@outerlayer/cli 0.33.0-next.20261022195547 → 0.33.0-next.20261023003700

package/dist/{chunk-3MXPS7ED.js → chunk-2N67C6IV.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { uploadSpooledSteps } from './chunk-DETKDTNL.js';
+import { uploadSpooledSteps } from './chunk-AU346ENF.js';
 import { LaunchFilter } from './chunk-ESVW4MJY.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
 import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-EWVYQLD3.js';
 import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-5DNCFOXA.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-WPGBDY73.js';
+import { cliFetch, resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-6RKD7YZ6.js';
 import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-PJDQPF5N.js';
-import { signerFor, signRunnerRequest } from './chunk-AA6LYZC4.js';
-import { writeSyncStatus, spoolDir } from './chunk-DJWKUQLO.js';
+import { signerFor, signRunnerRequest } from './chunk-SOI6K5DY.js';
+import { writeSyncStatus, spoolDir } from './chunk-QPWFVE3X.js';
 import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
 import { hookExecSpoolPath } from './chunk-2O5KA67H.js';
 import { applyReportedCost } from './chunk-BKO6JEZI.js';
@@ -686,6 +686,7 @@ var LiveUploader = class {
     enrichSessionRepo(session);
     destination ??= resolveGatewayCredentials({ home: this.home, env: {}, cwd: session.env.cwd ?? "/" });
     if (!destination.ok) return false;
+    if (destination.kind === "login" && readRepoConnection(session.env.cwd ?? "/") === void 0) return false;
     if (this.build === void 0 && !new RepoFilter(cloudConfig.repos).allows(session.env.gitRepo)) return false;
     const launchSpool = readLaunchSpoolState(this.home);
     if (!launchStatusIsDecisive(launchSpool)) return false;

package/dist/{chunk-ZQOSIMKU.js → chunk-2WMZPJVE.js}

@@ -4,7 +4,7 @@ import { sanitizeTerminal } from './chunk-EWVYQLD3.js';
 import { remoteLookupFailed } from './chunk-5DNCFOXA.js';
 import { isAgentsMdLayout } from './chunk-HJYBWJAS.js';
 import { DEFAULT_DASHBOARD } from './chunk-NSPRS7WK.js';
-import { cliFetch, resolveGatewayCredentials } from './chunk-WPGBDY73.js';
+import { cliFetch, resolveGatewayCredentials } from './chunk-6RKD7YZ6.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { findGitDirs, writeRepoConnection, readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
@@ -150,6 +150,7 @@ var REASON_TEXT = {
   flag: "you passed --factory",
   saved: "already connected",
   linked: "the repository is linked to it",
+  configured: "your config file names it",
   owner: "it owns this repository",
   only: "the only factory you can use",
   prompt: "you chose it"
@@ -237,11 +238,13 @@ async function fetchFactories(fetchImpl, url, token, repository) {
   }
   return { ok: true, factories };
 }
-function selectFactory(factories, saved, repository) {
+function selectFactory(factories, saved, repository, configured) {
   const remembered = saved && factories.find((f) => f.id === saved.appId);
   if (remembered) return { factory: remembered, reason: "saved" };
   const linked = factories.filter((f) => f.linked === true);
   if (linked.length === 1) return { factory: linked[0], reason: "linked" };
+  const named = (linked.length > 0 ? linked : factories).find((f) => f.id === configured);
+  if (named) return { factory: named, reason: "configured" };
   const owners = factories.filter((f) => f.owner);
   if (owners.length === 1) return { factory: owners[0], reason: "owner" };
   if (factories.length === 1) return { factory: factories[0], reason: "only" };
@@ -271,7 +274,7 @@ async function choose(flags, deps, factories, saved, repository) {
 ${listText(factories, repository)}`;
     return result(1, "failed", `--factory ${flags.factory} names no factory you can use`, message);
   }
-  const decided = selectFactory(factories, saved, repository);
+  const decided = selectFactory(factories, saved, repository, readCloudConfig(deps.home).appId);
   if (decided.factory) return { factory: decided.factory, reason: decided.reason };
   const linked = factories.filter((f) => f.linked === true);
   if (!deps.isTerminal) {

