@outerlayer/cli 0.33.0-next.20261022195547 → 0.33.0-next.20261023002325

package/README.md

@@ -404,6 +404,10 @@ content:
   The item is `--item`, or the item the recorded session was launched for.
   `findings result` sends the problem id, `fixed` or `not_fixed`, your note and
   the session id. Nothing from the session itself is sent.
+- **`outerlayer context show`** reads which instruction files and skills a
+  repository's builds receive (`GET /v1/context/delivery?repo=<owner>/<name>`).
+  It sends the repository name with your login or factory key. The answer holds
+  paths and skill names, never file contents.
 - **`outerlayer emit criteria <file>`** sends the acceptance criteria of a work
   item as one list (`POST /v1/criteria`): each criterion's id, text and
   declared proof kind, from the JSON file you name. The anchoring is the same
@@ -474,6 +478,7 @@ before it gives up.
 | `outerlayer init` | Connect this repository (`outerlayer connect`), install the capture hooks and the status-line segment, and run `doctor`. It never signs in: without a login it skips the connect step and says to run `outerlayer login`. `--local` installs the hooks only, with no network call. `--json` prints one document naming each step's outcome. Run through `npx`, it copies the CLI to `~/.outerlayer/cli` and points the hooks at that copy, so they survive npm clearing its cache; `npx @outerlayer/cli@latest init --local` upgrades it. From any other install, the hooks run that install. Claude Code deletes transcripts after ~30 days; run `outerlayer daemon` separately to mirror them first — `init` does not start it for you. |
 | `outerlayer daemon` | Run the copy-out daemon in the foreground (`--once` for a single sweep, which uploads nothing). Once cloud credentials exist, it also streams a launched session's new turns as they land — see Privacy, above. `outerlayer watch` is the former name and still works, with a warning. |
 | `outerlayer doctor` | Check the installation: hooks, status-line freshness, sync health and, with a factory key, the GitHub App access builds need. `--json` prints the checks and a summary for scripts. |
+| `outerlayer context show [--repo <owner/name>] [--json]` | Print what a repository's builds receive: the repository that governs it (or that it governs itself), the commit a build gets, the instruction files and the skill names. It warns when the skills include no `build`. `--repo` defaults to the checkout's own repository. It needs only the context-read permission. |
 | `outerlayer context emit [--check]` | Compile `.outerlayer/` into each configured target tool's native files (targets come from `.outerlayer/config.json`). `--check` computes outputs and diffs against disk without writing (CI mode). Bare `outerlayer emit` with no name still compiles, with a deprecation warning. |
 | `outerlayer hooks wrap` / `outerlayer hooks unwrap` | Auto-wrap (or undo wrapping) `PreToolUse`/`PostToolUse` hooks for execution evidence — one spawn per firing. |
 | `outerlayer emit artifact <file> --caption <text> [--for <criterion-id>] [--pr <n>]` | Upload a proof artifact — screenshot, recording, report, or log — with its caption. Inside a recorded session it spools locally and ships on the next `sync`; otherwise it uploads immediately, anchored to a pull request or the current checkout. `--replaces` retires artifacts an earlier run uploaded. A JUnit XML file bound with `--for` proves a criterion that declares `test` proof; `--test <name[=path:line]>` binds only the named tests. |

package/dist/{agent-setup-RJOVRRHK.js → agent-setup-55ZDEXCS.js}

@@ -1,18 +1,18 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { keepHandWritten, runAgentSetup } from './chunk-35IY5HQY.js';
+export { keepHandWritten, runAgentSetup } from './chunk-SVDOA4W2.js';
 import './chunk-JHTJPQSL.js';
 import './chunk-KT4CN6OU.js';
 import './chunk-DY7Y7UT4.js';
 import './chunk-HJYBWJAS.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-WCELNMXT.js';
+import './chunk-EUVE2EAE.js';
 import './chunk-UIUGTW5C.js';
-import './chunk-WPGBDY73.js';
+import './chunk-6RKD7YZ6.js';
 import './chunk-PJDQPF5N.js';
-import './chunk-AA6LYZC4.js';
-import './chunk-AGZNCIIJ.js';
-import './chunk-BCCI32ME.js';
+import './chunk-SOI6K5DY.js';
+import './chunk-PA6CK6WQ.js';
+import './chunk-BALIE3BA.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-BJ3KTMDH.js';
 import './chunk-G63KT5I5.js';

