@outerlayer/cli 0.22.1 → 0.23.0

package/dist/{chunk-EAQSOE62.js → chunk-XSPA5ODY.js}

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { revokeTokenOnDashboard } from './chunk-F35VMF5M.js';
+import { revokeTokenOnDashboard } from './chunk-GOSFARMS.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
-import { readCloudConfig, writeCloudConfig, cloudConfigPath } from './chunk-EABW6AJQ.js';
 import { C } from './chunk-ANPNT6PM.js';
+import { readCloudConfig, writeCloudConfig, cloudConfigPath } from './chunk-EABW6AJQ.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
+import { CLI_LOGIN_MACHINE_NAME_MAX, CliLoginPollResponseSchema, CLI_LOGIN_KIND, CliLoginRefusalSchema, CliLoginStartedSchema } from './chunk-QZBXLLTV.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { generateKeyPairSync, privateDecrypt, constants, createPrivateKey } from 'crypto';
 import { spawn } from 'child_process';
@@ -45,7 +46,6 @@ var PIPED_KEY_GIVE_UP_MS = 3e4;
 var REQUEST_TIMEOUT_MS = 15e3;
 var MAX_POLL_FAILURES = 5;
 var DEFAULT_POLL_INTERVAL_S = 3;
-var MACHINE_NAME_MAX = 255;
 function realLoginDeps() {
   return {
     fetchImpl: fetch,
@@ -74,7 +74,7 @@ function openInBrowser(url) {
 }
 function sanitizeMachineName(raw) {
   const cleaned = raw.replace(/[^\w\s\-().]/g, "").trim();
-  return (cleaned.length > 0 ? cleaned : "machine").slice(0, MACHINE_NAME_MAX);
+  return (cleaned.length > 0 ? cleaned : "machine").slice(0, CLI_LOGIN_MACHINE_NAME_MAX);
 }
 function stdinKind(stdin) {
   if (stdin.isTTY) return "terminal";
@@ -168,16 +168,13 @@ function purgeExpiredPending(home, now, keepId) {
     }
   }
 }
-function asRecord(value) {
-  return typeof value === "object" && value !== null ? value : {};
-}
 async function startLogin(deps, dashboard, publicKey, machineName) {
   let res;
   try {
     res = await deps.fetchImpl(`${dashboard}/api/cli/login`, {
       method: "POST",
       headers: { "content-type": "application/json" },
-      body: JSON.stringify({ public_key: publicKey, machine_name: machineName, kind: "account" }),
+      body: JSON.stringify({ public_key: publicKey, machine_name: machineName, kind: CLI_LOGIN_KIND }),
       signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
     });
   } catch (err) {
@@ -189,16 +186,18 @@ async function startLogin(deps, dashboard, publicKey, machineName) {
       `${dashboard} is limiting logins from this address` + (wait > 0 ? `; try again in ${wait} seconds` : "; try again shortly")
     );
   }
-  const body = asRecord(await res.json().catch(() => null));
+  const body = await res.json().catch(() => null);
   if (!res.ok) {
-    const reason = typeof body.message === "string" ? `: ${body.message}` : "";
+    const refusal = CliLoginRefusalSchema.safeParse(body);
+    const reason = refusal.success && refusal.data.message !== void 0 ? `: ${refusal.data.message}` : "";
     throw new LoginError(`${dashboard} refused to start a login (HTTP ${res.status})${reason}`);
   }
-  if (typeof body.id !== "string" || typeof body.code !== "string" || typeof body.expires_at !== "string") {
+  const started = CliLoginStartedSchema.safeParse(body);
+  if (!started.success) {
     throw new LoginError(`${dashboard} answered with something that is not a login; is --dashboard the dashboard's address?`);
   }
-  const interval = typeof body.interval === "number" && body.interval > 0 ? body.interval : DEFAULT_POLL_INTERVAL_S;
-  return { id: body.id, code: body.code, interval, expiresAt: body.expires_at };
+  const { id, code, interval, expires_at: expiresAt } = started.data;
+  return { id, code, interval: interval ?? DEFAULT_POLL_INTERVAL_S, expiresAt };
 }
 async function pollLogin(deps, dashboard, id) {
   let res;
@@ -215,13 +214,16 @@ async function pollLogin(deps, dashboard, id) {
   if (res.status === 202) return { kind: "pending" };
   if (res.status >= 500) return { kind: "unavailable", message: `HTTP ${res.status}` };
   if (!res.ok) return { kind: "error", message: `HTTP ${res.status}` };
-  const body = asRecord(await res.json().catch(() => null));
-  if (body.status === "pending") return { kind: "pending" };
-  if (body.status === "denied") return { kind: "denied" };
-  if (body.status === "approved" && typeof body.encrypted_token === "string" && typeof body.gateway_url === "string" && typeof body.email === "string") {
-    return { kind: "approved", encryptedToken: body.encrypted_token, gatewayUrl: body.gateway_url, email: body.email };
+  const answer = CliLoginPollResponseSchema.safeParse(await res.json().catch(() => null));
+  if (!answer.success) return { kind: "error", message: "unexpected answer" };
+  switch (answer.data.status) {
+    case "pending":
+      return { kind: "pending" };
+    case "denied":
+      return { kind: "denied" };
+    case "approved":
+      return { kind: "approved", encryptedToken: answer.data.encrypted_token, gatewayUrl: answer.data.gateway_url, email: answer.data.email };
   }
-  return { kind: "error", message: "unexpected answer" };
 }
 function decryptToken(privateKeyPem, encryptedToken) {
   try {