package/dist/{chunk-ZXBQ6E72.js → chunk-3RIFVLPO.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { checkStarterFiles, contextIsGoverned } from './chunk-BJQ25STI.js';
-import { fleetCheck, checkBuildSkill, checkMachineSkills, checkCommittedMaintainedSkills, checkMaintainedReferences } from './chunk-6IKSUAIA.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-CMKY36NV.js';
-import { isLinkedRepository } from './chunk-ZQOSIMKU.js';
+import { fleetCheck, checkBuildSkill, checkMachineSkills, checkCommittedMaintainedSkills, checkMaintainedReferences, checkIgnoredSkillFolders } from './chunk-HXA5GIHK.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-VT4TTJPG.js';
+import { isLinkedRepository } from './chunk-2WMZPJVE.js';
 import { sanitizeTerminal } from './chunk-EWVYQLD3.js';
 import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-5DNCFOXA.js';
 import { C } from './chunk-ANPNT6PM.js';
 import { checkFormerSkillNames } from './chunk-UIUGTW5C.js';
-import { resolveGatewayCredentials, defaultFetch } from './chunk-WPGBDY73.js';
-import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-DJWKUQLO.js';
+import { resolveGatewayCredentials, defaultFetch } from './chunk-6RKD7YZ6.js';
+import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-QPWFVE3X.js';
 import { readStatuslineState, STATE_FRESH_MS } from './chunk-I7RZHMXW.js';
 import { hookCommandEscapesControlPlane, CONTROL_PLANE_DIR_VARIABLE } from './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
@@ -194,6 +194,7 @@ function runDoctor(env = {}) {
     ...starter?.checks ?? [],
     ...laptop ? checkRenamedSkills(env.cwd) : [],
     ...checkBuildSkillState(env.cwd, home),
+    ...checkIgnoredSkills(env.cwd),
     ...starter !== void 0 && !starter.mcpOutdated ? checkMcpCommand(env.cwd, env.processEnv) : [],
     ...checkContextSource(env.cwd),
     ...checkGovernsList(env.cwd),
@@ -206,6 +207,10 @@ function checkRenamedSkills(cwd) {
   if (dirs === void 0 || contextIsGoverned(dirs.gitCommonDir)) return [];
   return checkFormerSkillNames(dirs.repoRoot);
 }
+function checkIgnoredSkills(cwd) {
+  const dirs = findGitDirs(cwd ?? process.cwd());
+  return dirs === void 0 ? [] : checkIgnoredSkillFolders(dirs.repoRoot);
+}
 function checkBuildSkillState(cwd, home) {
   const dirs = findGitDirs(cwd ?? process.cwd());
   if (dirs === void 0 || contextIsGoverned(dirs.gitCommonDir)) return [];
@@ -1190,8 +1195,8 @@ function doctorExitCode(checks) {
 
 // src/doctor-report.ts
 async function gatherDoctorChecks() {
-  const { DEFAULT_BUILD_DISK } = await import('./build-disk-6QAXMA2J.js');
-  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-DUY2PT7K.js');
+  const { DEFAULT_BUILD_DISK, DEFAULT_CACHE_DISK } = await import('./build-disk-JHTMPRAA.js');
+  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-QXMUWJAQ.js');
   const configPath = defaultRunnerConfigPath();
   const runnerHost = hasRunnerBlock(configPath);
   const hooks = (() => {
@@ -1212,7 +1217,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-N3CDJ66I.js');
+    const { runnerHostChecks } = await import('./doctor-GJAHI3KU.js');
     const gateway = (() => {
       try {
         const { url, apiKey, appId } = loadRunnerConfig(configPath);
@@ -1231,7 +1236,7 @@ async function gatherDoctorChecks() {
     const runner = (() => {
       try {
         const { concurrency, build, housekeeping, managed } = loadRunnerConfig(configPath);
-        return { concurrency, buildMemory: build?.memory ?? "8g", buildDisk: build?.disk ?? DEFAULT_BUILD_DISK, minFreeDisk: housekeeping?.minFreeDisk, allowHosts: build?.allowHosts, ...build?.imageBuild === void 0 ? {} : { imageBuild: build.imageBuild }, ...managed === true ? { managed } : {} };
+        return { concurrency, buildMemory: build?.memory ?? "8g", buildDisk: build?.disk ?? DEFAULT_BUILD_DISK, cacheDisk: build?.cacheDisk ?? DEFAULT_CACHE_DISK, minFreeDisk: housekeeping?.minFreeDisk, allowHosts: build?.allowHosts, ...build?.imageBuild === void 0 ? {} : { imageBuild: build.imageBuild }, ...managed === true ? { managed } : {} };
       } catch {
         return void 0;
       }
@@ -1240,7 +1245,7 @@ async function gatherDoctorChecks() {
       const { existsSync: existsSync3 } = await import('fs');
       if (process.platform !== "linux" || !existsSync3("/run/systemd/system")) return void 0;
       const { inspectService, realInspectProbes } = await import('./inspect-DNLXTXLA.js');
-      const { DEFAULT_UNIT_NAME } = await import('./install-NLVYISAV.js');
+      const { DEFAULT_UNIT_NAME } = await import('./install-QPA7DQHO.js');
       const { dirname: dirname2 } = await import('path');
       return inspectService(DEFAULT_UNIT_NAME, dirname2(configPath), realInspectProbes());
     })();