package/dist/{bridge-BCG2EB7F.js → bridge-NBCXFTT4.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { BRIDGE_ADDRESS, BRIDGE_CIDR, CONTAINER_NO_PROXY, CONTAINER_PROXY, TUNNEL_PORT, dockerClientConfig, startBridgeForward, writeDockerClientConfig } from './chunk-QL3LPZ67.js';
-import './chunk-BCCI32ME.js';
+export { BRIDGE_ADDRESS, BRIDGE_CIDR, CONTAINER_NO_PROXY, CONTAINER_PROXY, TUNNEL_PORT, dockerClientConfig, startBridgeForward, writeDockerClientConfig } from './chunk-6LBSAW6I.js';
+import './chunk-BALIE3BA.js';
 import './chunk-HACGUL52.js';
 import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';

package/dist/{build-GKCVFHF4.js → build-G4GUF6LT.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { KEY_PREFIX, TAG_HOST, buildRepositoryImage, metadataFromLabels, prepareImageBuild, writeRecord } from './chunk-KLXWS5Z7.js';
-import './chunk-DDS2ISML.js';
+export { KEY_PREFIX, TAG_HOST, buildRepositoryImage, metadataFromLabels, prepareImageBuild, writeRecord } from './chunk-JPG43G6Y.js';
+import './chunk-F5UL23I2.js';
 import './chunk-JBJTC3UU.js';
 export { RecipeError } from './chunk-3Z3MPR55.js';
 import './chunk-TGHBOXKJ.js';
-import './chunk-AGZNCIIJ.js';
-import './chunk-BCCI32ME.js';
+import './chunk-PA6CK6WQ.js';
+import './chunk-BALIE3BA.js';
 import './chunk-HACGUL52.js';
 import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';

package/dist/{build-disk-6QAXMA2J.js → build-disk-3GL3KKEB.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { DEFAULT_BUILD_DISK, DOCKER_CACHE_MS, checkDiskFit, realBuildDiskProbe, runDocker, volumeBytes } from './chunk-P5FC7VUO.js';
+export { DEFAULT_BUILD_DISK, DOCKER_CACHE_MS, checkDiskFit, realBuildDiskProbe, runDocker, volumeBytes } from './chunk-XWFSAOC7.js';
 import './chunk-YYYRBYWG.js';
-import './chunk-43PV5KDB.js';
+import './chunk-GFVDC5S3.js';
 import './chunk-3Z3MPR55.js';
 import './chunk-TGHBOXKJ.js';
 import './chunk-YJLHUKYS.js';
 import './chunk-5DNCFOXA.js';
-import './chunk-AA6LYZC4.js';
-import './chunk-AGZNCIIJ.js';
-import './chunk-BCCI32ME.js';
+import './chunk-SOI6K5DY.js';
+import './chunk-PA6CK6WQ.js';
+import './chunk-BALIE3BA.js';
 import './chunk-E6CO3MJE.js';
 import './chunk-HACGUL52.js';
 import './chunk-MESOOLF4.js';

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-22T19:57:46.463Z+671ceda","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-23T00:24:49.363Z+beeb073","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{builder-DPNHJXG3.js → builder-3CUKTVSY.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-43PV5KDB.js';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-GFVDC5S3.js';
 import './chunk-3Z3MPR55.js';
 import './chunk-TGHBOXKJ.js';
 import './chunk-YJLHUKYS.js';
 import './chunk-5DNCFOXA.js';
-import './chunk-AA6LYZC4.js';
-import './chunk-AGZNCIIJ.js';
-import './chunk-BCCI32ME.js';
+import './chunk-SOI6K5DY.js';
+import './chunk-PA6CK6WQ.js';
+import './chunk-BALIE3BA.js';
 import './chunk-E6CO3MJE.js';
 import './chunk-HACGUL52.js';
 import './chunk-MESOOLF4.js';

