(init?.headers, "user-agent", userAgent()) });
+  });
+}
+function globalFetch(input, init) {
+  return globalThis.fetch(input, init);
+}
+var cliFetch = withCliUserAgent(globalFetch);
+var defaultFetch = signingFetch(cliFetch);
+
+export { cliFetch, defaultFetch, resolveGatewayCredentials, signingFetchFor, unauthorizedMessage };

package/dist/{chunk-FOCML5FI.js → chunk-QSEPKZXR.js}

@@ -1,24 +1,25 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { senderPidfile } from './chunk-BOMRFYTZ.js';
-import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-JZGFDTNC.js';
-import { installScrubContext } from './chunk-URAKVDSI.js';
-import { ADDED_USER, AssetError, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, resolveAgentUser, AgentUserError, runBuildSteps, shellQuote, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, senderAliveScript, GH_CONFIG_YML, ghHostsYml, isLiteralAddress, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, copyJudgeTree } from './chunk-5NJIWKD4.js';
-import { readBranchHead, fetchCommit, diffBetween } from './chunk-3AZYLAJC.js';
-import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, COMMAND_DIR, childEnvironment, judgeCommand, JUDGE_MAX_TURNS, MAX_REPORT_BYTES, JUDGE_DIR } from './chunk-XR56WEA5.js';
+import { senderPidfile } from './chunk-WY7HFY62.js';
+import { DOCKERD_LOG, HELPER_PATH, HELPER_RECORD } from './chunk-Z42JY3LQ.js';
+import { writeDockerClientConfig } from './chunk-WXJXHZVB.js';
+import { installScrubContext } from './chunk-DJYOCD65.js';
+import { ADDED_USER, AssetError, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, resolveAgentUser, AgentUserError, runBuildSteps, shellQuote, LEASE_SECONDS, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, containerSenderCommand, signalInContainer, syncInContainer, copyTranscriptsFromContainer, senderAliveScript, GH_CONFIG_YML, ghHostsYml, isLiteralAddress, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, DeliveryFailure, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript, containerJudgeEnvironment, copyJudgeTree } from './chunk-BOG4ENP7.js';
+import { readBranchHead, fetchCommit, diffBetween } from './chunk-QILR6TZP.js';
+import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
+import { HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, writeJobFile, readJobFile, COMMAND_DIR, childEnvironment, judgeCommand, JUDGE_MAX_TURNS, MAX_REPORT_BYTES, JUDGE_DIR } from './chunk-OGMZJWWD.js';
 import { CLAUDE_CODE_VERSION } from './chunk-3W333NFO.js';
 import { waitForAgent, vmExecArgs } from './chunk-NYTZ7HVN.js';
 import { socketPathProblem, vsockLinks, linkVsockSockets } from './chunk-2Q3PZ42G.js';
-import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, formatDuration, retrySend, formatClock } from './chunk-CUFFDEF3.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-BET347JZ.js';
-import { planArtifactUpload } from './chunk-G3IJ3N6F.js';
+import { describeCallFailure, resolveGoverningSource, refusalCode, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, logStamp, createRunnerLog, formatDuration, retrySend, formatClock } from './chunk-KGKFEONR.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-C64D7HR3.js';
+import { planArtifactUpload } from './chunk-BUP5N3X6.js';
 import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-V5CG75NX.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
-import { isSameProcess, startTimeOf } from './chunk-JBJTC3UU.js';
-import { scrubText } from './chunk-AEKSX4EY.js';
+import { scrubText } from './chunk-CBCKD6DO.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
-import { resolvePackRoot } from './chunk-5OCIHFGE.js';
-import { parsePolicy } from './chunk-WFSUUUAN.js';
+import { resolvePackRoot } from './chunk-HBISTTG3.js';
+import { parsePolicy } from './chunk-RKOTJQVG.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
 import { signerFor } from './chunk-OW52QLK3.js';
@@ -413,7 +414,7 @@ async function waitForDocker(runtime, state, agentUser, now) {
       if (firstLine(granted.stderr) !== "") lastError = `giving the agent's group the Docker socket failed: ${firstLine(granted.stderr)}`;
     } else {
       const answered = await runtime.vm.exec(state.vsockPath, request);
-      if (answered.status === 0) return void 0;
+      if (answered.status === 0) return writeDockerClientConfig(asRoot.bind(null, runtime, state), agentUser);
       lastError = firstLine(answered.stderr) === "" ? "" : `docker info said: ${firstLine(answered.stderr)}`;
     }
     if (now().getTime() >= deadline) break;

