@outerlayer/cli 0.33.0-next.20261022195547 → 0.33.0-next.20261023002325

package/dist/chunk-I5LGKZ4M.js

@@ -1,107 +0,0 @@
-#!/usr/bin/env node
-import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-D3HRAPNF.js';
-import { runnerImageVersion } from './chunk-SK4TWCN3.js';
-import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-TGHBOXKJ.js';
-import { spawnSync } from 'child_process';
-import { existsSync, accessSync, constants, statSync, readFileSync } from 'fs';
-
-createRequire(import.meta.url);
-function groupName(gid) {
-  try {
-    for (const line of readFileSync("/etc/group", "utf8").split("\n")) {
-      const [name, , id] = line.split(":");
-      if (name !== void 0 && Number(id) === gid) return name;
-    }
-  } catch {
-  }
-  return String(gid);
-}
-function detectKvm(device) {
-  if (!existsSync(device)) return { state: "absent" };
-  try {
-    accessSync(device, constants.R_OK | constants.W_OK);
-    return { state: "usable" };
-  } catch {
-    return { state: "no-permission", group: groupName(statSync(device).gid) };
-  }
-}
-function readProcVersion() {
-  try {
-    return readFileSync("/proc/version", "utf8");
-  } catch {
-    return void 0;
-  }
-}
-function docker(args) {
-  const result = spawnSync("docker", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 15e3 });
-  const out = result.status === 0 ? result.stdout.trim() : "";
-  return out === "" ? void 0 : out;
-}
-function dockerFailure() {
-  const result = spawnSync("docker", ["version", "--format", "{{.Server.Version}}"], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 15e3 });
-  if (result.error?.code === "ENOENT") return void 0;
-  return /permission denied/i.test(result.stderr ?? "") ? "permission" : "daemon";
-}
-function platformOf(probes) {
-  const platform = probes.platform ?? process.platform;
-  if (platform === "win32") return "windows";
-  if (platform === "darwin") return "darwin";
-  if (platform !== "linux") return "other";
-  return /microsoft/i.test((probes.procVersion ?? readProcVersion)() ?? "") ? "wsl2" : "linux";
-}
-function detectMachine(probes = {}) {
-  const platform = platformOf(probes);
-  const kvm = (probes.kvm ?? (() => detectKvm(probes.kvmDevice ?? "/dev/kvm")))();
-  const arch = firecrackerArch(probes.nodeArch ?? process.arch);
-  const inImage = runnerImageVersion(probes.env ?? process.env) !== void 0 ? { inImage: true } : {};
-  const version = (probes.dockerVersion ?? (() => docker(["version", "--format", "{{.Server.Version}}"])))();
-  if (version === void 0) {
-    const failure = (probes.dockerFailure ?? (probes.dockerVersion === void 0 ? dockerFailure : () => void 0))();
-    return { platform, ...inImage, docker: failure === void 0 ? { kind: "none" } : { kind: "unreachable", reason: failure }, kvm, arch };
-  }
-  const system = (probes.dockerOperatingSystem ?? (() => docker(["info", "--format", "{{.OperatingSystem}}"])))() ?? "";
-  return { platform, ...inImage, docker: { kind: /docker desktop/i.test(system) ? "desktop" : "engine", version }, kvm, arch };
-}
-function supportsContainerBuilds(machine) {
-  if (machine.platform !== "linux" && machine.platform !== "wsl2") return false;
-  const { kind, version } = machine.docker;
-  if (kind !== "engine" && !(kind === "desktop" && machine.inImage === true)) return false;
-  return Number.parseInt(version ?? "", 10) >= MIN_ENGINE_MAJOR;
-}
-function supportsMicroVmBuilds(machine) {
-  return machine.platform === "linux" && machine.kvm?.state === "usable" && supportsContainerBuilds(machine) && microVmAssetsPinned(machine);
-}
-function microVmArchSupported(machine) {
-  return MICROVM_ARCHES.includes(machine.arch ?? "");
-}
-function microVmAssetsPinned(machine) {
-  return microVmArchSupported(machine) && guestAssetsPinned(machine.arch);
-}
-function reachDockerStep(machine) {
-  if (machine.docker.kind !== "unreachable") return void 0;
-  return machine.docker.reason === "permission" ? "give this user access to Docker Engine's socket (add it to the docker group, then log in again)" : "start Docker Engine's daemon (for example, sudo systemctl start docker)";