package/dist/{chunk-UOFBHIOZ.js → chunk-57L2YAJA.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-AGZNCIIJ.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-PA6CK6WQ.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-6NWS455T.js → chunk-5THSC6BD.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EXEC_PORT } from './chunk-LWTBE5J6.js';
+import { EXEC_PORT } from './chunk-L26V6ILJ.js';
 import { createConnection } from 'net';
 
 createRequire(import.meta.url);

package/dist/{chunk-QL3LPZ67.js → chunk-6LBSAW6I.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RELAY_PORT, BUILD_HOME } from './chunk-BCCI32ME.js';
+import { RELAY_PORT, BUILD_HOME } from './chunk-BALIE3BA.js';
 import { createServer, connect } from 'net';
 
 createRequire(import.meta.url);

package/dist/{chunk-WPGBDY73.js → chunk-6RKD7YZ6.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readCloudConfigStrict, readCloudConfig, cloudConfigPath } from './chunk-PJDQPF5N.js';
-import { signRunnerRequest, signerFor } from './chunk-AA6LYZC4.js';
+import { signRunnerRequest, signerFor } from './chunk-SOI6K5DY.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
 import { PLAIN_VERSION, recordCliVersion, removeRecordedVersion } from './chunk-5BHIBJDA.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';

package/dist/{chunk-77B36F5K.js → chunk-6Z4SZHV2.js}

@@ -1,12 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { staleBuildRefusal, staleBuildWarning, detectCi } from './chunk-3MXPS7ED.js';
+import { staleBuildRefusal, staleBuildWarning, detectCi } from './chunk-2N67C6IV.js';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
-import { detectActiveSession, autoConnect } from './chunk-2QT4JUW3.js';
+import { detectActiveSession } from './chunk-IP7BIBXJ.js';
+import { autoConnect } from './chunk-B2JURP6A.js';
 import { readEffectiveArtifactSpoolState, localArtifactIds, isArtifactTombstoned, artifactBlobsDir, appendArtifactRecord, artifactsSpoolPath, findPendingArtifactRecord, sanitizeTerminal, appendArtifactTombstone } from './chunk-EWVYQLD3.js';
 import { resolveRepoIdentity } from './chunk-5DNCFOXA.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-WPGBDY73.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-6RKD7YZ6.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { ARTIFACT_MAX_CAPTION_LENGTH, ArtifactCriterionIdSchema, ARTIFACT_MAX_BYTES, ARTIFACT_MAX_FILENAME_LENGTH, mediaTypeForArtifactPath, inferArtifactKind, ARTIFACT_MAX_REPLACES_TARGETS, parseTestSelector, parseJunit, bindTests } from './chunk-E6CO3MJE.js';