package/dist/{chunk-JZGFDTNC.js → chunk-Z42JY3LQ.js}

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EXEC_PORT } from './chunk-2Q3PZ42G.js';
+import { BRIDGE_ADDRESS, TUNNEL_PORT, BRIDGE_CIDR } from './chunk-WXJXHZVB.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
+import { EXEC_PORT } from './chunk-2Q3PZ42G.js';
 import { RELAY_PORT } from './chunk-URWYRAIC.js';
 import { spawn, spawnSync } from 'child_process';
 import { writeFileSync, chmodSync, mkdirSync } from 'fs';
@@ -12,6 +13,7 @@ var HELPER_RECORD = "/run/outerlayer-helpers";
 var KERNEL_FLAG = "outerlayer.relay";
 var DOCKER_FLAG = "outerlayer.docker";
 var DOCKERD_CONFIG = "/run/outerlayer-dockerd.json";
+var NONLOCAL_BIND = "/proc/sys/net/ipv4/ip_nonlocal_bind";
 var DOCKERD_LOG = "/run/dockerd.log";
 var DOCKER_DATA_ROOT = "/build/docker";
 var BUILD_DISK = "/dev/vdb";
@@ -32,13 +34,25 @@ function relayPortsFrom(cmdline) {
 function dockerRequestedBy(cmdline) {
   return new RegExp(`(?:^|\\s)${DOCKER_FLAG.replace(".", "\\.")}=1(?:\\s|$)`).test(cmdline);
 }
+function startBridgeForwarder(host) {
+  host.writeFile(NONLOCAL_BIND, "1");
+  host.spawnDetached([
+    "/opt/outerlayer/bin/node",
+    "/opt/outerlayer/cli/dist/index.js",
+    "vm-forward",
+    "--listen",
+    `${BRIDGE_ADDRESS}:${TUNNEL_PORT}`,
+    "--to",
+    `127.0.0.1:${TUNNEL_PORT}`
+  ]);
+}
 function startDocker(host) {
   const proxy = `http://127.0.0.1:${RELAY_PORT}`;
   host.mount({ source: "cgroup2", target: "/sys/fs/cgroup", type: "cgroup2" });
   host.mkdir(DOCKER_DATA_ROOT, 457);
   host.writeFile(
     DOCKERD_CONFIG,
-    `${JSON.stringify({ "data-root": DOCKER_DATA_ROOT, proxies: { "http-proxy": proxy, "https-proxy": proxy, "no-proxy": "localhost,127.0.0.1" } }, null, 2)}
+    `${JSON.stringify({ "data-root": DOCKER_DATA_ROOT, bip: BRIDGE_CIDR, proxies: { "http-proxy": proxy, "https-proxy": proxy, "no-proxy": "localhost,127.0.0.1" } }, null, 2)}
 `
   );
   host.spawnDetached(["/bin/sh", "-c", `exec dockerd --config-file ${DOCKERD_CONFIG} >${DOCKERD_LOG} 2>&1`]);
@@ -65,7 +79,10 @@ function runGuestInit(host, cmdline) {
   host.writeFile("/proc/sys/kernel/hostname", HOSTNAME);
   host.mount({ source: "tmpfs", target: "/outerlayer/job", type: "tmpfs", options: "mode=0755" });
   const relay = host.spawnDetached([HELPER_PATH, "relay", ...ports.flatMap((port) => ["--forward", String(port)])]);
-  if (dockerRequestedBy(cmdline)) startDocker(host);
+  if (dockerRequestedBy(cmdline)) {
+    startBridgeForwarder(host);
+    startDocker(host);
+  }
   const agent = host.spawnDetached([HELPER_PATH, "exec-agent", "--port", String(EXEC_PORT)]);
   host.writeFile(HELPER_RECORD, [relay, agent].map((started) => `${started.pid} ${started.start}
 `).join(""));