package/dist/{check-64UX323V.js → check-64FD5G3X.js}

@@ -1,64 +1,62 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-H7A3IQH5.js';
-import './chunk-L6JFFP3Q.js';
+import { probeCredentials } from './chunk-CANYZTD5.js';
+import './chunk-DGI66PGY.js';
 import './chunk-ZVB57WI6.js';
-import './chunk-UOFBHIOZ.js';
+import './chunk-57L2YAJA.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-E7R2GIAW.js';
-import './chunk-6C2YWM6N.js';
-import './chunk-YKYCE4HY.js';
-import './chunk-JEKENLLA.js';
-import './chunk-W5DOK7BL.js';
-import './chunk-QL3LPZ67.js';
+import './chunk-OOCAF3ID.js';
+import './chunk-MZYOUIY5.js';
+import './chunk-GH246BGV.js';
+import './chunk-HVRQQOMH.js';
+import './chunk-6LBSAW6I.js';
 import './chunk-I3LTIAOR.js';
-import './chunk-QDMMW5PC.js';
-import './chunk-3MXPS7ED.js';
-import './chunk-DETKDTNL.js';
+import './chunk-Q2CMEQV7.js';
+import './chunk-2N67C6IV.js';
+import './chunk-AU346ENF.js';
 import './chunk-ESVW4MJY.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, managedProblems, managedFactsOf, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-DNKUSXQU.js';
-import './chunk-OWDSO3PE.js';
+import { managedProblems, managedFactsOf } from './chunk-QFQC5K4J.js';
+import './chunk-NBZ7XBT6.js';
 import './chunk-TBT347UY.js';
-import './chunk-WBZJWVT2.js';
-import './chunk-CUBIZBMF.js';
-import './chunk-I5LGKZ4M.js';
-import { probeHelper, HELPER_ENV, helperSocketPath } from './chunk-D3HRAPNF.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, probeHelper, HELPER_ENV, helperSocketPath, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-JRZCRIEO.js';
 import './chunk-2PGI6RDE.js';
-import './chunk-KLXWS5Z7.js';
-import './chunk-DDS2ISML.js';
+import './chunk-YERR22SY.js';
+import './chunk-JPG43G6Y.js';
+import './chunk-F5UL23I2.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-6NWS455T.js';
-import './chunk-LWTBE5J6.js';
-import './chunk-RBJG5MM4.js';
-import './chunk-SK4TWCN3.js';
+import './chunk-5THSC6BD.js';
+import './chunk-L26V6ILJ.js';
+import './chunk-T5REPMNL.js';
+import './chunk-MZBQTVFG.js';
 import './chunk-TQMI335S.js';
-import { DEFAULT_UNIT_NAME } from './chunk-ZRRUWNJS.js';
-import './chunk-P5FC7VUO.js';
+import { DEFAULT_UNIT_NAME } from './chunk-LYE3KB6L.js';
+import './chunk-XWFSAOC7.js';
 import './chunk-YYYRBYWG.js';
-import './chunk-43PV5KDB.js';
+import './chunk-GFVDC5S3.js';
 import './chunk-3Z3MPR55.js';
 import './chunk-TGHBOXKJ.js';
-import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-5BNWAIHN.js';
-import './chunk-UXYLWVTQ.js';
+import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-3DCB3GOV.js';
 import './chunk-YJLHUKYS.js';
-import './chunk-CMKY36NV.js';
-import './chunk-2QT4JUW3.js';
-import './chunk-ZQOSIMKU.js';
+import './chunk-VT4TTJPG.js';
+import './chunk-IP7BIBXJ.js';
+import './chunk-B2JURP6A.js';
+import './chunk-2WMZPJVE.js';
 import './chunk-EWVYQLD3.js';
 import './chunk-5DNCFOXA.js';
 import './chunk-HJYBWJAS.js';
 import './chunk-NSPRS7WK.js';
 import './chunk-G2JWZDFA.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-WCELNMXT.js';
+import './chunk-EUVE2EAE.js';
 import './chunk-UIUGTW5C.js';
-import './chunk-WPGBDY73.js';
+import './chunk-6RKD7YZ6.js';
 import './chunk-PJDQPF5N.js';
-import './chunk-AA6LYZC4.js';
-import './chunk-AGZNCIIJ.js';
-import { claudeEnvPath } from './chunk-BCCI32ME.js';
-import './chunk-DJWKUQLO.js';
+import './chunk-SOI6K5DY.js';
+import './chunk-PA6CK6WQ.js';
+import { claudeEnvPath } from './chunk-BALIE3BA.js';
+import './chunk-QPWFVE3X.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-2O5KA67H.js';
 import './chunk-BKO6JEZI.js';