package/dist/chunk-7HHNGZS5.js

@@ -0,0 +1,146 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { placeholderQueues, placeholderProblem } from './chunk-2EGCI2VW.js';
+import { checkFit } from './chunk-HE4FBF4T.js';
+import { builtinKind, imageBuildOf } from './chunk-RQJMN5TJ.js';
+import { realBuildDiskProbe, checkDiskFit, DEFAULT_CACHE_DISK, DEFAULT_BUILD_DISK } from './chunk-W2AEL4BJ.js';
+import { builderDiskPinned } from './chunk-NE63JADS.js';
+import { claudeCredentialVariablesSet, claudeCredential } from './chunk-BALIE3BA.js';
+import { closeSync, openSync, constants } from 'fs';
+import { totalmem } from 'os';
+
+createRequire(import.meta.url);
+function openKvm() {
+  try {
+    closeSync(openSync("/dev/kvm", constants.O_RDWR));
+    return "usable";
+  } catch (err) {
+    return err.code === "ENOENT" ? "absent" : "no-permission";
+  }
+}
+var sharedBuildDisk;
+function realBlockedProbes() {
+  sharedBuildDisk ??= realBuildDiskProbe();
+  return { env: process.env, kvm: openKvm, totalMemoryBytes: totalmem, imageBuilder: "unknown", buildDisk: sharedBuildDisk };
+}
+var DEFAULT_BUILD_MEMORY = "8g";
+function managedProblems(facts) {
+  const problems = [];
+  if (builtinKind(facts.provision) !== "vm") {
+    problems.push({
+      condition: "jailer",
+      reason: `a managed runner needs builtin:vm hooks, and runner.hooks.provision is ${facts.provision}. Without them builds would run without the jailer. Set runner.hooks.provision and runner.hooks.cleanup to builtin:vm`
+    });
+  } else if (facts.jailer === "usable") ; else if (facts.jailer === "unknown") {
+    problems.push({ condition: "jailer", reason: "the runner has not yet asked the root helper whether builds run under the jailer, so builds would run without the jailer until it answers" });
+  } else {
+    const { problem } = facts.jailer;
+    const advice = problem.includes("pins no helper") || problem.includes("runner install") ? "" : ". Run `outerlayer runner install --service --replace` to install the root helper, then restart the service";
+    problems.push({ condition: "jailer", reason: `builds would run without the jailer, which a managed runner does not allow: ${problem}${advice}` });
+  }
+  if (facts.credentials.has("CLAUDE_CODE_OAUTH_TOKEN")) {
+    problems.push({
+      condition: "credential",
+      reason: "CLAUDE_CODE_OAUTH_TOKEN is set in the runner's environment or credentials directory, and a managed runner accepts only ANTHROPIC_API_KEY. Remove CLAUDE_CODE_OAUTH_TOKEN from the claude.env and runner.env beside the config, store ANTHROPIC_API_KEY, then restart the service"
+    });
+  } else if (!facts.credentials.has("ANTHROPIC_API_KEY")) {
+    problems.push({
+      condition: "credential",
+      reason: "there is no Claude credential in the runner's environment, and a managed runner needs ANTHROPIC_API_KEY. Store ANTHROPIC_API_KEY with `outerlayer runner init --agent claude`, which writes the claude.env beside the config, then restart the service"
+    });
+  }
+  if (facts.allowHosts === void 0) {
+    problems.push({
+      condition: "allowHosts",
+      reason: "runner.build.allowHosts is not set, and a managed runner needs it so that a build reaches only the public hosts it lists. List the hosts your builds need; an empty list allows none"
+    });
+  }
+  if (builtinKind(facts.provision) === "vm") {
+    if (facts.imageBuild === "host") {
+      problems.push({
+        condition: "imageBuild",
+        reason: "runner.build.imageBuild is host, and a managed runner builds its images in a builder microVM, because a recipe step on the host could reach the host's own services and network. Remove runner.build.imageBuild or set it to vm"
+      });
+    } else if (!facts.builderDiskPinned) {
+      problems.push({
+        condition: "imageBuild",
+        reason: "this release of the CLI pins no builder root disk, so it cannot build images in a builder microVM, which a managed runner needs for runner.build.imageBuild. Update the CLI to a release that pins one"
+      });
+    }
+  }
+  return problems;
