@outerlayer/cli 0.5.1 → 0.7.0

package/dist/command-FLSYCGIB.js

@@ -0,0 +1,187 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { runRunnerInstall } from './chunk-Q5G2ODUZ.js';
+import { currentLink, execStartCommand } from './chunk-TI7B7UEO.js';
+import { readJobFile } from './chunk-T6OIJQRT.js';
+import { installService, uninstallService, realTaskScheduler } from './chunk-7FTNIAHS.js';
+import './chunk-FBTE2A2X.js';
+import './chunk-OUUINEYB.js';
+import { realLima } from './chunk-77MM5RYD.js';
+import { writeLaunchAgent, launchAgentPath } from './chunk-LF6MLJCY.js';
+import { detectMachine } from './chunk-AQ54MKSQ.js';
+import './chunk-E4PIFIC3.js';
+import './chunk-CEBIA5FD.js';
+import './chunk-N5FOE5PS.js';
+import './chunk-OGFGZQA3.js';
+import './chunk-774HEQL6.js';
+import './chunk-QOZKPLVJ.js';
+import './chunk-ZOAEPWGL.js';
+import './chunk-R7STSBLC.js';
+import './chunk-DGAIVMMN.js';
+import './chunk-PUN7LMNS.js';
+import './chunk-BFESLKPP.js';
+import './chunk-SSU747O6.js';
+import './chunk-ZYHKJKSU.js';
+import './chunk-D6FXM5OW.js';
+import './chunk-USO2DKBD.js';
+import './chunk-N6LURUEF.js';
+import './chunk-YRYMNBGQ.js';
+import { runnerVmOf, loadRunnerConfig } from './chunk-DTXOJDEH.js';
+import './chunk-F6GFZXZ3.js';
+import './chunk-OD2VTIHN.js';
+import './chunk-HKMPVPO7.js';
+import './chunk-WZBHBH3J.js';
+import './chunk-5FWNEQNZ.js';
+import './chunk-ZJSNLVCE.js';
+import './chunk-ZZXLM64C.js';
+import './chunk-VXLJORHL.js';
+import './chunk-7ZR5UPMB.js';
+import './chunk-BCLJSQCV.js';
+import './chunk-BOLTI6LR.js';
+import './chunk-YNJEOGDL.js';
+import './chunk-EABW6AJQ.js';
+import './chunk-RA3O54FC.js';
+import './chunk-M5POMKKW.js';
+import './chunk-ZM2IMMYN.js';
+import './chunk-XCCLFVXM.js';
+import './chunk-BJ3KTMDH.js';
+import './chunk-VNVZDWO3.js';
+import './chunk-Z5GEFMRW.js';
+import { userInfo, totalmem } from 'os';
+import { join } from 'path';
+import { rmSync, existsSync, readdirSync, readFileSync } from 'fs';
+import { spawnSync } from 'child_process';
+
+createRequire(import.meta.url);
+async function serviceInVm(lima, instance, action, options) {
+  const limactl = lima.locate();
+  if (limactl === void 0) {
+    return { ok: false, lines: ["limactl is not installed, and the runner's service lives in the Linux VM it manages. Install Lima with `brew install lima`."] };
+  }
+  const ran = await lima.shell(instance, ["outerlayer", "runner", action, "--service", ...options.extraArgs ?? []]);
+  const lines = [...ran.stdout.split("\n"), ...ran.stderr.split("\n")].map((line) => line.trim()).filter((line) => line !== "");
+  if (ran.status !== 0) return { ok: false, lines: lines.length > 0 ? lines : [`outerlayer runner ${action} --service failed in the VM ${instance} with exit status ${ran.status}`] };
+  if (action === "install") {
+    const path = writeLaunchAgent(options.home, limactl, instance);
+    lines.push(`the VM ${instance} starts at login through ${path}`);
+  } else {
+    rmSync(launchAgentPath(options.home), { force: true });
+    lines.push("removed the launch agent that started the VM at login");
+  }
+  return { ok: true, lines };
+}
+var WSL_CONF = "/etc/wsl.conf";
+function readText(path) {
+  try {
+    return readFileSync(path, "utf8");
+  } catch {
+    return void 0;
+  }
+}
+function sudoWrite(path, text) {
+  const result = spawnSync("sudo", ["tee", path], { input: text, stdio: ["pipe", "ignore", "inherit"] });
+  if (result.status !== 0) throw new Error(`sudo tee ${path} failed with exit status ${result.status}`);
+}
+function realSystemd() {
+  return {
+    running: () => existsSync("/run/systemd/system"),
+    read: readText,
+    write: sudoWrite,
+    remove: (path) => {
+      spawnSync("sudo", ["rm", "-f", path], { stdio: ["inherit", "ignore", "inherit"] });
+    },
+    systemctl: (args, options) => {
+      const result = options?.sudo === true ? spawnSync("sudo", ["systemctl", ...args], { encoding: "utf8", stdio: ["inherit", "pipe", "inherit"] }) : spawnSync("systemctl", args, { encoding: "utf8" });
+      return { status: result.status ?? -1, stdout: result.stdout ?? "" };
+    }
+  };
+}
+function realWslConf() {
+  return { read: () => readText(WSL_CONF), write: (text) => sudoWrite(WSL_CONF, text) };
+}
