@outerlayer/cli 0.6.0 → 0.7.0

package/dist/{chunk-BNMCXPG7.js → chunk-DGAIVMMN.js}

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
+import { autoConnect } from './chunk-PUN7LMNS.js';
 import { detectActiveSession } from './chunk-BFESLKPP.js';
-import { sanitizeTerminal } from './chunk-3DEVYTNQ.js';
-import { resolveRepoIdentity } from './chunk-ANK2B36Y.js';
+import { sanitizeTerminal } from './chunk-ZYHKJKSU.js';
+import { resolveRepoIdentity } from './chunk-D6FXM5OW.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { defaultFetch } from './chunk-BCLJSQCV.js';
 import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-BOLTI6LR.js';
@@ -79,6 +80,10 @@ function resolveCredentials(opts) {
   if (!resolved.ok) throw new WorkCommandError(resolved.message);
   return { url: resolved.url, apiKey: resolved.credential, appId: resolved.appId };
 }
+async function connectIfOneFits(opts) {
+  const refusal = await autoConnect(opts);
+  if (refusal !== void 0) throw new WorkCommandError(refusal);
+}
 function resolveRepository(repoFlag, cwd) {
   if (repoFlag) return repoFlag;
   const identity = resolveRepoIdentity(cwd);
@@ -299,6 +304,7 @@ async function runWorkBuild(opts) {
   const cwd = opts.cwd ?? process.cwd();
   const env = opts.env ?? process.env;
   const home = opts.home ?? homeFromEnv(env);
+  await connectIfOneFits(opts);
   const { url, apiKey, appId } = resolveCredentials(opts);
   const fetchImpl = opts.fetchImpl ?? defaultFetch;
   const facts = environmentFacts({ cwd, env, home, sessionIdOverride: opts.sessionId });
@@ -341,7 +347,7 @@ async function runWorkLinkSession(opts) {
     return await linkSession(opts);
   } catch (err) {
     if (opts.logFailures) {
-      const { logHookError } = await import('./hook-fast-NJBBZQ5Q.js');
+      const { logHookError } = await import('./hook-fast-XBOZ3N6L.js');
       const reason = err instanceof Error ? err.message : String(err);
       logHookError(opts.home ?? homeFromEnv(opts.env ?? process.env), new Error(`work link-session #${opts.number} failed: ${reason}`));
     }
@@ -389,6 +395,7 @@ async function runWorkRemove(opts) {
   const cwd = opts.cwd ?? process.cwd();
   const env = opts.env ?? process.env;
   const home = opts.home ?? homeFromEnv(env);
+  await connectIfOneFits(opts);
   const creds = resolveCredentials(opts);
   if (!opts.reason) {
     throw new WorkCommandError("--reason is required \u2014 a removal records why");
@@ -432,6 +439,7 @@ async function runWorkRemove(opts) {
 }
 async function runWorkStatus(opts) {
   const cwd = opts.cwd ?? process.cwd();
+  await connectIfOneFits(opts);
   const creds = resolveCredentials(opts);
   const fetchByItem = opts.item !== void 0 ? parsePositiveInt(opts.item, "--item") : void 0;
   if (fetchByItem !== void 0) {
@@ -461,6 +469,7 @@ async function runWorkStatus(opts) {
 }
 async function runWorkList(opts) {
   const cwd = opts.cwd ?? process.cwd();
+  await connectIfOneFits(opts);
   const { url, apiKey, appId } = resolveCredentials(opts);
   const fetchImpl = opts.fetchImpl ?? defaultFetch;
   const repository = opts.repo ?? resolveRepoIdentity(cwd).gitRepo;