+}
+function managedFactsOf(config, probes) {
+  return {
+    provision: config.hooks.provision,
+    jailer: probes.jailer ?? "unknown",
+    credentials: claudeCredentialVariablesSet(probes.env),
+    allowHosts: config.build?.allowHosts,
+    imageBuild: imageBuildOf(config),
+    builderDiskPinned: probes.builderDiskPinned ?? builderDiskPinned()
+  };
+}
+function keepsHostBuilder(config, builderDiskIsPinned) {
+  return !(builtinKind(config.hooks.provision) === "vm" && imageBuildOf(config) === "vm" && (builderDiskIsPinned ?? builderDiskPinned()));
+}
+function checkBlockedWithSlots(config, probes) {
+  const blocked = (reason) => ({ blocked: { reason } });
+  let slots;
+  const placeholders = placeholderQueues(config);
+  if (placeholders.length > 0) return blocked(`${placeholderProblem(placeholders)}. The runner takes work again once the config is edited`);
+  if (config.managed === true) {
+    const unmet = managedProblems(managedFactsOf(config, probes))[0];
+    if (unmet !== void 0) return blocked(unmet.reason);
+  }
+  const kind = builtinKind(config.hooks.provision);
+  if (kind === "container" || kind === "vm") {
+    const fit = checkFit({
+      concurrency: config.concurrency,
+      buildMemory: config.build?.memory ?? DEFAULT_BUILD_MEMORY,
+      usableBytes: probes.totalMemoryBytes()
+    });
+    if (!fit.fits) {
+      const advice = probes.inImage === true ? "Set OUTERLAYER_BUILD_MEMORY or OUTERLAYER_CONCURRENCY in the env file and recreate the container, or give the machine more memory" : `Lower runner.concurrency or runner.build.memory in ${config.configPath}`;
+      return blocked(`${fit.message}. ${advice}`);
+    }
+    const facts = probes.buildDisk?.(kind, config.configPath);
+    if (facts !== void 0) {
+      const diskFit = checkDiskFit({ concurrency: config.concurrency, buildDisk: config.build?.disk ?? DEFAULT_BUILD_DISK, cacheDisk: config.build?.cacheDisk ?? DEFAULT_CACHE_DISK, facts });
+      slots = diskFit.slots;
+      if (diskFit.slots < 1) {
+        const advice = probes.inImage === true ? "Set OUTERLAYER_CONCURRENCY in the env file and recreate the container, or give the machine more disk" : `Lower runner.build.disk${kind === "vm" ? " or runner.build.cacheDisk" : ""} in ${config.configPath}, or give the machine more disk`;
+        return { blocked: { reason: `${diskFit.message}. ${advice}` }, slots };
+      }
+    }
+  }
+  const kvm = kind === "vm" ? probes.kvm() : "usable";
+  if (kvm === "absent") {
+    return { blocked: { reason: "/dev/kvm does not exist on this machine, so builtin:vm cannot start a microVM. Use a host with KVM enabled, or builtin:container hooks" }, slots };
+  }
+  if (kvm !== "usable") {
+    return {
+      slots,
+      blocked: {
+        reason: "the runner cannot open /dev/kvm, so builtin:vm cannot start a microVM. Add the runner's account to the kvm group, then restart the service, because a service reads its groups only when it starts"
+      }
+    };
+  }
+  if ((kind === "container" || kind === "vm") && keepsHostBuilder(config, probes.builderDiskPinned)) {
+    const builder = probes.imageBuilder;
+    if (builder === "unknown") {
+      return { blocked: { reason: "the runner is still preparing its image builder, the container that limits image builds to runner.build.memory, so it claims nothing yet" }, slots };
+    }
+    if (builder !== "usable") return { blocked: { reason: `${builder.problem}. The runner takes work again once its image builder works` }, slots };
+  }
+  if (kind !== "own" && claudeCredential(probes.env) === void 0) {
+    return {
+      slots,
+      blocked: {
+        reason: "there is no Claude credential in the runner's environment. Store CLAUDE_CODE_OAUTH_TOKEN (from `claude setup-token`) or ANTHROPIC_API_KEY with `outerlayer runner init --agent claude`, which writes the claude.env beside the config, then restart the service"
+      }
+    };
+  }
+  return { slots };
+}
+
+export { checkBlockedWithSlots, keepsHostBuilder, managedFactsOf, managedProblems, realBlockedProbes };