-}
-function describeMachineDocker(machine) {
-  const { kind, version, reason } = machine.docker;
-  const where = machine.platform === "windows" ? "Windows" : machine.platform === "darwin" ? "macOS" : machine.platform === "wsl2" ? "WSL2" : "Linux";
-  if (kind === "desktop") {
-    const engine = version === void 0 ? "" : ` with engine ${version}`;
-    if (machine.inImage === true && (machine.platform === "linux" || machine.platform === "wsl2")) {
-      const major = Number.parseInt(version ?? "", 10);
-      if (Number.isNaN(major)) return `Docker Desktop${engine}, whose engine version is not readable`;
-      if (major < MIN_ENGINE_MAJOR) return `Docker Desktop${engine}, older than the ${MIN_ENGINE_MAJOR} that container builds need`;
-      return `Docker Desktop${engine}`;
-    }
-    return `Docker Desktop${engine} on ${where}, which a runner accepts only in the runner image`;
-  }
-  if (kind === "none") return `no Docker on ${where}`;
-  if (kind === "unreachable") {
-    const problem = reason === "permission" ? "this user has no permission on its socket" : "its daemon is not running";
-    return `a docker command on ${where} that cannot reach Docker Engine (${problem})`;
-  }
-  if (machine.platform !== "linux" && machine.platform !== "wsl2") return `Docker Engine ${version ?? ""} on ${where}, which cannot isolate a build`.replace("  ", " ");
-  return `Docker Engine ${version ?? "of no known version"}, older than the ${MIN_ENGINE_MAJOR} that container builds need`;
-}
-
-export { describeMachineDocker, detectMachine, microVmArchSupported, microVmAssetsPinned, reachDockerStep, supportsContainerBuilds, supportsMicroVmBuilds };

package/dist/chunk-UXYLWVTQ.js

@@ -1,43 +0,0 @@
-#!/usr/bin/env node
-import { createRequire } from 'node:module';
-
-createRequire(import.meta.url);
-
-// src/runner/allow-hosts.ts
-var MAX_ALLOW_HOSTS = 500;
-var LABEL = /^(?!-)[a-z0-9-]{1,63}(?<!-)$/;
-var IPV4 = /^(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)$/;
-function isAddress(text) {
-  if (IPV4.test(text)) return true;
-  try {
-    new URL(`http://[${text}]/`);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function isHostName(text) {
-  const labels = text.split(".");
-  return text.length <= 253 && labels.every((label) => LABEL.test(label)) && !/^\d+$/.test(labels.at(-1));
-}
-function allowHostProblem(entry) {
-  if (typeof entry !== "string") return "is not a string";
-  const text = entry.toLowerCase();
-  if (isAddress(text)) return void 0;
-  if (text.startsWith("*.")) {
-    const domain = text.slice(2);
-    if (!isHostName(domain)) return "is not a host name after *.";
-    if (!domain.includes(".")) return "is too broad: a pattern needs a domain with at least two labels after *.";
-    return void 0;
-  }
-  return isHostName(text) ? void 0 : "is not a host name, a *. pattern or an IP address";
-}
-function hostAllowed(host, allowHosts) {
-  const name = host.toLowerCase().replace(/\.$/, "");
-  return allowHosts.some((entry) => {
-    const pattern = entry.toLowerCase();
-    return pattern.startsWith("*.") ? name.endsWith(pattern.slice(1)) : name === pattern;
-  });
-}
-
-export { MAX_ALLOW_HOSTS, allowHostProblem, hostAllowed };

package/dist/chunk-WBZJWVT2.js

@@ -1,146 +0,0 @@
-#!/usr/bin/env node
-import { createRequire } from 'node:module';
-import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-CUBIZBMF.js';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-I5LGKZ4M.js';
-import { MIN_ENGINE_MAJOR } from './chunk-D3HRAPNF.js';
-import { runnerCredentialProblem } from './chunk-5BNWAIHN.js';
-import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-AGZNCIIJ.js';
-import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
-import { dirname } from 'path';
-
-createRequire(import.meta.url);
-var RunnerInitError = class extends Error {
-};
-var UNMARKED_PLACEHOLDER_COMMAND = "echo 'edit runner.commands in this config file: it must start your agent on item $OUTERLAYER_WORK' >&2; exit 1";
