@outerlayer/cli 0.27.1 → 0.28.2

package/dist/{chunk-BWH36FOC.js → chunk-7CK2TJFB.js}

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
 import { readCloudConfigStrict, readCloudConfig, cloudConfigPath } from './chunk-PJDQPF5N.js';
+import { signRunnerRequest, signerFor } from './chunk-YL2VDSNF.js';
+import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
+import { PLAIN_VERSION, recordCliVersion, removeRecordedVersion } from './chunk-5BHIBJDA.js';
+import { resolvePackageVersion } from './chunk-RA3O54FC.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { resolvePackageVersion } from './chunk-RA3O54FC.js';
-import { signRunnerRequest, signerFor } from './chunk-Y4OKEFAX.js';
 
 createRequire(import.meta.url);
 
@@ -122,10 +123,25 @@ function withCliUserAgent(base, userAgent = () => cliUserAgent()) {
     return base(input, { ...init, headers: withHeader(init?.headers, "user-agent", userAgent()) });
   });
 }
+function recordingCliVersion(base) {
+  return (async (input, init) => {
+    const response = await base(input, init);
+    try {
+      const header = response.headers.get("outerlayer-cli-version");
+      if (header !== null) {
+        if (PLAIN_VERSION.test(header)) recordCliVersion(homeFromEnv(), header);
+      } else if (response.ok && new Headers(input instanceof Request ? input.headers : init?.headers).get("authorization")?.startsWith("Bearer ")) {
+        removeRecordedVersion(homeFromEnv());
+      }
+    } catch {
+    }
+    return response;
+  });
+}
 function globalFetch(input, init) {
   return globalThis.fetch(input, init);
 }
-var cliFetch = withCliUserAgent(globalFetch);
+var cliFetch = recordingCliVersion(withCliUserAgent(globalFetch));
 var defaultFetch = signingFetch(cliFetch);
 
 export { cliFetch, defaultFetch, resolveGatewayCredentials, signingFetchFor, unauthorizedMessage };

package/dist/{chunk-QKIQ2R7F.js → chunk-ATJOFXTE.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { launcherPath, writeLauncher, LauncherWriteError, pathNotes } from './chunk-QHH4OSD4.js';
-import { currentVersion, currentLink, isInLayout, packageRootIn, versionDir, switchCurrent, execStartLine } from './chunk-MATUHHN4.js';
+import { launcherPath, writeLauncher, LauncherWriteError, pathNotes } from './chunk-CTYSTE5C.js';
+import { currentVersion, currentLink, isInLayout, packageRootIn, versionDir, switchCurrent, execStartLine } from './chunk-GUXWQIEY.js';
 import { compareVersions } from './chunk-TQMI335S.js';
-import { RUNNER_DIR_MODE } from './chunk-RHAGBUL5.js';
+import { RUNNER_DIR_MODE } from './chunk-5K3KB4YR.js';
 import { realpathSync, readFileSync, mkdirSync, rmSync, cpSync, existsSync } from 'fs';
 import { dirname, sep, join } from 'path';
 

package/dist/chunk-CDDED64E.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+
+createRequire(import.meta.url);
+
+// src/maintained-line.ts
+var MAINTAINED_SKILLS = ["outerlayer-evidence", "outerlayer-amend", "outerlayer-findings", "outerlayer-cli", "outerlayer-build"];
+var MAINTAINED_LINE_VERSION = /^<!-- maintained by OuterLayer (\S+?)\. /m;
+function maintainedLineVersion(text) {
+  return MAINTAINED_LINE_VERSION.exec(text)?.[1];
+}
+
+export { MAINTAINED_SKILLS, maintainedLineVersion };

package/dist/{chunk-QHH4OSD4.js → chunk-CTYSTE5C.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { currentLink } from './chunk-MATUHHN4.js';
+import { currentLink } from './chunk-GUXWQIEY.js';
 import { readFileSync, statSync, chmodSync, mkdirSync, writeFileSync, renameSync, rmSync, existsSync, lstatSync, accessSync, constants, realpathSync } from 'fs';
 import { randomBytes } from 'crypto';
 import { join, dirname, delimiter, resolve } from 'path';