+function buildsRunningIn(runnerDirPath) {
+  const jobs = join(runnerDirPath, "jobs");
+  if (!existsSync(jobs)) return false;
+  try {
+    return readdirSync(jobs, { withFileTypes: true }).some((entry) => {
+      if (!entry.isDirectory()) return false;
+      const job = readJobFile(join(jobs, entry.name, "job.json"));
+      return job === null || job.outcome === void 0 && job.endedAt === void 0;
+    });
+  } catch {
+    return true;
+  }
+}
+function realServiceDeps() {
+  const platform = detectMachine().platform;
+  return {
+    platform,
+    say: (line) => process.stdout.write(`running: ${line}
+`),
+    systemd: realSystemd(),
+    ...platform === "wsl2" ? { tasks: realTaskScheduler(), wslConf: realWslConf(), distro: process.env.WSL_DISTRO_NAME } : {},
+    usableMemoryBytes: totalmem(),
+    buildsRunning: buildsRunningIn,
+    // Asked as the account, through sudo, which the unit's own install needs anyway.
+    accountCan: (account, flag, path) => spawnSync("sudo", ["-n", "-u", account, "test", flag, path], { stdio: "ignore" }).status === 0
+  };
+}
+
+// src/runner/service/command.ts
+function accountCannotStart(account, nodePath, entry, can) {
+  if (!can(account, "-x", nodePath)) {
+    return `\u2717 the service would run as ${account}, which cannot execute ${nodePath}, the Node this install runs on. Nothing is set up: run the install as ${account} with a Node it can execute, or install Node where ${account} can reach it`;
+  }
+  if (!can(account, "-r", entry)) {
+    return `\u2717 the service would run as ${account}, which cannot read ${entry}. Nothing is set up: put the runner's config where ${account} can read it, or run the install as ${account}`;
+  }
+  return void 0;
+}
+function vmArgs(input) {
+  return [...input.print === true ? ["--print"] : [], ...input.replace === true ? ["--replace"] : [], ...input.user === void 0 ? [] : ["--user", input.user], ...input.unitName === void 0 ? [] : ["--unit-name", input.unitName]];
+}
+async function installServiceCommand(input, deps = {}) {
+  const vm = runnerVmOf(input.configPath);
+  if (vm !== void 0) {
+    const result = await serviceInVm((deps.lima ?? realLima)(), vm.instance, "install", { home: input.home, extraArgs: vmArgs(input) });
+    return { ok: result.ok, state: "vm", lines: result.lines };
+  }
+  const config = loadRunnerConfig(input.configPath);
+  if (input.print !== true && input.layoutInstalled !== true) {
+    runRunnerInstall({ configPath: input.configPath, entryPath: input.entryPath, nodePath: input.nodePath });
+  }
+  const account = input.user ?? userInfo().username;
+  const serviceDeps = (deps.service ?? realServiceDeps)();
+  if (input.print !== true && account !== userInfo().username && serviceDeps.accountCan !== void 0) {
+    const entry = join(currentLink(input.configPath), "node_modules", "@outerlayer", "cli", "dist", "index.js");
+    const problem = accountCannotStart(account, input.nodePath, entry, serviceDeps.accountCan);
+    if (problem !== void 0) return { ok: false, state: "refused", lines: [problem] };
+  }
+  const outcome = installService(
+    {
+      configPath: input.configPath,
+      hooks: config.hooks,
+      concurrency: config.concurrency,
+      buildMemory: config.build?.memory ?? "8g",
+      timeLimitMinutes: config.timeLimitMinutes,
+      execStart: execStartCommand(input.configPath, input.nodePath),
+      user: account,
+      unitName: input.unitName,
+      print: input.print,
+      replace: input.replace
+    },
+    serviceDeps
+  );
+  return { ok: outcome.ok, state: outcome.state, lines: outcome.lines, unit: outcome.unit };
+}
+async function uninstallServiceCommand(input, deps = {}) {
+  const vm = runnerVmOf(input.configPath);
+  if (vm !== void 0) {
+    const result = await serviceInVm((deps.lima ?? realLima)(), vm.instance, "uninstall", { home: input.home, extraArgs: input.unitName === void 0 ? [] : ["--unit-name", input.unitName] });
+    return { ok: result.ok, state: "vm", lines: result.lines };
+  }
+  const outcome = uninstallService({ configPath: input.configPath, unitName: input.unitName }, (deps.service ?? realServiceDeps)());
+  return { ok: outcome.ok, state: outcome.state, lines: outcome.lines };
+}
+
+export { installServiceCommand, uninstallServiceCommand };