package/dist/{chunk-O6RJ3QMU.js → chunk-ZKWKQIJU.js}

@@ -1,14 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runEmit } from './chunk-XCRZTXRL.js';
-import { resolveGitCommonDir, defaultGitRunner } from './chunk-6YBLN4TR.js';
-import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME } from './chunk-DIB2WLBL.js';
-import { installStarterPack } from './chunk-V7SAQ645.js';
-import { loadTemplateFiles, loadMaintainedFiles, skillDir } from './chunk-5OCIHFGE.js';
+import { runEmit } from './chunk-WX2WEERU.js';
+import { installStarterPack } from './chunk-VJBFQP3H.js';
+import { resolveGitCommonDir, defaultGitRunner } from './chunk-XGPC3IOR.js';
+import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME } from './chunk-YVZJ6GKF.js';
 import { C } from './chunk-ANPNT6PM.js';
+import { AGENTS_MD_LAYOUT, declareAgentsMdLayout, linkClaudeSkills, SKILLS_LINK_PATH, describeSkillsLink, isAgentsMdLayout, holdsTodaysLayoutSources, discoverOuterlayerPaths } from './chunk-JKNYTNYD.js';
+import { loadTemplateFiles, loadMaintainedFiles, skillDir, AGENTS_SKILLS_BASE } from './chunk-HBISTTG3.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
+import { linkedAgentsPath } from './chunk-VWFOKRYS.js';
 import { cloneIsGoverned } from './chunk-YQR6E6OV.js';
-import { generatedHeaderSource } from './chunk-WFSUUUAN.js';
+import { generatedHeaderSource } from './chunk-RKOTJQVG.js';
 import { execFileSync } from 'child_process';
 import { existsSync, mkdirSync, writeFileSync } from 'fs';
 import { join, dirname } from 'path';
@@ -19,6 +21,18 @@ var MCP_OUTPUT_PATH = ".mcp.json";
 var POLICY_PATH = ".outerlayer/policy.yaml";
 var DEFAULT_CONFIG = `${JSON.stringify({ targets: ["claude-code"] }, null, 2)}
 `;
+var AGENTS_MD_CONFIG = `${JSON.stringify({ targets: ["claude-code"], layout: AGENTS_MD_LAYOUT }, null, 2)}
+`;
+var STARTER_AGENTS_MD = `# Agent instructions
+
+Write here what an agent needs to work in this repository: how to build and test it, the rules it follows, and what to check before it opens a pull request.
+
+Claude Code and Codex read this file as it is. Skills are in \`.agents/skills/\`.
+`;
+function inTodaysLayout(repoRoot) {
+  if (isAgentsMdLayout(repoRoot)) return false;
+  return existsSync(join(repoRoot, CONFIG_PATH)) || holdsTodaysLayoutSources(discoverOuterlayerPaths(repoRoot));
+}
 var errorMessage = (err) => err instanceof Error ? err.message : String(err);
 var skipped = (reason) => ({
   outcome: "skipped",
@@ -75,6 +89,7 @@ function runAgentSetup(opts) {
   } catch (err) {
     return failed(errorMessage(err), /* @__PURE__ */ new Set(), []);
   }
+  if (!inTodaysLayout(repoRoot)) return runAgentsMdSetup(repoRoot, opts.skillsLink !== false);
   const written = /* @__PURE__ */ new Set();
   const kept = [];
   const problems = [];
@@ -142,6 +157,71 @@ function runAgentSetup(opts) {
     kept: keptPaths
   };
 }
+function runAgentsMdSetup(repoRoot, skillsLink) {
+  const written = /* @__PURE__ */ new Set();
+  const kept = [];
+  const problems = [];
+  const linked = linkedAgentsPath(repoRoot);
+  if (linked !== void 0) return failed(`${linked} is a link, and a write there would land outside the repository; replace it with a folder and run this again`, written, kept);
+  try {
+    const pack = installStarterPack({ repoRoot, base: AGENTS_SKILLS_BASE });
+    for (const file of loadTemplateFiles(void 0, void 0, AGENTS_SKILLS_BASE).filter((f) => pack.copied.includes(f.skill))) written.add(file.path);
+    for (const path of pack.maintained) written.add(path);
+    for (const skill of pack.kept) kept.push(`${skillDir(skill, AGENTS_SKILLS_BASE)}/`);
+    if (pack.policy === "written") written.add(POLICY_PATH);
+    else kept.push(POLICY_PATH);
+    for (const path of pack.validatorsWritten) written.add(path);
+    kept.push(...pack.validatorsKept);
+    if (existsSync(join(repoRoot, "AGENTS.md")) || existsSync(join(repoRoot, "CLAUDE.md"))) {
+      kept.push(existsSync(join(repoRoot, "AGENTS.md")) ? "AGENTS.md" : "CLAUDE.md");
+    } else {
+      writeFileSync(join(repoRoot, "AGENTS.md"), STARTER_AGENTS_MD);
+      written.add("AGENTS.md");
+    }
+    if (existsSync(join(repoRoot, CONFIG_PATH))) {
+      kept.push(CONFIG_PATH);
+    } else {
+      mkdirSync(dirname(join(repoRoot, CONFIG_PATH)), { recursive: true });
+      writeFileSync(join(repoRoot, CONFIG_PATH), AGENTS_MD_CONFIG);
+      written.add(CONFIG_PATH);
+    }
+    declareAgentsMdLayout(repoRoot);
+  } catch (err) {
+    return failed(`could not install the skills: ${errorMessage(err)}`, written, kept);
+  }
+  try {
+    const mcp = addStdioMcpEntryIfAbsent(repoRoot);
+    if (mcp.added) written.add(mcp.path);
+    else kept.push(`${mcp.path} (already has an outerlayer server)`);
+    const docs = addDocsMcpEntryIfAbsent(repoRoot);
+    if (docs.added) written.add(docs.path);
+    else kept.push(`${docs.path} (already has an ${DOCS_MCP_SERVER_NAME} server)`);
+  } catch (err) {
+    problems.push(errorMessage(err));
+  }
+  let linkNote = "";
+  if (skillsLink) {
+    const link = linkClaudeSkills(repoRoot);
+    if (link.status === "linked") written.add(SKILLS_LINK_PATH);
+    linkNote = describeSkillsLink(link);
+  }
+  if (problems.length > 0) return failed(problems.join("; "), written, kept);
+  const paths = [...written].sort();
+  const lines = [
+    `${C.green}\u2713${C.reset} Agent setup: ${paths.length === 0 ? "already in place, nothing changed" : "instructions in AGENTS.md, skills in .agents/skills/"}`,
+    renderPaths(paths, kept).trimEnd()
+  ];
+  if (linkNote !== "") lines.push(`  ${linkNote}`);
+  if (paths.length > 0) lines.push(`  ${C.dim}Commit AGENTS.md, .agents/ and .mcp.json with .outerlayer/. Nothing is generated, so there is no emit step.${C.reset}`);
+  return {
+    outcome: "done",
+    reason: paths.length === 0 ? "already set up" : `${paths.length} files written`,
+    text: `${lines.join("\n")}
+`,
+    paths,
+    kept: []
+  };
+}
 function writtenBeforeFailure(repoRoot, pending, keep) {
   if (pending === void 0 || pending.length === 0) return [];
   try {