package/dist/{chunk-3MXPS7ED.js → chunk-2N67C6IV.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { uploadSpooledSteps } from './chunk-DETKDTNL.js';
+import { uploadSpooledSteps } from './chunk-AU346ENF.js';
 import { LaunchFilter } from './chunk-ESVW4MJY.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
 import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-EWVYQLD3.js';
 import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-5DNCFOXA.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-WPGBDY73.js';
+import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-6RKD7YZ6.js';
 import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-PJDQPF5N.js';
-import { signerFor, signRunnerRequest } from './chunk-AA6LYZC4.js';
-import { writeSyncStatus, spoolDir } from './chunk-DJWKUQLO.js';
+import { signerFor, signRunnerRequest } from './chunk-SOI6K5DY.js';
+import { writeSyncStatus, spoolDir } from './chunk-QPWFVE3X.js';
 import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
 import { hookExecSpoolPath } from './chunk-2O5KA67H.js';
 import { applyReportedCost } from './chunk-BKO6JEZI.js';
@@ -686,6 +686,7 @@ var LiveUploader = class {
     enrichSessionRepo(session);
     destination ??= resolveGatewayCredentials({ home: this.home, env: {}, cwd: session.env.cwd ?? "/" });
     if (!destination.ok) return false;
+    if (destination.kind === "login" && readRepoConnection(session.env.cwd ?? "/") === void 0) return false;
     if (this.build === void 0 && !new RepoFilter(cloudConfig.repos).allows(session.env.gitRepo)) return false;
     const launchSpool = readLaunchSpoolState(this.home);
     if (!launchStatusIsDecisive(launchSpool)) return false;

package/dist/{chunk-ZQOSIMKU.js → chunk-2WMZPJVE.js}

@@ -4,7 +4,7 @@ import { sanitizeTerminal } from './chunk-EWVYQLD3.js';
 import { remoteLookupFailed } from './chunk-5DNCFOXA.js';
 import { isAgentsMdLayout } from './chunk-HJYBWJAS.js';
 import { DEFAULT_DASHBOARD } from './chunk-NSPRS7WK.js';
-import { cliFetch, resolveGatewayCredentials } from './chunk-WPGBDY73.js';
+import { cliFetch, resolveGatewayCredentials } from './chunk-6RKD7YZ6.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { findGitDirs, writeRepoConnection, readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
@@ -150,6 +150,7 @@ var REASON_TEXT = {
   flag: "you passed --factory",
   saved: "already connected",
   linked: "the repository is linked to it",
+  configured: "your config file names it",
   owner: "it owns this repository",
   only: "the only factory you can use",
   prompt: "you chose it"
@@ -237,11 +238,13 @@ async function fetchFactories(fetchImpl, url, token, repository) {
   }
   return { ok: true, factories };
 }
-function selectFactory(factories, saved, repository) {
+function selectFactory(factories, saved, repository, configured) {
   const remembered = saved && factories.find((f) => f.id === saved.appId);
   if (remembered) return { factory: remembered, reason: "saved" };
   const linked = factories.filter((f) => f.linked === true);
   if (linked.length === 1) return { factory: linked[0], reason: "linked" };
+  const named = (linked.length > 0 ? linked : factories).find((f) => f.id === configured);
+  if (named) return { factory: named, reason: "configured" };
   const owners = factories.filter((f) => f.owner);
   if (owners.length === 1) return { factory: owners[0], reason: "owner" };
   if (factories.length === 1) return { factory: factories[0], reason: "only" };
@@ -271,7 +274,7 @@ async function choose(flags, deps, factories, saved, repository) {
 ${listText(factories, repository)}`;
     return result(1, "failed", `--factory ${flags.factory} names no factory you can use`, message);
   }
-  const decided = selectFactory(factories, saved, repository);
+  const decided = selectFactory(factories, saved, repository, readCloudConfig(deps.home).appId);
   if (decided.factory) return { factory: decided.factory, reason: decided.reason };
   const linked = factories.filter((f) => f.linked === true);
   if (!deps.isTerminal) {