package/dist/{chunk-DETKDTNL.js → chunk-AU346ENF.js}

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
-import { autoConnect, detectActiveSession } from './chunk-2QT4JUW3.js';
+import { detectActiveSession } from './chunk-IP7BIBXJ.js';
+import { autoConnect } from './chunk-B2JURP6A.js';
 import { acquireSpoolLockAt } from './chunk-EWVYQLD3.js';
 import { resolveRepoIdentity } from './chunk-5DNCFOXA.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-WPGBDY73.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-6RKD7YZ6.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { StepNameSchema, StepBodySchema } from './chunk-E6CO3MJE.js';

package/dist/chunk-B2JURP6A.js

@@ -0,0 +1,41 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-2WMZPJVE.js';
+import { resolveRepoIdentity } from './chunk-5DNCFOXA.js';
+import { resolveGatewayCredentials } from './chunk-6RKD7YZ6.js';
+import { readCloudConfig } from './chunk-PJDQPF5N.js';
+import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
+import { cliInvocation } from './chunk-CRB3POP4.js';
+import { homeFromEnv } from './chunk-VNVZDWO3.js';
+
+createRequire(import.meta.url);
+
+// src/auto-connect.ts
+async function autoConnect(opts) {
+  const env = opts.env ?? process.env;
+  const home = opts.home ?? homeFromEnv(env);
+  const cwd = opts.cwd ?? process.cwd();
+  const resolved = resolveGatewayCredentials({ url: opts.url, apiKey: opts.apiKey, appId: opts.appId, home, env, cwd });
+  if (resolved.ok || resolved.kind !== "login" || !resolved.credential || !resolved.url) return void 0;
+  const dirs = findGitDirs(cwd);
+  const repository = opts.repository ?? resolveRepoIdentity(cwd).gitRepo;
+  if (dirs === void 0 || repository === void 0) return void 0;
+  const listed = await fetchFactories(opts.fetchImpl ?? fetch, resolved.url, resolved.credential, repository);
+  if (!listed.ok || listed.factories.length === 0) return void 0;
+  const chosen = selectFactory(listed.factories, readRepoConnection(cwd), repository, readCloudConfig(home).appId);
+  if (chosen.factory === void 0) {
+    return `you are logged in, but no factory is chosen for this repository, and more than one fits. Run \`${cliInvocation()} connect --factory <org>/<factory>\` with one of:
+${chosen.text}
+Or pass --app-id / set OUTERLAYER_APP_ID.`;
+  }
+  try {
+    saveFactoryConnection(dirs.gitCommonDir, void 0, chosen.factory, /* @__PURE__ */ new Date());
+  } catch {
+    return void 0;
+  }
+  process.stderr.write(`${autoConnectedLine(repository, chosen.factory, chosen.reason)}
+`);
+  return void 0;
+}
+
+export { autoConnect };