package/dist/config-I3TVFYLH.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+export { DEFAULT_CHECK_TIME_LIMIT_MINUTES, RunnerConfigError, builtinKind, checkHooks, defaultRunnerConfigPath, hasRunnerBlock, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, loadRunnerConfig, resolveBuild, runnerVmOf } from './chunk-DTXOJDEH.js';
+import './chunk-F6GFZXZ3.js';
+import './chunk-OD2VTIHN.js';
+import './chunk-HKMPVPO7.js';
+import './chunk-VNVZDWO3.js';
+import './chunk-Z5GEFMRW.js';
+
+createRequire(import.meta.url);

package/dist/{connect-cmd-OJBFHZWP.js → connect-cmd-MJMUONDY.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { promptOnTerminal, realConnectDeps, runConnect, runConnectCommand } from './chunk-OR6AEEDO.js';
-import './chunk-D2KWEAN6.js';
-import './chunk-WOBNRVQT.js';
-import './chunk-EX6M5JPR.js';
+export { connectedLine, fetchFactories, promptOnTerminal, realConnectDeps, runConnect, runConnectCommand, saveFactoryConnection, selectFactory } from './chunk-SSU747O6.js';
+import './chunk-ZYHKJKSU.js';
+import './chunk-D6FXM5OW.js';
 import './chunk-USO2DKBD.js';
 import './chunk-N6LURUEF.js';
 import './chunk-YRYMNBGQ.js';
 import './chunk-BOLTI6LR.js';
+import './chunk-YNJEOGDL.js';
 import './chunk-EABW6AJQ.js';
 import './chunk-BJ3KTMDH.js';
 import './chunk-VNVZDWO3.js';

package/dist/{context-adopt-UMA4O5NY.js → context-adopt-CE4KDXS3.js}

@@ -1,12 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { defaultGitRunner, hasSymlinkComponent } from './chunk-XDDW4FRS.js';
-import { writeContextManifest, writePinIfChanged, touchLastCheck, clearDegraded, writeSourceCache, SOURCE_CACHE_TTL_SUCCESS_MS, writeBuildHold } from './chunk-WIOZAJ2W.js';
-import './chunk-WO2BXCTQ.js';
-import './chunk-EMY4I27X.js';
+import { defaultGitRunner, hasSymlinkComponent } from './chunk-5FWNEQNZ.js';
 import './chunk-ZJSNLVCE.js';
+import { writeContextManifest, writePinIfChanged, touchLastCheck, clearDegraded, writeSourceCache, SOURCE_CACHE_TTL_SUCCESS_MS, writeBuildHold } from './chunk-ZZXLM64C.js';
+import './chunk-VXLJORHL.js';
+import './chunk-7ZR5UPMB.js';
 import './chunk-BCLJSQCV.js';
 import './chunk-BOLTI6LR.js';
+import './chunk-YNJEOGDL.js';
 import './chunk-EABW6AJQ.js';
 import './chunk-RA3O54FC.js';
 import './chunk-M5POMKKW.js';

package/dist/{context-materialize-G2FUFC72.js → context-materialize-QL33HDJN.js}

@@ -1,12 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { defaultGitRunner, hasSymlinkComponent, materializeContext, parseOwnerRepo, parseRemoteHost, resolveGitCommonDir } from './chunk-XDDW4FRS.js';
-import './chunk-WIOZAJ2W.js';
-import './chunk-WO2BXCTQ.js';
-import './chunk-EMY4I27X.js';
+export { defaultGitRunner, hasSymlinkComponent, materializeContext, parseOwnerRepo, parseRemoteHost, resolveGitCommonDir } from './chunk-5FWNEQNZ.js';
 import './chunk-ZJSNLVCE.js';
+import './chunk-ZZXLM64C.js';
+import './chunk-VXLJORHL.js';
+import './chunk-7ZR5UPMB.js';
 import './chunk-BCLJSQCV.js';
 import './chunk-BOLTI6LR.js';
+import './chunk-YNJEOGDL.js';
 import './chunk-EABW6AJQ.js';
 import './chunk-RA3O54FC.js';
 import './chunk-M5POMKKW.js';