package/dist/{chunk-7VUK5RFS.js → chunk-QZBXLLTV.js}

@@ -22514,6 +22514,41 @@ external_exports.object({
   clientSendId: external_exports.string().regex(REVIEW_SEND_ID_PATTERN),
   notes: external_exports.array(WorkItemReviewNoteSchema).min(1).max(WORK_ITEM_REVIEW_NOTES_MAX)
 });
+var CLI_LOGIN_KIND = "account";
+var CLI_LOGIN_MACHINE_NAME_MAX = 255;
+external_exports.object({
+  public_key: external_exports.string().min(1),
+  // The characters a key name may hold; the CLI cuts its host name to these.
+  machine_name: external_exports.string().trim().min(1).max(CLI_LOGIN_MACHINE_NAME_MAX).regex(/^[\w\s\-().]+$/, "Invalid characters in machine_name"),
+  kind: external_exports.literal(CLI_LOGIN_KIND)
+});
+var CliLoginStartResponseSchema = external_exports.object({
+  id: external_exports.string(),
+  code: external_exports.string(),
+  verification_url: external_exports.string(),
+  interval: external_exports.number(),
+  expires_at: external_exports.string()
+});
+var CliLoginStartedSchema = CliLoginStartResponseSchema.pick({ id: true, code: true, expires_at: true }).extend({
+  interval: CliLoginStartResponseSchema.shape.interval.positive().optional().catch(void 0)
+});
+var CliLoginPollResponseSchema = external_exports.discriminatedUnion("status", [
+  external_exports.object({ status: external_exports.literal("pending") }),
+  external_exports.object({ status: external_exports.literal("denied") }),
+  external_exports.object({
+    status: external_exports.literal("approved"),
+    /** The account token, RSA-OAEP (SHA-256) encrypted to the start's public key, in base64. */
+    encrypted_token: external_exports.string(),
+    /** The gateway the token works against. */
+    gateway_url: external_exports.string(),
+    /** The email of the account the token signs in to. */
+    email: external_exports.string()
+  })
+]);
+var CliLoginRefusalSchema = external_exports.object({
+  error: external_exports.string(),
+  message: external_exports.string().optional()
+});
 /*! Bundled license information:
 
 xmlchars/xml/1.0/ed5.js:
@@ -22544,4 +22579,4 @@ xmlchars/xmlns/1.0/ed3.js:
    *)
 */
 
-export { ARTIFACT_KINDS, ARTIFACT_MAX_CAPTION_LENGTH, ARTIFACT_MAX_FILENAME_LENGTH, ARTIFACT_MAX_REPLACES_TARGETS, ArtifactCriterionIdSchema, ArtifactSpoolRecordSchema, ArtifactTombstoneRecordSchema, BUCKET_MODEL_MAX_LENGTH, CAPTURE_TIERS, CriteriaListSchema, EMITTED_RESULTS, EMITTED_RESULT_MAX_BODY_LENGTH, EMITTED_RESULT_MAX_LINK_LENGTH, EVENT_TYPES, EmittedNameSchema, FindingBatchSchema, FindingsResponseSchema, INPUT_BAND_BOUNDARIES, RESERVED_EMIT_NAMES, SAME_PROBLEM_RULES, SCHEMA_VERSION, SPEED_MAX_LENGTH, StepBodySchema, StepNameSchema, bannedPathsForTier, bindTests, downconvertSession, inferArtifactKind, inputBandOf, isHumanUserTurn, mediaTypeForArtifactPath, parseAgentSession, parseJunit, parseTestSelector, turnCountBound };
+export { ARTIFACT_KINDS, ARTIFACT_MAX_CAPTION_LENGTH, ARTIFACT_MAX_FILENAME_LENGTH, ARTIFACT_MAX_REPLACES_TARGETS, ArtifactCriterionIdSchema, ArtifactSpoolRecordSchema, ArtifactTombstoneRecordSchema, BUCKET_MODEL_MAX_LENGTH, CAPTURE_TIERS, CLI_LOGIN_KIND, CLI_LOGIN_MACHINE_NAME_MAX, CliLoginPollResponseSchema, CliLoginRefusalSchema, CliLoginStartedSchema, CriteriaListSchema, EMITTED_RESULTS, EMITTED_RESULT_MAX_BODY_LENGTH, EMITTED_RESULT_MAX_LINK_LENGTH, EVENT_TYPES, EmittedNameSchema, FindingBatchSchema, FindingsResponseSchema, INPUT_BAND_BOUNDARIES, RESERVED_EMIT_NAMES, SAME_PROBLEM_RULES, SCHEMA_VERSION, SPEED_MAX_LENGTH, StepBodySchema, StepNameSchema, bannedPathsForTier, bindTests, downconvertSession, inferArtifactKind, inputBandOf, isHumanUserTurn, mediaTypeForArtifactPath, parseAgentSession, parseJunit, parseTestSelector, turnCountBound };