package/dist/{chunk-BCCI32ME.js → chunk-BALIE3BA.js}

@@ -318,14 +318,26 @@ async function startDestination(input) {
   const headerName = destination.header.name.toLowerCase();
   const dropped = /* @__PURE__ */ new Set(["host", "authorization", "proxy-authorization", "cookie", "connection", "proxy-connection", "keep-alive", "transfer-encoding", "upgrade", ...input.drop ?? []]);
   const handle = (req, res) => {
+    let finished = false;
+    const finish = (ok) => {
+      if (finished) return;
+      finished = true;
+      input.onFinished?.(destination.name, ok);
+    };
+    res.on("finish", () => finish(true));
+    res.on("close", () => finish(false));
+    const fail = (status, body) => {
+      finish(false);
+      respond(res, status, body);
+    };
     const target = req.url ?? "";
     if (!target.startsWith("/")) {
-      respond(res, 400, "send an origin-form request path\n");
+      fail(400, "send an origin-form request path\n");
       return;
     }
     const expanded = expandHeader(destination.header, hostEnv);
     if ("missing" in expanded) {
-      respond(res, 502, `the destination ${destination.name} cannot be reached: ${expanded.missing} is not set in the runner's environment
+      fail(502, `the destination ${destination.name} cannot be reached: ${expanded.missing} is not set in the runner's environment
 `);
       return;
     }
@@ -351,20 +363,23 @@ async function startDestination(input) {
           res.writeHead(answer.statusCode ?? 502, answer.headers);
           answer.on("error", () => res.destroy());
           answer.on("close", () => {
-            if (!answer.complete) res.destroy();
+            if (!answer.complete) {
+              finish(false);
+              res.destroy();
+            }
           });
           answer.pipe(res);
         }
       );
     } catch {
-      respond(res, 502, `the destination ${destination.name} cannot be reached: its header value was refused
+      fail(502, `the destination ${destination.name} cannot be reached: its header value was refused
 `);
       return;
     }
     input.onUsed?.(destination.name);
     forwarded.setTimeout(UPSTREAM_IDLE_MS, () => forwarded.destroy());
     res.on("close", () => forwarded.destroy());
-    forwarded.on("error", () => respond(res, 502, `the upstream of the destination ${destination.name} could not be reached
+    forwarded.on("error", () => fail(502, `the upstream of the destination ${destination.name} could not be reached
 `));
     req.pipe(forwarded);
   };
@@ -445,9 +460,12 @@ async function startBuildServices(input) {
         ...input.serve === "socket" || streamed ? {} : { port: input.ports?.destinations?.[index] ?? 0 },
         hostEnv: input.hostEnv,
         onUsed: (name) => tunnel.destinationUsed(name),
+        onFinished: (name, ok) => tunnel.routeFinished(name, ok),
         ...input.destinationOptions
       });
       servers.push(server);
+      tunnel.routeServed(destination.name);
+      input.log?.(`route ${destination.name} served to the build`);
       const listener = server.listener?.();
       if (listener !== void 0) listeners[`dest-${index}.sock`] = listener;
       targets.set(destinationTarget(index), (stream) => server.acceptStream(stream));
@@ -463,9 +481,12 @@ async function startBuildServices(input) {
         hostEnv: builtIn.hostEnv,
         drop: builtIn.drop,
         onUsed: (name) => tunnel.destinationUsed(name),
+        onFinished: (name, ok) => tunnel.routeFinished(name, ok),
         ...input.destinationOptions
       });
       servers.push(server);
+      tunnel.routeServed(builtIn.destination.name);
+      input.log?.(`route ${builtIn.destination.name} served to the build`);
       const listener = server.listener?.();
       if (listener !== void 0) listeners[builtIn.socket] = listener;
       targets.set(builtIn.destination.name, (stream) => server.acceptStream(stream));
@@ -828,14 +849,22 @@ function withTunnelRecord(environment, record, onlyWhenUsed = false) {
   const base = ignoredProperties === void 0 ? environment : { ...environment, ignoredProperties };
   if (record === void 0) return base;
   const used = record.hosts.length + record.hostsMore + record.refusals.length + record.refusalsMore + (record.destinations?.length ?? 0) > 0;
-  if (onlyWhenUsed && !used) return base;
+  const routed = Object.values(record.routes ?? {}).some((counts) => counts.requests > 0);
+  if (onlyWhenUsed && !used && !routed) return base;
   return {
     ...base,
     ...capHosts(record.hosts, record.hostsMore),
     refusals: record.refusals.slice(0, MAX_HOSTS),
     refusalsMore: Math.max(0, record.refusals.length - MAX_HOSTS) + record.refusalsMore,
-    ...record.destinations === void 0 || record.destinations.length === 0 ? {} : { destinations: record.destinations }
+    ...record.destinations === void 0 || record.destinations.length === 0 ? {} : { destinations: record.destinations },
+    ...routesOf(record.routes)
   };
 }
+var MAX_ROUTES = 32;
+function routesOf(counts) {
+  if (counts === void 0) return {};
+  const routes = Object.entries(counts).sort(([a], [b]) => a < b ? -1 : 1).slice(0, MAX_ROUTES).map(([name, { requests, failures }]) => ({ name, requests, failures: Math.min(failures, requests) }));
+  return routes.length === 0 ? {} : { routes };
+}
 