package/dist/{chunk-5BNWAIHN.js → chunk-3DCB3GOV.js}

@@ -1,14 +1,52 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MAX_ALLOW_HOSTS, allowHostProblem } from './chunk-UXYLWVTQ.js';
 import { parseSize } from './chunk-YJLHUKYS.js';
-import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-BCCI32ME.js';
+import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-BALIE3BA.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { existsSync, statSync, accessSync, constants, readFileSync } from 'fs';
 import { hostname } from 'os';
 import { join } from 'path';
 
 createRequire(import.meta.url);
+
+// src/runner/allow-hosts.ts
+var MAX_ALLOW_HOSTS = 500;
+var LABEL = /^(?!-)[a-z0-9-]{1,63}(?<!-)$/;
+var IPV4 = /^(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)$/;
+function isAddress(text) {
+  if (IPV4.test(text)) return true;
+  try {
+    new URL(`http://[${text}]/`);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function isHostName(text) {
+  const labels = text.split(".");
+  return text.length <= 253 && labels.every((label) => LABEL.test(label)) && !/^\d+$/.test(labels.at(-1));
+}
+function allowHostProblem(entry) {
+  if (typeof entry !== "string") return "is not a string";
+  const text = entry.toLowerCase();
+  if (isAddress(text)) return void 0;
+  if (text.startsWith("*.")) {
+    const domain = text.slice(2);
+    if (!isHostName(domain)) return "is not a host name after *.";
+    if (!domain.includes(".")) return "is too broad: a pattern needs a domain with at least two labels after *.";
+    return void 0;
+  }
+  return isHostName(text) ? void 0 : "is not a host name, a *. pattern or an IP address";
+}
+function hostAllowed(host, allowHosts) {
+  const name = host.toLowerCase().replace(/\.$/, "");
+  return allowHosts.some((entry) => {
+    const pattern = entry.toLowerCase();
+    return pattern.startsWith("*.") ? name.endsWith(pattern.slice(1)) : name === pattern;
+  });
+}
+
+// src/runner/config.ts
 var BUILTIN_CONTAINER = "builtin:container";
 var BUILTIN_PROCESS = "builtin:process";
 var BUILTIN_VM = "builtin:vm";
@@ -415,4 +453,4 @@ function resolveBuild(configPath, block) {
   };
 }
 
-export { DEFAULT_CHECK_TIME_LIMIT_MINUTES, DEFAULT_UPDATE_MAX_WAIT_HOURS, RunnerConfigError, builtinKind, checkHooks, defaultRunnerConfigPath, hasRunnerBlock, imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, loadRunnerConfig, resolveBuild, resolveHousekeeping, runnerCredentialProblem, runnerVmOf };
+export { DEFAULT_CHECK_TIME_LIMIT_MINUTES, DEFAULT_UPDATE_MAX_WAIT_HOURS, MAX_ALLOW_HOSTS, RunnerConfigError, allowHostProblem, builtinKind, checkHooks, defaultRunnerConfigPath, hasRunnerBlock, hostAllowed, imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, loadRunnerConfig, resolveBuild, resolveHousekeeping, runnerCredentialProblem, runnerVmOf };

package/dist/{chunk-UOFBHIOZ.js → chunk-57L2YAJA.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-AGZNCIIJ.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-PA6CK6WQ.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-6NWS455T.js → chunk-5THSC6BD.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EXEC_PORT } from './chunk-LWTBE5J6.js';
+import { EXEC_PORT } from './chunk-L26V6ILJ.js';
 import { createConnection } from 'net';
 
 createRequire(import.meta.url);

package/dist/{chunk-QL3LPZ67.js → chunk-6LBSAW6I.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RELAY_PORT, BUILD_HOME } from './chunk-BCCI32ME.js';
+import { RELAY_PORT, BUILD_HOME } from './chunk-BALIE3BA.js';
 import { createServer, connect } from 'net';
 
