@outerlayer/cli 0.34.0-next.20261025132734 → 0.34.0-next.20261025180645

package/dist/{chunk-43I7PXDP.js → chunk-5AFPP3GZ.js}

@@ -1,15 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RecipeError } from './chunk-3Z3MPR55.js';
-import { BUILDKIT_IMAGE } from './chunk-ES4ULBAL.js';
-import { compareVersions } from './chunk-6ZFY2L2T.js';
-import { ensureHostKey } from './chunk-SOI6K5DY.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-PA6CK6WQ.js';
-import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-BALIE3BA.js';
+import { BUILDKIT_IMAGE } from './chunk-4UPET3R7.js';
+import { ensureHostKey } from './chunk-MOI2KDLH.js';
+import { compareVersions } from './chunk-AJYZNISW.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-PXGU3GKY.js';
+import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-G4W4B33M.js';
 import { JOIN_DIR, RELAY_ID, JOIN_SOCKET, TARGET_GATEWAY, TARGET_CLAUDE, destinationTarget, RELAY_USER } from './chunk-MESOOLF4.js';
 import { createHash } from 'crypto';
-import { existsSync, mkdirSync, createWriteStream, rmSync, readFileSync, chmodSync, writeFileSync, realpathSync, readdirSync, renameSync } from 'fs';
-import { join, dirname, resolve } from 'path';
+import { existsSync, readdirSync, readFileSync, lstatSync, realpathSync, writeFileSync, mkdirSync, createWriteStream, rmSync, chmodSync, renameSync } from 'fs';
+import { join, resolve, relative, dirname, sep, basename } from 'path';
 import { StringDecoder } from 'string_decoder';
 import { spawn } from 'child_process';
 import { createRequire as createRequire$1 } from 'module';
@@ -48,6 +47,228 @@ function cut(line) {
   const last = head.charCodeAt(head.length - 1);
   return last >= 55296 && last <= 56319 ? head.slice(0, -1) : head;
 }
+
+// src/runner/image/properties.ts
+var LIFECYCLE = ["onCreateCommand", "updateContentCommand", "postCreateCommand", "postStartCommand"];
+var HONOURED = ["image", "build", "features", "containerEnv", "remoteUser", ...LIFECYCLE];
+var IGNORED_BUILD_KEYS = ["options"];
+var HOST_REFERENCE = /\$\{(?:localEnv|env)[:}]/;
+var DROP = /* @__PURE__ */ Symbol("drop");
+function isHonoured(property) {
+  return HONOURED.includes(property);
+}
+function isObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function featureName(id) {
+  const slash = id.lastIndexOf("/");
+  const cut2 = id.slice(slash + 1).search(/[:@]/);
+  return cut2 === -1 ? id : id.slice(0, slash + 1 + cut2);
+}
+var DOCKER_FEATURE = "ghcr.io/devcontainers/features/docker-in-docker";
+function asksForDocker(recipe, metadata) {
+  const isDocker = (id) => featureName(id) === DOCKER_FEATURE;
+  if (isObject(recipe.features) && Object.keys(recipe.features).some(isDocker)) return true;
+  return metadata.some((entry) => typeof entry.id === "string" && isDocker(entry.id));
+}
+function sameValue(a, b) {
+  return JSON.stringify(a) === JSON.stringify(b);
+}
+function isFilesOwnEntry(entry, recipe) {
+  if (typeof entry.id === "string") return false;
+  const keys = Object.keys(entry);
+  return keys.length > 0 && keys.every((key) => key in recipe && sameValue(entry[key], recipe[key]));
+}
+function withoutHostReferences(value, path, dropped) {
+  if (typeof value === "string") {
+    if (!HOST_REFERENCE.test(value)) return value;
+    dropped.push(path);
+    return DROP;
+  }
+  if (Array.isArray(value)) {
+    if (!HOST_REFERENCE.test(JSON.stringify(value))) return value;
+    dropped.push(path);
+    return DROP;
+  }
+  if (isObject(value)) {
+    const kept = {};
+    for (const [key, item] of Object.entries(value)) {
+      if (HOST_REFERENCE.test(key)) {
+        dropped.push(`${path}.${key}`);
+        continue;
+      }
+      const clean = withoutHostReferences(item, `${path}.${key}`, dropped);
+      if (clean !== DROP) kept[key] = clean;
+    }
+    return kept;
+  }
+  return value;
+}
+function honouredWithoutHostReferences(entry) {
+  const kept = {};
+  const dropped = [];
+  for (const property of HONOURED) {
+    if (!(property in entry)) continue;
+    const value = entry[property];
+    const clean = withoutHostReferences(