package/dist/{dist-WDV7U7UJ.js → dist-PXBSA7QX.js}

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { CaptureDaemon, PRICE_TABLE_SOURCE, SECRET_PATTERNS, SOURCE_ADAPTERS, SUPPORTED_VERSIONS, StatuslineAggregator, WARNING_CODES, claudeCodeAdapter, codexAdapter, codexSessionIdFromPath, compareVersions, completePrefix, computeStatuslineState, costOfUsage, cursorAdapter, cursorChatIdFromPath, defaultCodexSessionsDir, defaultCursorChatsDir, defaultCursorProjectsDir, defaultProjectsDir, defaultRawDir, enrichSessionRepo, findCodexRollouts, findCursorChats, findTranscripts, isNewerThanSupported, isPriceKnown, normalizeErrorSignature, normalizeRemote, parseCodexRollout, parseCursorChat, parseTranscript, readStatuslineState, readSyncWatermarkMs, remoteLookupFailed, resolvePrice, resolveRepoIdentity, rootChildIds, scanAll, scrubDeep, scrubText, sessionIdFromPath, setCustomScrubbers, setLocalIdentity, setRepoRoot, statuslineStatePath, tailTranscript, workspacesByHash, writeStatuslineState } from './chunk-EX6M5JPR.js';
+export { CaptureDaemon, PRICE_TABLE_SOURCE, SECRET_PATTERNS, SOURCE_ADAPTERS, SUPPORTED_VERSIONS, StatuslineAggregator, WARNING_CODES, claudeCodeAdapter, codexAdapter, codexSessionIdFromPath, compareVersions, completePrefix, computeStatuslineState, costOfUsage, cursorAdapter, cursorChatIdFromPath, defaultCodexSessionsDir, defaultCursorChatsDir, defaultCursorProjectsDir, defaultProjectsDir, defaultRawDir, enrichSessionRepo, findCodexRollouts, findCursorChats, findTranscripts, isNewerThanSupported, isPriceKnown, normalizeErrorSignature, normalizeRemote, parseCodexRollout, parseCursorChat, parseTranscript, readStatuslineState, readSyncWatermarkMs, remoteLookupFailed, resolvePrice, resolveRepoIdentity, rootChildIds, scanAll, scrubDeep, scrubText, sessionIdFromPath, setCustomScrubbers, setLocalIdentity, setRepoRoot, statuslineStatePath, tailTranscript, workspacesByHash, writeStatuslineState } from './chunk-D6FXM5OW.js';
+import './chunk-YNJEOGDL.js';
 import './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);

package/dist/{doctor-MOA3RIEP.js → doctor-FVDT3KJZ.js}

@@ -1,33 +1,40 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { needsClaudeCredential, claudeCredentialCheck, missingPermissionOf, missingPermissionFix } from './chunk-CHLVJNTE.js';
+import { needsClaudeCredential, claudeCredentialCheck, missingPermissionOf, missingPermissionFix } from './chunk-6IYLDODX.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import './chunk-W7UTFZDH.js';
-import { detectMachine, supportsContainerBuilds, describeMachineDocker, reachDockerStep, supportsMicroVmBuilds, microVmArchSupported, microVmAssetsPinned } from './chunk-RTXKYLCA.js';
-import { MIN_ENGINE_MAJOR } from './chunk-T52PKE2Y.js';
-import { CLAUDE_CODE_VERSION } from './chunk-Z62HNKEJ.js';
+import './chunk-6QWV3YDJ.js';
+import { detectMachine, supportsContainerBuilds, describeMachineDocker, reachDockerStep, supportsMicroVmBuilds, microVmArchSupported, microVmAssetsPinned } from './chunk-AQ54MKSQ.js';
+import { MIN_ENGINE_MAJOR } from './chunk-E4PIFIC3.js';
+import { CLAUDE_CODE_VERSION } from './chunk-CEBIA5FD.js';
 import './chunk-N5FOE5PS.js';
 import './chunk-OGFGZQA3.js';
 import { resolveDevcontainerCli } from './chunk-774HEQL6.js';
 import { locateRecipe, assertBuildable, readRecipe, RecipeError } from './chunk-QOZKPLVJ.js';
-import './chunk-W4SQCOZU.js';
-import './chunk-B2G7JHHB.js';
-import { getJson, WorkCommandError, signatureRefusalMessage } from './chunk-RMAZ2NWA.js';
+import './chunk-ZOAEPWGL.js';
+import './chunk-R7STSBLC.js';
+import { getJson, WorkCommandError, signatureRefusalMessage } from './chunk-DGAIVMMN.js';
+import './chunk-PUN7LMNS.js';
 import './chunk-BFESLKPP.js';
-import './chunk-WOBNRVQT.js';
-import { compareVersions } from './chunk-EX6M5JPR.js';
-import { builtinKind } from './chunk-3DD6AOWC.js';
+import './chunk-SSU747O6.js';
+import './chunk-ZYHKJKSU.js';
+import { compareVersions } from './chunk-D6FXM5OW.js';
+import './chunk-USO2DKBD.js';
+import './chunk-N6LURUEF.js';
+import './chunk-YRYMNBGQ.js';
+import { builtinKind } from './chunk-DTXOJDEH.js';
 import { parseSize } from './chunk-F6GFZXZ3.js';
-import './chunk-AUFG23AA.js';
+import './chunk-OD2VTIHN.js';
+import './chunk-HKMPVPO7.js';
 import './chunk-WZBHBH3J.js';
-import { defaultGitRunner } from './chunk-XDDW4FRS.js';
-import './chunk-WIOZAJ2W.js';
-import './chunk-WO2BXCTQ.js';
-import './chunk-EMY4I27X.js';
+import { defaultGitRunner } from './chunk-5FWNEQNZ.js';
 import './chunk-ZJSNLVCE.js';
+import './chunk-ZZXLM64C.js';
+import './chunk-VXLJORHL.js';
+import './chunk-7ZR5UPMB.js';
 import { defaultFetch } from './chunk-BCLJSQCV.js';
 import './chunk-BOLTI6LR.js';
+import './chunk-YNJEOGDL.js';
 import './chunk-EABW6AJQ.js';
 import './chunk-RA3O54FC.js';
 import { loadHostKey } from './chunk-M5POMKKW.js';
@@ -46,8 +53,17 @@ createRequire(import.meta.url);
 // src/runner/microvm/doctor.ts
 var GIB = 1024 ** 3;
 var gib = (bytes) => `${Number((bytes / GIB).toFixed(1))} GiB`;
-function kvmCheck(machine) {
+function kvmCheck(machine, service) {
   const name = "KVM";
+  if (service?.hasKvmGroup !== void 0 && machine.kvm?.state !== "absent" && machine.kvm !== void 0) {
+    if (service.hasKvmGroup) return { name, status: "pass", detail: `the service ${service.unit} has the group that owns /dev/kvm, so each build runs in a microVM of its own` };
+    return {
+      name,
+      status: "fail",
+      detail: `the service ${service.unit} cannot open /dev/kvm: its main process is not in the kvm group, so every build fails at provision, even if this shell can open it`,
+      fix: `sudo usermod -aG ${machine.kvm.group ?? "kvm"} <the service's account>, then restart the service: sudo systemctl restart ${service.unit}. A service reads its groups only when it starts`
+    };
+  }
   const kvm = machine.kvm;
   if (kvm?.state === "usable") return { name, status: "pass", detail: "this user can open /dev/kvm, so each build runs in a microVM of its own" };
   if (kvm?.state === "no-permission") {
@@ -88,6 +104,16 @@ function memoryCheck(input) {
     fix: "lower runner.concurrency or runner.build.memory, or run the runner on a host with more memory"
   };
 }
+function delegationCheck(service) {
+  const name = "MicroVM memory limit";
+  if (service.delegate !== false) return { name, status: "pass", detail: `the service ${service.unit} is delegated its cgroup, so each microVM build gets a memory limit of its own` };
+  return {
+    name,
+    status: "warn",
+    detail: `the service ${service.unit} does not set Delegate=yes, so microVM builds have no limit of their own: one build that uses too much memory can take the others with it`,
+    fix: "run `outerlayer runner install --service --replace` to write the unit this CLI generates, which sets Delegate=yes"
+  };
+}
 