-var PLACEHOLDER_MARKER = "outerlayer-placeholder";
-var PLACEHOLDER_COMMAND = `${UNMARKED_PLACEHOLDER_COMMAND} # ${PLACEHOLDER_MARKER}`;
-function isolationNote(machine) {
-  const has = describeMachineDocker(machine);
-  const reach = reachDockerStep(machine);
-  const needs = reach !== void 0 ? `Isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later: ${reach}, then set both hooks to builtin:container.` : machine.platform === "windows" ? `Isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later inside WSL2: install it there, run the runner from a WSL2 shell, and set both hooks to builtin:container.` : `Isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later on Linux or WSL2. Once it is installed, set both hooks to builtin:container.`;
-  return `This machine has ${has}, so builds run as processes under this user (isolation: shared-user), through the tunnel. ${needs}`;
-}
-function processRefusal(machine) {
-  const reach = reachDockerStep(machine);
-  const needs = machine.platform === "darwin" ? "Isolated builds on a Mac run in the runner image on Docker Desktop (https://docs.outerlayer.ai/run-the-runner-in-a-container) or in a Linux VM: run this again with --vm." : reach !== void 0 ? `Isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later: ${reach}, then run this again.` : machine.platform === "windows" ? `Isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later inside WSL2: install it there, then run this again from a WSL2 shell.` : `Isolated builds need Docker Engine ${MIN_ENGINE_MAJOR} or later on Linux or WSL2: install it, then run this again.`;
-  return `This machine has ${describeMachineDocker(machine)}, so it cannot isolate a build. ${needs} To run builds as processes under this user instead, where a build can read this user's files and the runner's Claude credential, run this again with --allow-process-builds.`;
-}
-function isPlaceholderCommand(command) {
-  return command === UNMARKED_PLACEHOLDER_COMMAND || command.includes(PLACEHOLDER_MARKER);
-}
-function readConfigObject(configPath) {
-  if (!existsSync(configPath)) {
-    throw new RunnerInitError(
-      `${configPath}: no config file. Run \`outerlayer login\` first, then this command.`
-    );
-  }
-  try {
-    return JSON.parse(readFileSync(configPath, "utf8"));
-  } catch (err) {
-    throw new RunnerInitError(`${configPath}: not valid JSON (${err instanceof Error ? err.message : String(err)})`);
-  }
-}
-function handedCredential(value) {
-  if (value === void 0) return void 0;
-  if (typeof value !== "string") throw new RunnerInitError("the config on stdin carries a claudeCredential that is not text.");
-  return credentialFromStdin(value);
-}
-function handedAgent(value) {
-  if (value === void 0) return void 0;
-  if (!isAgentName(value)) throw new RunnerInitError("the config on stdin names an agent runner init does not know.");
-  return value;
-}
-function parseStdinConfig(configPath, text) {
-  if (existsSync(configPath)) {
-    throw new RunnerInitError(
-      `${configPath}: a config file is already here, so the runner key in it is not replaced. Remove it, or delete the VM and start again.`
-    );
-  }
-  let config;
-  try {
-    config = JSON.parse(text);
-  } catch (err) {
-    throw new RunnerInitError(`the config on stdin is not valid JSON (${err instanceof Error ? err.message : String(err)})`);
-  }
-  const problem = runnerCredentialProblem(config);
-  if (problem !== void 0) throw new RunnerInitError(`the config on stdin: ${problem.field} ${problem.reason}.`);
-  const carried = config.runner;
-  const credential = handedCredential(config.claudeCredential);
-  const agent = handedAgent(config.agent);
-  delete config.runner;
-  delete config.claudeCredential;
-  delete config.agent;
-  return { config, carried, credential, agent };
-}
-function runRunnerInit(configPath, opts = {}) {
-  return writeRunnerInit(prepareRunnerInit(configPath, opts));
-}
-function prepareRunnerInit(configPath, opts = {}) {