 export { AGENT_CREDENTIAL_MISSING, BUILD_HOME, BUILT_IN_NAMES, CHECKOUT_DIR, CHECK_ITEMS_FILE, CLAUDE_CREDENTIAL_ID, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_ENV_FILE, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, EVAL_INPUT_DIR, FORWARDED_CLAUDE_CREDENTIAL_VARIABLES, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, MAVEN_NO_PROXY_NOTE, MAVEN_SETTINGS_FILE, MAVEN_SPACE_NOTE, PROXY_WARNING_FLAG, RELAY_PORT, authorEnvironment, buildEnvironment, buildMavenSettingsXml, builtInEnvironment, checkEnvironment, checkoutPath, claudeCredential, claudeCredentialVariablesSet, claudeEnvPath, commitIdentityRecord, containerLocalAddress, credentialLineIn, currentClaudeCredential, destinationEnvironment, headerVariables, heldClaudeCredential, isRefusedInConfig, isReservedVariable, lifecycleWorkdir, mavenArgs, mavenSettingsXml, namesGlobalSettings, parseClaimIdentity, parseClaimedRepositories, parseIsolation, parseUnreachable, primaryOf, proxyEnvironment, readClaudeCredential, removedClaudeCredentialValues, repositoriesOf, repositoryPath, resolveDestinations, sharedUserEnvironment, startBuildServices, takeClaudeCredential, tokenHeader, withGitConfig, withHooksPath, withProxyWarningHidden, withTokenHeader, withTunnelRecord, withoutCredentialLines, writeBuildMavenSettings, writeMavenSettings };

package/dist/{chunk-BY36DVJV.js → chunk-BKADJZ7F.js}

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
-import { detectActiveSession, autoConnect, transcriptPathForSession } from './chunk-2QT4JUW3.js';
+import { detectActiveSession, transcriptPathForSession } from './chunk-IP7BIBXJ.js';
+import { autoConnect } from './chunk-B2JURP6A.js';
 import { resolveRepoIdentity, defaultProjectsDir, findTranscripts, sessionIdFromPath, scrubText } from './chunk-5DNCFOXA.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-WPGBDY73.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-6RKD7YZ6.js';
 import { readLatestProvenanceForSession } from './chunk-ZJSNLVCE.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';

package/dist/{chunk-CUBIZBMF.js → chunk-DISTLL2Q.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_UNIT_NAME } from './chunk-ZRRUWNJS.js';
-import { RUNNER_FILE_MODE } from './chunk-AGZNCIIJ.js';
-import { claudeEnvPath, withoutCredentialLines } from './chunk-BCCI32ME.js';
+import { DEFAULT_UNIT_NAME } from './chunk-HE4FBF4T.js';
+import { RUNNER_FILE_MODE } from './chunk-PA6CK6WQ.js';
+import { claudeEnvPath, withoutCredentialLines } from './chunk-BALIE3BA.js';
 import { parseRunnerEnv } from './chunk-HACGUL52.js';
 import { existsSync, readFileSync, writeFileSync, renameSync, rmSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-GN2R5Z7G.js → chunk-DXJTBU7A.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { launcherPath, writeLauncher, LauncherWriteError, pathNotes } from './chunk-GWDS42JC.js';
-import { currentVersion, currentLink, isInLayout, packageRootIn, versionDir, switchCurrent, execStartLine } from './chunk-OWDSO3PE.js';
+import { launcherPath, writeLauncher, LauncherWriteError, pathNotes } from './chunk-Z5IW4DHH.js';
+import { currentVersion, currentLink, isInLayout, packageRootIn, versionDir, switchCurrent, execStartLine } from './chunk-NBZ7XBT6.js';
 import { compareVersions } from './chunk-TQMI335S.js';
-import { RUNNER_DIR_MODE } from './chunk-AGZNCIIJ.js';
+import { RUNNER_DIR_MODE } from './chunk-PA6CK6WQ.js';
 import { realpathSync, readFileSync, mkdirSync, rmSync, cpSync, existsSync } from 'fs';
 import { dirname, sep, join } from 'path';
 

package/dist/{chunk-WCELNMXT.js → chunk-EUVE2EAE.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { removeRetiredSkills } from './chunk-UIUGTW5C.js';
-import { defaultFetch, resolveGatewayCredentials } from './chunk-WPGBDY73.js';
-import { withTokenHeader } from './chunk-BCCI32ME.js';
+import { defaultFetch, resolveGatewayCredentials } from './chunk-6RKD7YZ6.js';
+import { withTokenHeader } from './chunk-BALIE3BA.js';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
 import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-G63KT5I5.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';

package/dist/{chunk-DDS2ISML.js → chunk-F5UL23I2.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { isSameProcess } from './chunk-JBJTC3UU.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-AGZNCIIJ.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-PA6CK6WQ.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, rmSync } from 'fs';
 import { dirname } from 'path';