 // src/runner/image/doctor.ts
 var LATEST_URL = "https://registry.npmjs.org/@anthropic-ai/claude-code/latest";
@@ -419,11 +445,12 @@ async function runnerHostChecks(env) {
     },
     ...env.hooks === void 0 ? [] : [isolationCheck(env.machine ?? detectMachine(), env.hooks)],
     ...env.hooks !== void 0 && builtinKind(env.hooks.provision) === "vm" ? [
-      kvmCheck(env.machine ?? detectMachine()),
+      kvmCheck(env.machine ?? detectMachine(), env.service),
+      ...env.service === void 0 ? [] : [delegationCheck(env.service)],
       ...env.runner === void 0 ? [] : [memoryCheck({ concurrency: env.runner.concurrency, buildMemory: env.runner.buildMemory, hostMemory: env.hostMemory ?? totalmem() })]
     ] : [],
     ...env.runner?.minFreeDisk === void 0 ? [] : [freeDiskCheck(env.configPath, env.runner.minFreeDisk, env.freeBytes ?? freeBytes)],
-    ...env.hooks !== void 0 && needsClaudeCredential(env.hooks) ? [claudeCredentialCheck(env.env ?? process.env, { shell: true })] : [],
+    ...env.hooks !== void 0 && needsClaudeCredential(env.hooks) ? [claudeCredentialCheck(env.env ?? process.env, env.service === void 0 ? { shell: true } : { service: { unit: env.service.unit, variables: env.service.credentialVariables } })] : [],
     ...env.gateway === void 0 ? [] : [await hostKeyBindingCheck(env.configPath, env.gateway, env.fetchImpl ?? defaultFetch)],
     ...env.gateway === void 0 || env.hooks === void 0 || !["container", "vm"].includes(builtinKind(env.hooks.provision)) ? [] : [await controlPlaneAccessCheck({ ...env, gateway: env.gateway }, env.fetchImpl ?? defaultFetch)],
     devcontainerRunnable() ? { name: "Devcontainer CLI", status: "pass", detail: "installed beside the outerlayer CLI" } : {