+      property === "build" && isObject(value) ? withoutIgnoredBuildKeys(value) : value,
+      property,
+      dropped
+    );
+    if (clean !== DROP) kept[property] = clean;
+  }
+  return { kept, dropped };
+}
+function withoutIgnoredBuildKeys(build) {
+  return Object.fromEntries(Object.entries(build).filter(([key]) => !IGNORED_BUILD_KEYS.includes(key)));
+}
+function ignoredIn(entry, source) {
+  const found = [];
+  for (const property of Object.keys(entry)) {
+    if (property === "id" || property.startsWith("$") || isHonoured(property)) continue;
+    found.push({ property, source });
+  }
+  if (isObject(entry.build)) {
+    for (const key of IGNORED_BUILD_KEYS) {
+      if (key in entry.build) found.push({ property: `build.${key}`, source });
+    }
+  }
+  for (const property of honouredWithoutHostReferences(entry).dropped) found.push({ property, source });
+  return found;
+}
+function emptyApply() {
+  return { containerEnv: {}, lifecycle: { onCreateCommand: [], updateContentCommand: [], postCreateCommand: [], postStartCommand: [] } };
+}
+function applyEntry(apply, raw, source) {
+  const entry = honouredWithoutHostReferences(raw).kept;
+  if (typeof entry.remoteUser === "string") apply.remoteUser = entry.remoteUser;
+  if (isObject(entry.containerEnv)) {
+    for (const [key, value] of Object.entries(entry.containerEnv)) {
+      if (typeof value === "string") apply.containerEnv[key] = value;
+    }
+  }
+  for (const name of LIFECYCLE) {
+    if (entry[name] !== void 0) apply.lifecycle[name].push({ source, command: entry[name] });
+  }
+}
+function classifyProperties(recipe, metadata) {
+  const ignored = ignoredIn(recipe, "file");
+  const apply = emptyApply();
+  let fileApplied = false;
+  const sanitized = sanitizeRecipe(recipe);
+  for (const entry of metadata) {
+    if (isFilesOwnEntry(entry, sanitized)) {
+      applyEntry(apply, entry, "file");
+      fileApplied = true;
+      continue;
+    }
+    const source = typeof entry.id === "string" ? `feature ${featureName(entry.id)}` : "image label";
+    ignored.push(...ignoredIn(entry, source));
+    applyEntry(apply, entry, source);
+  }
+  if (!fileApplied) applyEntry(apply, recipe, "file");
+  return { docker: asksForDocker(recipe, metadata), honoured: HONOURED.filter((property) => property in recipe), ignored, apply };
+}
+function sanitizeRecipe(recipe) {
+  return honouredWithoutHostReferences(recipe).kept;
+}
+
+// src/runner/image/recipe.ts
+var RecipeError = class extends Error {
+  constructor(code, message, logPath) {
+    super(message);
+    this.code = code;
+    this.logPath = logPath;
+  }
+};
+var DIR_RECIPE = ".devcontainer/devcontainer.json";
+var ROOT_RECIPE = ".devcontainer.json";
+function locateRecipe(checkoutDir) {
+  if (existsSync(join(checkoutDir, DIR_RECIPE))) return { kind: "file", path: DIR_RECIPE };
+  if (existsSync(join(checkoutDir, ROOT_RECIPE))) return { kind: "file", path: ROOT_RECIPE };
+  const named = namedConfigurations(checkoutDir);
+  if (named.length > 0) {
+    throw new RecipeError(
+      "recipe_ambiguous",
+      `the repository has only named devcontainer configurations (${named.join(", ")}); add ${DIR_RECIPE} so the runner knows which to build`
+    );
+  }
+  return { kind: "default" };
+}
+function namedConfigurations(checkoutDir) {
+  const dir = join(checkoutDir, ".devcontainer");
+  if (!existsSync(dir)) return [];
+  return readdirSync(dir).sort().map((entry) => `.devcontainer/${entry}/devcontainer.json`).filter((path) => existsSync(join(checkoutDir, path)));
+}
+var COMMENTS = /("(?:[^"\\]|\\.)*")|\/\/[^\n]*|\/\*[\s\S]*?(?:\*\/|$)/g;
+var TRAILING_COMMAS = /("(?:[^"\\]|\\.)*")|,(\s*[}\]])/g;
+function parseJsonc(text) {
+  const withoutComments = text.replace(COMMENTS, (_match, str) => str ?? "");
+  return JSON.parse(withoutComments.replace(TRAILING_COMMAS, (_match, str, close) => str ?? close ?? ""));
+}
+function readRecipe(checkoutDir, location) {
+  if (location.kind === "default") return {};
+  const parsed = parseJsonc(readFileSync(join(checkoutDir, location.path), "utf8"));
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error(`${location.path} is not a JSON object`);