package/dist/{chunk-DJHNEGNM.js → chunk-DKWQMPSL.js}

@@ -3,6 +3,8 @@ import { createRequire } from 'node:module';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
 import { CONTROL_PLANE_DIR_VARIABLE } from './chunk-HCVLP7XA.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
+import { updateNoticeContext, staleMachineCopiesContext } from './chunk-5BHIBJDA.js';
+import { resolvePackageVersion } from './chunk-RA3O54FC.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { deadHooksState, huskyPrepareScript, preparePackageManagerCommand } from './chunk-TUSYOL2O.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
@@ -682,7 +684,7 @@ async function missingControlPlane(cwd, sessionId, home, env) {
     cleanupEarlierCopies(dirs);
   }
   if (!contextPossiblyGoverned(cwd, home)) return void 0;
-  const { governanceOf } = await import('./control-plane-launch-DBQA3KLJ.js');
+  const { governanceOf } = await import('./control-plane-launch-FZMD4MXX.js');
   if (await governanceOf({ cwd, env, home }) !== "governed") return void 0;
   recordMissingContext(dirs, sessionId, home);
   const launcher = `${cliInvocation()} claude`;
@@ -754,6 +756,8 @@ async function runHookFast(event, home = homeFromEnv(), read = readStdin, env =
     let hookErrorsMessage;
     let renewalHookMessage;
     let machineSkillsMessage;
+    let updateNoticeMessage;
+    let staleCopiesMessage;
     if (resolvedEvent === "SessionStart") {
       const hookErrorsBytes = fileSizeBytes(join(dir, "hook-errors.log"));
       const hookErrorsSeen = hookErrorsSeenBytes(home);
@@ -776,6 +780,18 @@ async function runHookFast(event, home = homeFromEnv(), read = readStdin, env =
       } catch (err) {
         logHookError(home, err);
       }
+      try {
+        updateNoticeMessage = updateNoticeContext(home, resolvePackageVersion(), env) ?? void 0;
+      } catch (err) {
+        logHookError(home, err);
+      }
+      if (machineSkillsMessage === void 0) {
+        try {
+          staleCopiesMessage = staleMachineCopiesContext(home, resolvePackageVersion()) ?? void 0;
+        } catch (err) {
+          logHookError(home, err);
+        }
+      }
       try {
         deadHooksMessage = deadHooksAutoHealContext(sessionCwd, home) ?? void 0;
       } catch (err) {
@@ -800,7 +816,7 @@ async function runHookFast(event, home = homeFromEnv(), read = readStdin, env =
       sessionCwd,
       (out) => process.stdout.write(out),
       missingPlane?.person,
-      [missingPlane?.agent, machineSkillsMessage, deadHooksMessage, workLaunchMessage, hookErrorsMessage, renewalHookMessage].filter(
+      [missingPlane?.agent, machineSkillsMessage, staleCopiesMessage, updateNoticeMessage, deadHooksMessage, workLaunchMessage, hookErrorsMessage, renewalHookMessage].filter(
         (s) => s !== void 0
       )
     );

package/dist/{chunk-IMOB4IOI.js → chunk-DQYMQ47E.js}

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MAINTAINED_SKILLS, loadMachineSkillFiles, resolvePackRoot, maintainedLineVersion } from './chunk-7OUOLGUV.js';
-import { homeFromEnv } from './chunk-VNVZDWO3.js';
+import { loadMachineSkillFiles, resolvePackRoot } from './chunk-JGML2VUN.js';
+import { MAINTAINED_SKILLS, maintainedLineVersion } from './chunk-CDDED64E.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
+import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { randomBytes } from 'crypto';
 import { existsSync, symlinkSync, realpathSync, lstatSync, readFileSync, mkdirSync, rmSync, renameSync, writeFileSync, cpSync } from 'fs';
 import { join, resolve, dirname, relative } from 'path';

package/dist/{chunk-YETTWTAY.js → chunk-E7R2GIAW.js}

@@ -48,10 +48,10 @@ async function fetchProvenance(version, fetchImpl) {
 }
 
 // src/runner/update/npm.ts
-function run(file, args, cwd) {
+function run(file, args, cwd, env) {
   const COMMAND_TIMEOUT_MS = 10 * 6e4;
   return new Promise((resolve) => {
-    const child = spawn(file, args, { cwd, stdio: ["ignore", "pipe", "pipe"], timeout: COMMAND_TIMEOUT_MS });
+    const child = spawn(file, args, { cwd, ...env === void 0 ? {} : { env }, stdio: ["ignore", "pipe", "pipe"], timeout: COMMAND_TIMEOUT_MS });
     let stdout = "";
     let stderr = "";
     child.stdout.on("data", (chunk) => stdout += chunk.toString());
@@ -66,10 +66,10 @@ function npmExecutable(nodePath) {
 }
 function realRunNpm(nodePath) {
   const npm = npmExecutable(nodePath);
-  return (args, cwd) => run(npm, args, cwd);
+  return (args, cwd, env) => run(npm, args, cwd, env);
 }
 function realRunNode(nodePath) {
-  return (args, cwd) => run(nodePath, args, cwd);
+  return (args, cwd, env) => run(nodePath, args, cwd, env);
 }
 function npmSupportsProvenance(version) {
   const match = /^(\d+)\.(\d+)/.exec(version.trim());