package/dist/{emit-artifact-cmd-FDWYKURA.js → emit-artifact-cmd-7RPMRSVP.js}

@@ -1,25 +1,29 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { staleBuildRefusal, staleBuildWarning } from './chunk-EGABNHZG.js';
-import { detectCi } from './chunk-ZOC7JSYC.js';
-import { launchRefusalForSession } from './chunk-BCJNHMZT.js';
+import { staleBuildRefusal, staleBuildWarning, detectCi } from './chunk-6ZZHWY2Z.js';
+import { launchRefusalForSession } from './chunk-HHJDN6AU.js';
 import './chunk-TBT347UY.js';
 import './chunk-F7CU5ABH.js';
 import './chunk-BKO6JEZI.js';
+import { autoConnect } from './chunk-PUN7LMNS.js';
 import { detectActiveSession } from './chunk-BFESLKPP.js';
-import { readEffectiveArtifactSpoolState, localArtifactIds, isArtifactTombstoned, artifactBlobsDir, appendArtifactRecord, artifactsSpoolPath, findPendingArtifactRecord, appendArtifactTombstone } from './chunk-WOBNRVQT.js';
-import { ARTIFACT_MAX_CAPTION_LENGTH, ArtifactCriterionIdSchema, ARTIFACT_MAX_FILENAME_LENGTH, mediaTypeForArtifactPath, inferArtifactKind, resolveRepoIdentity, ARTIFACT_MAX_REPLACES_TARGETS, parseTestSelector, parseJunit, bindTests } from './chunk-EX6M5JPR.js';
+import './chunk-SSU747O6.js';
+import { readEffectiveArtifactSpoolState, localArtifactIds, isArtifactTombstoned, artifactBlobsDir, appendArtifactRecord, artifactsSpoolPath, findPendingArtifactRecord, appendArtifactTombstone } from './chunk-ZYHKJKSU.js';
+import { resolveRepoIdentity } from './chunk-D6FXM5OW.js';
+import './chunk-USO2DKBD.js';
+import './chunk-N6LURUEF.js';
 import './chunk-YRYMNBGQ.js';
-import './chunk-DVDEBNQJ.js';
+import './chunk-GQD22KKN.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import './chunk-5QRP3MVS.js';
 import './chunk-ZJSNLVCE.js';
 import { defaultFetch } from './chunk-BCLJSQCV.js';
 import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-BOLTI6LR.js';
+import { ARTIFACT_MAX_CAPTION_LENGTH, ArtifactCriterionIdSchema, ARTIFACT_MAX_FILENAME_LENGTH, mediaTypeForArtifactPath, inferArtifactKind, ARTIFACT_MAX_REPLACES_TARGETS, parseTestSelector, parseJunit, bindTests } from './chunk-YNJEOGDL.js';
 import './chunk-EABW6AJQ.js';
 import './chunk-M5POMKKW.js';
 import './chunk-ZM2IMMYN.js';
-import './chunk-UFFXNXLQ.js';
+import './chunk-JPR2WHHF.js';
 import './chunk-XCCLFVXM.js';
 import './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
@@ -320,6 +324,8 @@ async function runEmitArtifact(opts) {
       "nothing to attach this to \u2014 no recorded session, no PR, and no git repo. Run inside a recorded Claude Code session, from a git checkout, in CI with PR context, or pass --pr <number>."
     );
   }
+  const noFactory = await autoConnect({ ...opts, home, env });
+  if (noFactory !== void 0) throw new EmitArtifactError(noFactory);
   const resolved = resolveGatewayCredentials({ ...opts, home, env });
   if (!resolved.ok) throw new EmitArtifactError(resolved.message);
   const { url, credential: apiKey, appId } = resolved;

package/dist/{emit-cmd-DCERAU27.js → emit-cmd-2QRMYPYO.js}

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { EmitError, runEmit } from './chunk-H5NCNVDA.js';
-import './chunk-WO2BXCTQ.js';
-import './chunk-EMY4I27X.js';
+export { EmitError, runEmit } from './chunk-EV3M3EH7.js';
+import './chunk-VXLJORHL.js';
+import './chunk-7ZR5UPMB.js';
+import './chunk-YNJEOGDL.js';
 import './chunk-RA3O54FC.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/{emit-criteria-cmd-OCXHLK34.js → emit-criteria-cmd-MKI7WETO.js}

@@ -1,12 +1,19 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { launchRefusalForSession } from './chunk-BCJNHMZT.js';
+import { launchRefusalForSession } from './chunk-HHJDN6AU.js';
+import { autoConnect } from './chunk-PUN7LMNS.js';
 import { detectActiveSession } from './chunk-BFESLKPP.js';
-import { resolveRepoIdentity, CriteriaListSchema } from './chunk-EX6M5JPR.js';
-import { launchedItemForSession } from './chunk-DVDEBNQJ.js';
+import './chunk-SSU747O6.js';
+import './chunk-ZYHKJKSU.js';
+import { resolveRepoIdentity } from './chunk-D6FXM5OW.js';
+import './chunk-USO2DKBD.js';
+import './chunk-N6LURUEF.js';
+import './chunk-YRYMNBGQ.js';
+import { launchedItemForSession } from './chunk-GQD22KKN.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { defaultFetch } from './chunk-BCLJSQCV.js';
 import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-BOLTI6LR.js';
+import { CriteriaListSchema } from './chunk-YNJEOGDL.js';
 import './chunk-EABW6AJQ.js';
 import './chunk-M5POMKKW.js';
 import './chunk-ZM2IMMYN.js';
@@ -120,6 +127,8 @@ async function runEmitCriteria(opts) {
     nowMs: now().getTime()
   });
   const target = resolveTarget({ item: opts.item, sessionId, home });
+  const refusal = await autoConnect({ url: opts.url, apiKey: opts.apiKey, appId: opts.appId, cwd, home, env, fetchImpl: opts.fetchImpl });
+  if (refusal !== void 0) throw new EmitCriteriaError(refusal);
   const resolved = resolveGatewayCredentials({ url: opts.url, apiKey: opts.apiKey, appId: opts.appId, cwd, home, env });
   if (!resolved.ok) throw new EmitCriteriaError(resolved.message);
   const { url, credential: apiKey, appId } = resolved;