 createRequire(import.meta.url);

package/dist/{chunk-WPGBDY73.js → chunk-6RKD7YZ6.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readCloudConfigStrict, readCloudConfig, cloudConfigPath } from './chunk-PJDQPF5N.js';
-import { signRunnerRequest, signerFor } from './chunk-AA6LYZC4.js';
+import { signRunnerRequest, signerFor } from './chunk-SOI6K5DY.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
 import { PLAIN_VERSION, recordCliVersion, removeRecordedVersion } from './chunk-5BHIBJDA.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';

package/dist/{chunk-77B36F5K.js → chunk-6Z4SZHV2.js}

@@ -1,12 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { staleBuildRefusal, staleBuildWarning, detectCi } from './chunk-3MXPS7ED.js';
+import { staleBuildRefusal, staleBuildWarning, detectCi } from './chunk-2N67C6IV.js';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
-import { detectActiveSession, autoConnect } from './chunk-2QT4JUW3.js';
+import { detectActiveSession } from './chunk-IP7BIBXJ.js';
+import { autoConnect } from './chunk-B2JURP6A.js';
 import { readEffectiveArtifactSpoolState, localArtifactIds, isArtifactTombstoned, artifactBlobsDir, appendArtifactRecord, artifactsSpoolPath, findPendingArtifactRecord, sanitizeTerminal, appendArtifactTombstone } from './chunk-EWVYQLD3.js';
 import { resolveRepoIdentity } from './chunk-5DNCFOXA.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-WPGBDY73.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-6RKD7YZ6.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { ARTIFACT_MAX_CAPTION_LENGTH, ArtifactCriterionIdSchema, ARTIFACT_MAX_BYTES, ARTIFACT_MAX_FILENAME_LENGTH, mediaTypeForArtifactPath, inferArtifactKind, ARTIFACT_MAX_REPLACES_TARGETS, parseTestSelector, parseJunit, bindTests } from './chunk-E6CO3MJE.js';

package/dist/{chunk-DETKDTNL.js → chunk-AU346ENF.js}

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
-import { autoConnect, detectActiveSession } from './chunk-2QT4JUW3.js';
+import { detectActiveSession } from './chunk-IP7BIBXJ.js';
+import { autoConnect } from './chunk-B2JURP6A.js';
 import { acquireSpoolLockAt } from './chunk-EWVYQLD3.js';
 import { resolveRepoIdentity } from './chunk-5DNCFOXA.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-WPGBDY73.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-6RKD7YZ6.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { StepNameSchema, StepBodySchema } from './chunk-E6CO3MJE.js';

package/dist/chunk-B2JURP6A.js

@@ -0,0 +1,41 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-2WMZPJVE.js';
+import { resolveRepoIdentity } from './chunk-5DNCFOXA.js';
+import { resolveGatewayCredentials } from './chunk-6RKD7YZ6.js';
+import { readCloudConfig } from './chunk-PJDQPF5N.js';
+import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
+import { cliInvocation } from './chunk-CRB3POP4.js';
+import { homeFromEnv } from './chunk-VNVZDWO3.js';
+
+createRequire(import.meta.url);
+
+// src/auto-connect.ts
+async function autoConnect(opts) {
+  const env = opts.env ?? process.env;
+  const home = opts.home ?? homeFromEnv(env);
+  const cwd = opts.cwd ?? process.cwd();
+  const resolved = resolveGatewayCredentials({ url: opts.url, apiKey: opts.apiKey, appId: opts.appId, home, env, cwd });
+  if (resolved.ok || resolved.kind !== "login" || !resolved.credential || !resolved.url) return void 0;
+  const dirs = findGitDirs(cwd);
+  const repository = opts.repository ?? resolveRepoIdentity(cwd).gitRepo;
+  if (dirs === void 0 || repository === void 0) return void 0;
+  const listed = await fetchFactories(opts.fetchImpl ?? fetch, resolved.url, resolved.credential, repository);
+  if (!listed.ok || listed.factories.length === 0) return void 0;
+  const chosen = selectFactory(listed.factories, readRepoConnection(cwd), repository, readCloudConfig(home).appId);
+  if (chosen.factory === void 0) {
+    return `you are logged in, but no factory is chosen for this repository, and more than one fits. Run \`${cliInvocation()} connect --factory <org>/<factory>\` with one of:
+${chosen.text}
+Or pass --app-id / set OUTERLAYER_APP_ID.`;
+  }
+  try {
+    saveFactoryConnection(dirs.gitCommonDir, void 0, chosen.factory, /* @__PURE__ */ new Date());
+  } catch {
+    return void 0;
+  }
+  process.stderr.write(`${autoConnectedLine(repository, chosen.factory, chosen.reason)}
+`);
+  return void 0;
+}
+
+export { autoConnect };