package/dist/{chunk-WFSUUUAN.js → chunk-RKOTJQVG.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RESERVED_EMIT_NAMES, ARTIFACT_KINDS, ArtifactCriterionIdSchema } from './chunk-7VUK5RFS.js';
+import { RESERVED_EMIT_NAMES, ARTIFACT_KINDS, ArtifactCriterionIdSchema } from './chunk-QZBXLLTV.js';
 import { __commonJS, __require, __toESM } from './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);

package/dist/{chunk-7FEY33MY.js → chunk-TFGXOHF6.js}

@@ -1,25 +1,25 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, commandLogOffset, execCommandLine, startSender, startHostServices, finishJob, isContainerTracked, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, ALREADY_RELEASED } from './chunk-FOCML5FI.js';
+import { releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, commandLogOffset, execCommandLine, startSender, startHostServices, finishJob, isContainerTracked, probeCommand, appendCommandLog, judgeProbe, EXIT_CODE_FILE, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, AttemptLogBook, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, listTrackedJobs, restartSender, ALREADY_RELEASED } from './chunk-QSEPKZXR.js';
+import { writePendingUpdate } from './chunk-CQAEV3Z5.js';
+import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-UF5L4BAI.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
-import { compareVersions, satisfiesRange } from './chunk-I2UOAV7X.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-YETTWTAY.js';
+import { compareVersions, satisfiesRange } from './chunk-I2UOAV7X.js';
 import { RUNNER_PROTOCOL } from './chunk-TPKYTORP.js';
-import { writePendingUpdate } from './chunk-CQAEV3Z5.js';
-import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-UF5L4BAI.js';
-import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-ENTHEUKT.js';
+import { currentSkillCommand, formerSkillProblem, placeholderQueues, placeholderProblem } from './chunk-G3LHWUBK.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, cleanVersions, isInLayout, stagingDir } from './chunk-276D7BJ7.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
+import { LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, measureDisk, setUpRunnerCgroup, createContainerRuntime, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied } from './chunk-BOG4ENP7.js';
 import { checkFit } from './chunk-OBCFK4QD.js';
-import { LEASE_SECONDS, provisionContainer, leaseExpiresAtMs, deliverContainerHooks, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandExec, measureDisk, setUpRunnerCgroup, createContainerRuntime, parseCpuList, ensureTunnel, keepGhConfigCurrent, filesAreCopied } from './chunk-5NJIWKD4.js';
-import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-XR56WEA5.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-CUFFDEF3.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-BET347JZ.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-V5CG75NX.js';
-import { exceedsDisk } from './chunk-7RQ73DLO.js';
 import { claimPidFile, readPidFile, releasePidFile } from './chunk-XACXXKQ5.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
+import { writeJobFile, ensureRunnerIdentity, readJobFile, builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, spawnRun, BUILD_LABEL, RUNNER_LABEL, readJobFileChecked } from './chunk-OGMZJWWD.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, BuildTokens, classifyRefusal, refusalCode, createRunnerLog, formatClock } from './chunk-KGKFEONR.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-C64D7HR3.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-V5CG75NX.js';
+import { exceedsDisk } from './chunk-7RQ73DLO.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
 import { loadHostKey, ensureHostKey, signerFor } from './chunk-OW52QLK3.js';
 import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, RUNNER_FILE_MODE, jobsDir, pidFilePath, spoolDir, rootfsDir } from './chunk-IHNQWF6F.js';
@@ -1552,7 +1552,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected repository_not_reachable branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-KWHAYUYB.js');
+  const { postJson: postJson2 } = await import('./work-cmd-FMPDXPU6.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -2521,7 +2521,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     const outcome = await onStartUnderMarker({
       configPath,
       own: ownVersionOf(deps),
-      check: update.check ? () => update.check(configPath) : async () => (await import('./check-UYKEMQNR.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
+      check: update.check ? () => update.check(configPath) : async () => (await import('./check-3CGLWMHM.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
     });