+  }
+  return parsed;
+}
+function within(dir, path) {
+  const rel = relative(dir, path);
+  return rel !== ".." && !rel.startsWith(`..${sep}`);
+}
+function realish(path) {
+  let existing = path;
+  let rest = "";
+  while (!existsSync(existing)) {
+    rest = join(basename(existing), rest);
+    existing = dirname(existing);
+  }
+  return join(realpathSync(existing), rest);
+}
+function assertBuildable(checkoutDir, location, recipe) {
+  if (location.kind === "default") return;
+  const devcontainerDir = join(checkoutDir, ".devcontainer");
+  if (existsSync(devcontainerDir) && lstatSync(devcontainerDir).isSymbolicLink()) {
+    throw new RecipeError(
+      "recipe_context_outside",
+      ".devcontainer is a symbolic link, so the build could read files outside the repository; commit a real directory"
+    );
+  }
+  if (recipe.dockerComposeFile !== void 0) {
+    throw new RecipeError(
+      "recipe_needs_docker",
+      "the recipe uses dockerComposeFile; its services need Docker, which a container build does not have"
+    );
+  }
+  const build = recipe.build;
+  if (typeof build !== "object" || build === null) return;
+  const { dockerfile, context } = build;
+  const base = resolve(checkoutDir, location.path, "..");
+  const allowed = join(realpathSync(checkoutDir), ".devcontainer");
+  const contextPath = resolve(base, typeof context === "string" ? context : ".");
+  const paths = [contextPath];
+  if (typeof dockerfile === "string") paths.push(resolve(base, dockerfile));
+  for (const path of paths) {
+    if (!within(devcontainerDir, path) || !within(allowed, realish(path))) {
+      throw new RecipeError(
+        "recipe_context_outside",
+        `the recipe's build reads ${relative(checkoutDir, path) || "."}, outside .devcontainer/; move the build files into .devcontainer/`
+      );
+    }
+  }
+}
+function writeSanitizedRecipe(checkoutDir, location, recipe) {
+  if (location.kind === "default") throw new Error("the default image has no recipe to sanitize");
+  const path = location.path === ROOT_RECIPE ? join(checkoutDir, ".outerlayer-recipe.json") : join(checkoutDir, ".devcontainer", SANITIZED_NAME);
+  writeFileSync(path, `${JSON.stringify(sanitizeRecipe(recipe), null, 2)}
+`);
+  return path;
+}
+var SANITIZED_NAME = "outerlayer-recipe.json";
+
+// src/runner/image/devcontainer-cli.ts
 var PACKAGE = "@devcontainers/cli";
 function buildRootFromDist(moduleDir = dirname(fileURLToPath(import.meta.url))) {
   try {
@@ -58,9 +279,9 @@ function buildRootFromDist(moduleDir = dirname(fileURLToPath(import.meta.url)))
   }
 }
 function resolveDevcontainerCli(opts = {}) {
-  const resolve2 = opts.resolve ?? createRequire$1(import.meta.url).resolve;
+  const resolve3 = opts.resolve ?? createRequire$1(import.meta.url).resolve;
   try {
-    const bin = join(dirname(resolve2(`${PACKAGE}/package.json`)), "devcontainer.js");
+    const bin = join(dirname(resolve3(`${PACKAGE}/package.json`)), "devcontainer.js");
     if (existsSync(bin)) return { command: process.execPath, args: [bin] };
   } catch {
   }
@@ -133,7 +354,7 @@ function childEnvironment(base) {
   }
   return env;
 }
-var spawnRun = (command, args, opts = {}) => new Promise((resolve2) => {
+var spawnRun = (command, args, opts = {}) => new Promise((resolve3) => {
   let log;
   if (opts.logPath !== void 0) {
     mkdirSync(dirname(opts.logPath), { recursive: true });
@@ -149,11 +370,11 @@ var spawnRun = (command, args, opts = {}) => new Promise((resolve2) => {
     settled = true;
     const result = { status, stdout: stdout + stdoutDecoder.end(), stderr: stderr + stderrDecoder.end() + extra };
     if (log === void 0) {
-      resolve2(result);
+      resolve3(result);
       return;
     }
     if (extra) log.write(extra);
-    log.end(() => resolve2(result));
+    log.end(() => resolve3(result));
   };
   let timer;
   const child = spawn(command, args, {
@@ -374,6 +595,9 @@ function readRunnerIdentity(configPath) {
     return void 0;
   }
 }
+function identityDockerFor(runner) {
+  return runner.keepsHostBuilder ? void 0 : { holdsObjects: async () => false };
+}