package/dist/{chunk-BCCI32ME.js → chunk-BALIE3BA.js}

@@ -318,14 +318,26 @@ async function startDestination(input) {
   const headerName = destination.header.name.toLowerCase();
   const dropped = /* @__PURE__ */ new Set(["host", "authorization", "proxy-authorization", "cookie", "connection", "proxy-connection", "keep-alive", "transfer-encoding", "upgrade", ...input.drop ?? []]);
   const handle = (req, res) => {
+    let finished = false;
+    const finish = (ok) => {
+      if (finished) return;
+      finished = true;
+      input.onFinished?.(destination.name, ok);
+    };
+    res.on("finish", () => finish(true));
+    res.on("close", () => finish(false));
+    const fail = (status, body) => {
+      finish(false);
+      respond(res, status, body);
+    };
     const target = req.url ?? "";
     if (!target.startsWith("/")) {
-      respond(res, 400, "send an origin-form request path\n");
+      fail(400, "send an origin-form request path\n");
       return;
     }
     const expanded = expandHeader(destination.header, hostEnv);
     if ("missing" in expanded) {
-      respond(res, 502, `the destination ${destination.name} cannot be reached: ${expanded.missing} is not set in the runner's environment
+      fail(502, `the destination ${destination.name} cannot be reached: ${expanded.missing} is not set in the runner's environment
 `);
       return;
     }
@@ -351,20 +363,23 @@ async function startDestination(input) {
           res.writeHead(answer.statusCode ?? 502, answer.headers);
           answer.on("error", () => res.destroy());
           answer.on("close", () => {
-            if (!answer.complete) res.destroy();
+            if (!answer.complete) {
+              finish(false);
+              res.destroy();
+            }
           });
           answer.pipe(res);
         }
       );
     } catch {
-      respond(res, 502, `the destination ${destination.name} cannot be reached: its header value was refused
+      fail(502, `the destination ${destination.name} cannot be reached: its header value was refused
 `);
       return;
     }
     input.onUsed?.(destination.name);
     forwarded.setTimeout(UPSTREAM_IDLE_MS, () => forwarded.destroy());
     res.on("close", () => forwarded.destroy());
-    forwarded.on("error", () => respond(res, 502, `the upstream of the destination ${destination.name} could not be reached
+    forwarded.on("error", () => fail(502, `the upstream of the destination ${destination.name} could not be reached
 `));
     req.pipe(forwarded);
   };
@@ -445,9 +460,12 @@ async function startBuildServices(input) {
         ...input.serve === "socket" || streamed ? {} : { port: input.ports?.destinations?.[index] ?? 0 },
         hostEnv: input.hostEnv,
         onUsed: (name) => tunnel.destinationUsed(name),
+        onFinished: (name, ok) => tunnel.routeFinished(name, ok),
         ...input.destinationOptions
       });
       servers.push(server);
+      tunnel.routeServed(destination.name);
+      input.log?.(`route ${destination.name} served to the build`);
       const listener = server.listener?.();
       if (listener !== void 0) listeners[`dest-${index}.sock`] = listener;
       targets.set(destinationTarget(index), (stream) => server.acceptStream(stream));
@@ -463,9 +481,12 @@ async function startBuildServices(input) {
         hostEnv: builtIn.hostEnv,
         drop: builtIn.drop,
         onUsed: (name) => tunnel.destinationUsed(name),
+        onFinished: (name, ok) => tunnel.routeFinished(name, ok),
         ...input.destinationOptions
       });
       servers.push(server);
+      tunnel.routeServed(builtIn.destination.name);
+      input.log?.(`route ${builtIn.destination.name} served to the build`);
       const listener = server.listener?.();
       if (listener !== void 0) listeners[builtIn.socket] = listener;
       targets.set(builtIn.destination.name, (stream) => server.acceptStream(stream));
@@ -828,14 +849,22 @@ function withTunnelRecord(environment, record, onlyWhenUsed = false) {
   const base = ignoredProperties === void 0 ? environment : { ...environment, ignoredProperties };
   if (record === void 0) return base;
   const used = record.hosts.length + record.hostsMore + record.refusals.length + record.refusalsMore + (record.destinations?.length ?? 0) > 0;
-  if (onlyWhenUsed && !used) return base;
+  const routed = Object.values(record.routes ?? {}).some((counts) => counts.requests > 0);
+  if (onlyWhenUsed && !used && !routed) return base;
   return {
     ...base,
     ...capHosts(record.hosts, record.hostsMore),
     refusals: record.refusals.slice(0, MAX_HOSTS),
     refusalsMore: Math.max(0, record.refusals.length - MAX_HOSTS) + record.refusalsMore,
-    ...record.destinations === void 0 || record.destinations.length === 0 ? {} : { destinations: record.destinations }
+    ...record.destinations === void 0 || record.destinations.length === 0 ? {} : { destinations: record.destinations },
+    ...routesOf(record.routes)
   };
 }
+var MAX_ROUTES = 32;
+function routesOf(counts) {
+  if (counts === void 0) return {};
+  const routes = Object.entries(counts).sort(([a], [b]) => a < b ? -1 : 1).slice(0, MAX_ROUTES).map(([name, { requests, failures }]) => ({ name, requests, failures: Math.min(failures, requests) }));
+  return routes.length === 0 ? {} : { routes };
+}
 