package/dist/{chunk-QOALB6ZD.js → chunk-ZLZ3XVPI.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-JRCSET55.js';
-import { resolveGatewayCredentials } from './chunk-NTRCK4NH.js';
+import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-GXV73IIS.js';
+import { resolveGatewayCredentials } from './chunk-QS43O4DR.js';
 import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
-import { resolveRepoIdentity } from './chunk-AEKSX4EY.js';
+import { resolveRepoIdentity } from './chunk-CBCKD6DO.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { openSync, fstatSync, readSync, closeSync } from 'fs';

package/dist/{claude-launcher-TBWV3YL3.js → claude-launcher-KEESTJHO.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { sharedSkillNames } from './chunk-ZNPE7FW5.js';
+import { sharedSkillNames } from './chunk-VPEGE3QZ.js';
 import { GOVERNANCE_VARIABLE, versionAtLeast, MINIMUM_CLAUDE_VERSION, SHIM_SCRIPT, CONTROL_PLANE_DIR_VARIABLE } from './chunk-HCVLP7XA.js';
 export { MINIMUM_CLAUDE_VERSION } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
-import './chunk-5OCIHFGE.js';
-import './chunk-WFSUUUAN.js';
-import './chunk-7VUK5RFS.js';
+import './chunk-HBISTTG3.js';
+import './chunk-RKOTJQVG.js';
+import './chunk-QZBXLLTV.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
 import './chunk-Z5GEFMRW.js';
@@ -236,7 +236,7 @@ async function runClaudeLauncher(args, deps = {}) {
       return 1;
     }
   } else {
-    const { resolveLaunchPlane } = await import('./control-plane-launch-OWSNH6YA.js');
+    const { resolveLaunchPlane } = await import('./control-plane-launch-SEYCOZFH.js');
     const plane = env[GOVERNANCE_VARIABLE] === "self" ? { kind: "none" } : await resolveLaunchPlane({ cwd, env, home, fetchImpl: deps.fetchImpl, stderr });
     if (plane.kind === "none") {
       const own2 = ownSkillsDirFor(cwd, home, [], stderr);