 function dockerIdentity(run = spawnRun) {
   return {
     async holdsObjects(label, builder) {
@@ -697,7 +921,7 @@ function ensureBuilder(rawRun, spec, options = {}) {
   const result = serialized(async () => {
     const state = await buildxState(run);
     if (state !== "usable") return { ok: false, problem: state.problem };
-    const sleep = options.sleep ?? ((ms) => new Promise((resolve2) => setTimeout(resolve2, ms)));
+    const sleep = options.sleep ?? ((ms) => new Promise((resolve3) => setTimeout(resolve3, ms)));
     const inspected = await run("docker", ["buildx", "inspect", spec.name]);
     let create = inspected.status !== 0;
     if (!create) {
@@ -763,4 +987,4 @@ function ensureBuilder(rawRun, spec, options = {}) {
   );
 }
 
-export { BUILD_LABEL, COMMAND_DIR, HASH_ARGV, JUDGE_DIR, JUDGE_ITEMS, JUDGE_MAX_TURNS, JUDGE_PROGRAM, JUDGE_REPORT, MAX_ITEMS_BYTES, MAX_REPORT_BYTES, MIN_BUILDX_VERSION, RUNNER_LABEL, builderName, builderNameFor, builderSpec, buildxState, childEnvironment, containerExecArgs, containerRunArgs, createDockerHost, dockerIdentity, ensureBuilder, ensureFailureCount, ensureRunnerIdentity, exceedsDisk, isOutOfMemory, judgeCommand, parseProgramHash, parseSize, pathLabelValue, prepareRunArgs, proxyEnvironment, readDu, readJobFile, readJobFileChecked, readRunnerIdentity, resolveDevcontainerCli, runnerLabelValue, spawnRun, trackImageBuild, withAnswerProtocol, writeJobFile };
+export { BUILD_LABEL, COMMAND_DIR, DOCKER_FEATURE, HASH_ARGV, JUDGE_DIR, JUDGE_ITEMS, JUDGE_MAX_TURNS, JUDGE_PROGRAM, JUDGE_REPORT, MAX_ITEMS_BYTES, MAX_REPORT_BYTES, MIN_BUILDX_VERSION, RUNNER_LABEL, RecipeError, SANITIZED_NAME, assertBuildable, builderName, builderNameFor, builderSpec, buildxState, childEnvironment, classifyProperties, containerExecArgs, containerRunArgs, createDockerHost, dockerIdentity, ensureBuilder, ensureFailureCount, ensureRunnerIdentity, exceedsDisk, identityDockerFor, isOutOfMemory, judgeCommand, locateRecipe, parseProgramHash, parseSize, pathLabelValue, prepareRunArgs, proxyEnvironment, readDu, readJobFile, readJobFileChecked, readRecipe, readRunnerIdentity, resolveDevcontainerCli, runnerLabelValue, spawnRun, trackImageBuild, withAnswerProtocol, writeJobFile, writeSanitizedRecipe };

package/dist/{chunk-HVRQQOMH.js → chunk-63IVRRIO.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { TUNNEL_PORT, BRIDGE_ADDRESS, BRIDGE_CIDR } from './chunk-6LBSAW6I.js';
+import { TUNNEL_PORT, BRIDGE_ADDRESS, BRIDGE_CIDR } from './chunk-SI6WDF3U.js';
+import { EXEC_PORT } from './chunk-OGPEHSNW.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
-import { EXEC_PORT } from './chunk-L26V6ILJ.js';
-import { RELAY_PORT } from './chunk-BALIE3BA.js';
+import { RELAY_PORT } from './chunk-G4W4B33M.js';
 import { spawn, spawnSync } from 'child_process';
 import { symlinkSync, lstatSync, writeFileSync, chmodSync, mkdirSync, existsSync } from 'fs';
 

package/dist/{chunk-FVKH3PMV.js → chunk-6OLVVAOK.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { WorkCommandError, resolveCredentials, getJson } from './chunk-Z4KWHSO4.js';
-import { sanitizeTerminal } from './chunk-MECW77XP.js';
-import { resolveRepoIdentity } from './chunk-6ZFY2L2T.js';
+import { WorkCommandError, resolveCredentials, getJson } from './chunk-UN3SQTVL.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { defaultFetch } from './chunk-6RKD7YZ6.js';
+import { sanitizeTerminal } from './chunk-MECW77XP.js';
+import { defaultFetch } from './chunk-3N77LUQI.js';
+import { resolveRepoIdentity } from './chunk-AJYZNISW.js';
 import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { inferArtifactKind, mediaTypeForArtifactPath, WORK_ITEM_COMMENT_MAX_BODY_LENGTH } from './chunk-EOTMDIYC.js';
@@ -130,7 +130,7 @@ async function runWorkProofs(opts) {
 async function runWorkProofsCommand(opts) {
   try {
     if (opts.record) {
-      const { runWorkProofsRecord } = await import('./work-proofs-record-XPAU7N57.js');
+      const { runWorkProofsRecord } = await import('./work-proofs-record-6OKAT3IC.js');
       const result2 = await runWorkProofsRecord(opts);
       process.exitCode = result2.exitCode;
       return;