package/dist/{emit-finding-cmd-POW7PKIA.js → emit-finding-cmd-RMLGZASB.js}

@@ -1,13 +1,20 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { launchRefusalForSession } from './chunk-BCJNHMZT.js';
+import { launchRefusalForSession } from './chunk-HHJDN6AU.js';
+import { autoConnect } from './chunk-PUN7LMNS.js';
 import { detectActiveSession } from './chunk-BFESLKPP.js';
-import { FindingBatchSchema, resolveRepoIdentity } from './chunk-EX6M5JPR.js';
-import { launchedItemForSession } from './chunk-DVDEBNQJ.js';
+import './chunk-SSU747O6.js';
+import './chunk-ZYHKJKSU.js';
+import { resolveRepoIdentity } from './chunk-D6FXM5OW.js';
+import './chunk-USO2DKBD.js';
+import './chunk-N6LURUEF.js';
+import './chunk-YRYMNBGQ.js';
+import { launchedItemForSession } from './chunk-GQD22KKN.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { readLatestProvenanceForSession } from './chunk-ZJSNLVCE.js';
 import { defaultFetch } from './chunk-BCLJSQCV.js';
 import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-BOLTI6LR.js';
+import { FindingBatchSchema } from './chunk-YNJEOGDL.js';
 import './chunk-EABW6AJQ.js';
 import './chunk-M5POMKKW.js';
 import './chunk-ZM2IMMYN.js';
@@ -117,6 +124,8 @@ function resolveUploadTarget(opts) {
   return { item: { number: launchedNumber }, sessionId };
 }
 async function upload(batch, target, opts) {
+  const refusal = await autoConnect(opts);
+  if (refusal !== void 0) throw new EmitFindingError(refusal);
   const resolved = resolveGatewayCredentials(opts);
   if (!resolved.ok) throw new EmitFindingError(resolved.message);
   const { url, credential: apiKey, appId } = resolved;
@@ -187,6 +196,7 @@ async function runEmitFinding(opts) {
     url: opts.url,
     apiKey: opts.apiKey,
     appId: opts.appId,
+    cwd,
     quiet: opts.quiet,
     home,
     env,
@@ -230,6 +240,7 @@ async function runEmitFindings(opts) {
     url: opts.url,
     apiKey: opts.apiKey,
     appId: opts.appId,
+    cwd,
     quiet: opts.quiet,
     home,
     env,

package/dist/{emit-result-cmd-ID35SH53.js → emit-result-cmd-MTXAZ2GV.js}

@@ -1,25 +1,29 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import './chunk-EGABNHZG.js';
-import { detectCi } from './chunk-ZOC7JSYC.js';
-import { launchRefusalForSession } from './chunk-BCJNHMZT.js';
+import { detectCi } from './chunk-6ZZHWY2Z.js';
+import { launchRefusalForSession } from './chunk-HHJDN6AU.js';
 import './chunk-TBT347UY.js';
 import './chunk-F7CU5ABH.js';
 import './chunk-BKO6JEZI.js';
+import { autoConnect } from './chunk-PUN7LMNS.js';
 import { detectActiveSession } from './chunk-BFESLKPP.js';
-import './chunk-WOBNRVQT.js';
-import { EmittedNameSchema, EMITTED_RESULT_MAX_LINK_LENGTH, EMITTED_RESULTS, EMITTED_RESULT_MAX_BODY_LENGTH, resolveRepoIdentity } from './chunk-EX6M5JPR.js';
+import './chunk-SSU747O6.js';
+import './chunk-ZYHKJKSU.js';
+import { resolveRepoIdentity } from './chunk-D6FXM5OW.js';
+import './chunk-USO2DKBD.js';
+import './chunk-N6LURUEF.js';
 import './chunk-YRYMNBGQ.js';
-import './chunk-DVDEBNQJ.js';
+import './chunk-GQD22KKN.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import './chunk-5QRP3MVS.js';
 import './chunk-ZJSNLVCE.js';
 import { defaultFetch } from './chunk-BCLJSQCV.js';
 import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-BOLTI6LR.js';
+import { EmittedNameSchema, EMITTED_RESULT_MAX_LINK_LENGTH, EMITTED_RESULTS, EMITTED_RESULT_MAX_BODY_LENGTH } from './chunk-YNJEOGDL.js';
 import './chunk-EABW6AJQ.js';
 import './chunk-M5POMKKW.js';
 import './chunk-ZM2IMMYN.js';
-import './chunk-UFFXNXLQ.js';
+import './chunk-JPR2WHHF.js';
 import './chunk-XCCLFVXM.js';
 import './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
@@ -128,14 +132,16 @@ async function runEmitResult(opts) {
     );
   }
   if (sessionId !== void 0) {
-    const refusal = launchRefusalForSession(sessionId, home);
-    if (refusal !== void 0) throw new EmitResultError(refusal);
+    const refusal2 = launchRefusalForSession(sessionId, home);
+    if (refusal2 !== void 0) throw new EmitResultError(refusal2);
   }
   if (item === void 0) {
     throw new EmitResultError(
       "nothing to attach this to \u2014 no work item. Pass --item <number>; a recorded session alone does not name one."
     );
   }
+  const refusal = await autoConnect({ ...opts, home, env });
+  if (refusal !== void 0) throw new EmitResultError(refusal);
   const resolved = resolveGatewayCredentials({ ...opts, home, env });
   if (!resolved.ok) throw new EmitResultError(resolved.message);
   const { url, credential: apiKey, appId } = resolved;