package/dist/{chunk-GFUE5TKO.js → chunk-F4FA3ZUT.js}

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_UNIT_NAME } from './chunk-7AQ5AM7U.js';
-import { parseRunnerEnv } from './chunk-STSLH5EJ.js';
-import { RUNNER_FILE_MODE } from './chunk-RHAGBUL5.js';
+import { DEFAULT_UNIT_NAME } from './chunk-MQHTM4YJ.js';
+import { RUNNER_FILE_MODE } from './chunk-5K3KB4YR.js';
+import { claudeEnvPath, withoutCredentialLines } from './chunk-HXAEQPZR.js';
+import { parseRunnerEnv } from './chunk-XD4ZCMA4.js';
 import { existsSync, readFileSync, writeFileSync, renameSync, rmSync } from 'fs';
 import { join, dirname } from 'path';
 
@@ -20,7 +21,6 @@ var CLAUDE_CREDENTIAL_NAMES = ["CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_API_KEY"];
 var RunnerEnvError = class extends Error {
 };
 var CREDENTIAL_SHAPE = /^sk-ant-(oat|api)[0-9]*-[A-Za-z0-9_-]+$/;
-var SETS = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=/;
 function runnerEnvPath(configPath) {
   return join(dirname(configPath), "runner.env");
 }
@@ -35,18 +35,15 @@ function credentialFromStdin(text) {
   }
   return { variable: kind === "oat" ? "CLAUDE_CODE_OAUTH_TOKEN" : "ANTHROPIC_API_KEY", value };
 }
-function hasStoredCredential(configPath) {
-  const path = runnerEnvPath(configPath);
+function setsCredential(path) {
   if (!existsSync(path)) return false;
   const env = parseRunnerEnv(readFileSync(path, "utf8"));
   return CLAUDE_CREDENTIAL_NAMES.some((name) => env[name]);
 }
-function storeClaudeCredential(configPath, credential) {
-  const path = runnerEnvPath(configPath);
-  const kept = existsSync(path) ? readFileSync(path, "utf8").split("\n").filter((line) => !CLAUDE_CREDENTIAL_NAMES.includes(SETS.exec(line)?.[1] ?? "")) : [];
-  while (kept[kept.length - 1] === "") kept.pop();
-  const text = `${[...kept, `${credential.variable}=${credential.value}`].join("\n")}
-`;
+function hasStoredCredential(configPath) {
+  return setsCredential(claudeEnvPath(configPath)) || setsCredential(runnerEnvPath(configPath));
+}
+function replaceFile(path, text) {
   const temporary = `${path}.${process.pid}.tmp`;
   try {
     writeFileSync(temporary, text, { mode: RUNNER_FILE_MODE, flag: "wx" });
@@ -55,11 +52,24 @@ function storeClaudeCredential(configPath, credential) {
     rmSync(temporary, { force: true });
     throw err;
   }
+}
+function storeClaudeCredential(configPath, credential) {
+  const path = claudeEnvPath(configPath);
+  replaceFile(path, `${credential.variable}=${credential.value}
+`);
+  const runnerPath = runnerEnvPath(configPath);
+  if (existsSync(runnerPath)) {
+    const dropped = withoutCredentialLines(readFileSync(runnerPath, "utf8"));
+    if (dropped !== void 0) replaceFile(runnerPath, dropped);
+  }
   return path;
 }
 function restartForCredential(state, unitName = DEFAULT_UNIT_NAME) {
-  if (state !== "pending-restart" && state !== "differs") return void 0;
-  return `The service ${unitName} reads runner.env only when it starts. Restart it so it uses the stored credential: sudo systemctl restart ${unitName}`;
+  if (state === "differs") {
+    return `The service ${unitName} was not written by runner init, so it may not load claude.env, the one file that now holds the credential. Add EnvironmentFile=-<config directory>/claude.env to it, or run runner install --service --replace. Then restart it: sudo systemctl restart ${unitName}`;
+  }
+  if (state !== "pending-restart") return void 0;
+  return `The service ${unitName} loads claude.env only when it starts. Restart it so it uses the stored credential: sudo systemctl restart ${unitName}`;
 }
 
 export { AGENT_COMMANDS, RunnerEnvError, credentialFromStdin, hasStoredCredential, isAgentName, restartForCredential, storeClaudeCredential };

package/dist/{chunk-6TRNCUM4.js → chunk-FGF52V4V.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { rewriteControlPlanePaths, rewriteAgentsFilePaths, SUPPORTED_CONTROL_PLANE_LAYOUT, rewriteHookCommand } from './chunk-HCVLP7XA.js';
-import { MAINTAINED_SKILLS } from './chunk-7OUOLGUV.js';
+import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { existsSync, mkdirSync, copyFileSync, lstatSync, readdirSync, writeFileSync, readFileSync } from 'fs';
 import { join, dirname } from 'path';