-  let config;
-  let carried;
-  let credential = opts.credential;
-  let agent = opts.agent;
-  let needsKey = false;
-  if (opts.configFromStdin === void 0) {
-    config = opts.keyFromLogin === true && !existsSync(configPath) ? {} : readConfigObject(configPath);
-    if (config.runner !== void 0) {
-      throw new RunnerInitError(`${configPath}: a runner block is already here. Edit it, or remove it and run this again.`);
-    }
-    needsKey = opts.keyFromLogin === true && config.apiKey === void 0;
-    const problem = needsKey ? void 0 : runnerCredentialProblem(config);
-    if (problem !== void 0) throw new RunnerInitError(`${configPath}: ${problem.field} ${problem.reason}.`);
-  } else {
-    const handed = parseStdinConfig(configPath, opts.configFromStdin);
-    ({ config, carried } = handed);
-    credential ??= handed.credential;
-    agent ??= handed.agent;
-  }
-  const machine = opts.machine ?? detectMachine();
-  if (opts.requireContainer === true && !supportsContainerBuilds(machine)) {
-    const fix = reachDockerStep(machine) ?? `install Docker Engine ${MIN_ENGINE_MAJOR} or later in the VM`;
-    throw new RunnerInitError(`the VM has ${describeMachineDocker(machine)}, but the runner in it needs container builds: ${fix}, then run this again.`);
-  }
-  const hooks = opts.requireContainer !== true && supportsMicroVmBuilds(machine) ? "builtin:vm" : supportsContainerBuilds(machine) ? "builtin:container" : "builtin:process";
-  if (hooks === "builtin:process" && opts.allowProcess !== true) throw new RunnerInitError(processRefusal(machine));
-  if (agent === "claude" && credential === void 0 && opts.credentialInEnvironment !== true && !hasStoredCredential(configPath)) {
-    throw new RunnerInitError(
-      "--agent claude needs Claude's credential, and none was piped on stdin or is in the claude.env beside the config. Pipe a token from `claude setup-token`, or an Anthropic API key: printf '%s' \"$CLAUDE_CODE_OAUTH_TOKEN\" | outerlayer runner init --agent claude"
-    );
-  }
-  return { configPath, config, carried, credential, agent, machine, hooks, needsKey, host: opts.host };
-}
-function writeRunnerInit(prepared, runnerKey) {
-  const { configPath, config, carried, credential, agent, machine, hooks, host } = prepared;
-  if (prepared.needsKey && runnerKey === void 0) {
-    throw new RunnerInitError(`${configPath}: apiKey is missing, and no runner key was pasted.`);
-  }
-  if (runnerKey !== void 0) Object.assign(config, { url: runnerKey.url, apiKey: runnerKey.apiKey, appId: runnerKey.appId });
-  mkdirSync(runnerDir(configPath), { recursive: true, mode: RUNNER_DIR_MODE });
-  config.runner = {
-    queues: ["implement", "amend"],
-    concurrency: 1,
-    pollSeconds: 60,
-    timeLimitMinutes: 480,
-    idleLimitMinutes: 30,
-    // A placeholder that fails loudly. A command line that quietly did
-    // nothing would claim an item, run, exit zero, and record `ok` —
-    // every attempt reading as a success that produced nothing.
-    commands: {
-      implement: PLACEHOLDER_COMMAND,
-      amend: PLACEHOLDER_COMMAND
-    },
-    ...carried,
-    ...host === void 0 ? {} : { name: host },
-    // The agent was named on this command line, so its commands win over any the hand-off carried.
-    ...agent === void 0 ? {} : { commands: { ...AGENT_COMMANDS[agent] } },
-    hooks: { provision: hooks, cleanup: hooks }
-  };
-  if (host !== void 0) delete config.runner.host;
-  mkdirSync(dirname(configPath), { recursive: true });
-  const stored = credential === void 0 ? void 0 : { variable: credential.variable, path: storeClaudeCredential(configPath, credential) };
-  writeFileSync(configPath, `${JSON.stringify(config, null, 2)}
-`, { mode: RUNNER_FILE_MODE });
-  return { configPath, hooks, ...hooks === "builtin:process" ? { note: isolationNote(machine) } : {}, credential: stored };
-}
-
-export { PLACEHOLDER_MARKER, RunnerInitError, isPlaceholderCommand, prepareRunnerInit, readConfigObject, runRunnerInit, writeRunnerInit };