package/dist/{exec-client-4XGXV3XN.js → exec-client-NPYNUAF3.js}

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { CAPTURE_LIMIT_BYTES, ExecConnectionError, HANDSHAKE_TIMEOUT_MS, execCapture, runExec, runVmExec, vmExecArgs, waitForAgent } from './chunk-W4SQCOZU.js';
-import './chunk-B2G7JHHB.js';
-import './chunk-AUFG23AA.js';
+export { CAPTURE_LIMIT_BYTES, ExecConnectionError, HANDSHAKE_TIMEOUT_MS, execCapture, runExec, runVmExec, vmExecArgs, waitForAgent } from './chunk-ZOAEPWGL.js';
+import './chunk-R7STSBLC.js';
+import './chunk-OD2VTIHN.js';
+import './chunk-HKMPVPO7.js';
 import './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);

package/dist/{guest-init-GENRHNP7.js → guest-init-JWNNAH2H.js}

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { DOCKERD_LOG, HELPER_PATH, realGuestHost, relayPortsFrom, runGuestInit } from './chunk-CBPPJSAR.js';
-import './chunk-B2G7JHHB.js';
-import './chunk-AUFG23AA.js';
+export { DOCKERD_LOG, HELPER_PATH, realGuestHost, relayPortsFrom, runGuestInit } from './chunk-WVGSB3Z2.js';
+import './chunk-R7STSBLC.js';
+import './chunk-OD2VTIHN.js';
+import './chunk-HKMPVPO7.js';
 import './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);

package/dist/{hook-fast-EYENPK6F.js → hook-fast-XBOZ3N6L.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { AUTO_SYNC_DEBOUNCE_MS, WORK_LEASE_RENEW_DEBOUNCE_MS, WORK_LINK_RETRIES, contextPossiblyGoverned, handleWorkLaunch, handleWorkSessionEnd, hookFiredMarkerPath, maybeAutoSync, maybeRenewWorkLease, runHookFast, spoolDir } from './chunk-UFFXNXLQ.js';
+export { AUTO_SYNC_DEBOUNCE_MS, WORK_LEASE_RENEW_DEBOUNCE_MS, WORK_LINK_RETRIES, contextPossiblyGoverned, handleWorkLaunch, handleWorkSessionEnd, hookFiredMarkerPath, logHookError, maybeAutoSync, maybeRenewWorkLease, recordLinkExitFailure, runHookFast, spoolDir } from './chunk-JPR2WHHF.js';
 import './chunk-XCCLFVXM.js';
 import './chunk-BJ3KTMDH.js';
 import './chunk-VNVZDWO3.js';

package/dist/{import-capture-cmd-AVZ4VIVJ.js → import-capture-cmd-T4556ELW.js}

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-WO2BXCTQ.js';
-import './chunk-EMY4I27X.js';
+import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-VXLJORHL.js';
+import './chunk-7ZR5UPMB.js';
+import './chunk-YNJEOGDL.js';
 import './chunk-RA3O54FC.js';
 import './chunk-Z5GEFMRW.js';
 import { statSync, existsSync, readFileSync, writeFileSync } from 'fs';

package/dist/{import-ruler-cmd-GUHL6IY5.js → import-ruler-cmd-SG3UVGI7.js}

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { normalizePath } from './chunk-EMY4I27X.js';
+import { normalizePath } from './chunk-7ZR5UPMB.js';
+import './chunk-YNJEOGDL.js';
 import './chunk-Z5GEFMRW.js';
 import { existsSync, readdirSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import { join, dirname } from 'path';