 export { AGENT_CREDENTIAL_MISSING, BUILD_HOME, BUILT_IN_NAMES, CHECKOUT_DIR, CHECK_ITEMS_FILE, CLAUDE_CREDENTIAL_ID, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_ENV_FILE, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, EVAL_INPUT_DIR, FORWARDED_CLAUDE_CREDENTIAL_VARIABLES, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, MAVEN_NO_PROXY_NOTE, MAVEN_SETTINGS_FILE, MAVEN_SPACE_NOTE, PROXY_WARNING_FLAG, RELAY_PORT, authorEnvironment, buildEnvironment, buildMavenSettingsXml, builtInEnvironment, checkEnvironment, checkoutPath, claudeCredential, claudeCredentialVariablesSet, claudeEnvPath, commitIdentityRecord, containerLocalAddress, credentialLineIn, currentClaudeCredential, destinationEnvironment, headerVariables, heldClaudeCredential, isRefusedInConfig, isReservedVariable, lifecycleWorkdir, mavenArgs, mavenSettingsXml, namesGlobalSettings, parseClaimIdentity, parseClaimedRepositories, parseIsolation, parseUnreachable, primaryOf, proxyEnvironment, readClaudeCredential, removedClaudeCredentialValues, repositoriesOf, repositoryPath, resolveDestinations, sharedUserEnvironment, startBuildServices, takeClaudeCredential, tokenHeader, withGitConfig, withHooksPath, withProxyWarningHidden, withTokenHeader, withTunnelRecord, withoutCredentialLines, writeBuildMavenSettings, writeMavenSettings };

package/dist/{chunk-BY36DVJV.js → chunk-BKADJZ7F.js}

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
-import { detectActiveSession, autoConnect, transcriptPathForSession } from './chunk-2QT4JUW3.js';
+import { detectActiveSession, transcriptPathForSession } from './chunk-IP7BIBXJ.js';
+import { autoConnect } from './chunk-B2JURP6A.js';
 import { resolveRepoIdentity, defaultProjectsDir, findTranscripts, sessionIdFromPath, scrubText } from './chunk-5DNCFOXA.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-WPGBDY73.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-6RKD7YZ6.js';
 import { readLatestProvenanceForSession } from './chunk-ZJSNLVCE.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';