package/dist/{chunk-3DD6AOWC.js → chunk-DTXOJDEH.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { parseSize, MAX_ALLOW_HOSTS, allowHostProblem } from './chunk-F6GFZXZ3.js';
-import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-AUFG23AA.js';
+import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-OD2VTIHN.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { existsSync, statSync, accessSync, constants, readFileSync } from 'fs';
 import { hostname } from 'os';
@@ -30,6 +30,9 @@ var DEFAULT_CONCURRENCY = 1;
 var DEFAULT_POLL_SECONDS = 60;
 var DEFAULT_TIME_LIMIT_MINUTES = 480;
 var DEFAULT_IDLE_LIMIT_MINUTES = 30;
+var DEFAULT_CHECK_TIME_LIMIT_MINUTES = 10;
+var CHECKS_KEYS = ["timeLimitMinutes"];
+var MAX_CHECK_TIME_LIMIT_MINUTES = 240;
 var DEFAULT_BUILD = { memory: "8g", cpus: 4, pids: 4096, disk: "40g", variables: [] };
 var BUILD_KEYS = ["memory", "cpus", "pids", "disk", "variables", "destinations", "allowHosts"];
 var HOUSEKEEPING_KEYS = ["jobsKeepDays", "buildCacheMax", "minFreeDisk"];
@@ -81,6 +84,7 @@ var RUNNER_KEYS = [
   "hooks",
   "build",
   "housekeeping",
+  "checks",
   "autoUpdate"
 ];
 function runnerNumbers() {
@@ -199,6 +203,7 @@ function loadRunnerConfig(configPath) {
   checkBuiltinHooks(configPath, runner.hooks);
   const build = resolveBuild(configPath, runner.build);
   const housekeeping = resolveHousekeeping(configPath, runner.housekeeping, build.disk);
+  const checks = resolveChecks(configPath, runner.checks);
   if (config.scrub?.literals !== void 0 && !Array.isArray(config.scrub.literals)) {
     fail(configPath, "scrub.literals", "must be a list of strings");
   }
@@ -226,6 +231,7 @@ function loadRunnerConfig(configPath) {
     },
     build,
     housekeeping,
+    checks,
     // A host with executables of its own for provision and cleanup chose
     // its own environment, and an update could change what its hooks run
     // under; it opts in. The built-in hooks are the runner's own. Provision
@@ -275,6 +281,24 @@ function resolveHousekeeping(configPath, block, buildDisk) {
   if (minFreeDisk === void 0) fail(configPath, "runner.housekeeping.minFreeDisk", 'must be a size such as "40g"');
   return { jobsKeepDays: keys.jobsKeepDays ?? DEFAULT_JOBS_KEEP_DAYS, buildCacheMax, minFreeDisk };
 }
+function resolveChecks(configPath, block) {
+  const given = block ?? {};
+  if (typeof given !== "object" || Array.isArray(given)) fail(configPath, "runner.checks", "must be an object");
+  const keys = given;
+  for (const key of Object.keys(keys)) {
+    if (CHECKS_KEYS.includes(key)) continue;
+    const near = nearestKey(key, CHECKS_KEYS);
+    fail(configPath, `runner.checks.${key}`, near ? `is not a key this block accepts; did you mean ${near}?` : "is not a key this block accepts");
+  }
+  const limit = keys.timeLimitMinutes === void 0 ? DEFAULT_CHECK_TIME_LIMIT_MINUTES : keys.timeLimitMinutes;
+  if (!Number.isInteger(limit) || limit < 1) {
+    fail(configPath, "runner.checks.timeLimitMinutes", "must be a whole number of at least 1");
+  }
+  if (limit > MAX_CHECK_TIME_LIMIT_MINUTES) {
+    fail(configPath, "runner.checks.timeLimitMinutes", `must be at most ${MAX_CHECK_TIME_LIMIT_MINUTES}`);
+  }
+  return { timeLimitMinutes: limit };
+}
 function wholeBytes(bytes) {
   if (bytes === void 0) return void 0;
   const whole = Math.floor(bytes);
@@ -334,4 +358,4 @@ function resolveBuild(configPath, block) {
   };
 }
 
-export { RunnerConfigError, builtinKind, checkHooks, defaultRunnerConfigPath, hasRunnerBlock, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, loadRunnerConfig, resolveBuild, runnerVmOf };
+export { DEFAULT_CHECK_TIME_LIMIT_MINUTES, RunnerConfigError, builtinKind, checkHooks, defaultRunnerConfigPath, hasRunnerBlock, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, loadRunnerConfig, resolveBuild, runnerVmOf };

package/dist/{chunk-RZSF5B46.js → chunk-E4PIFIC3.js}

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, CLAUDE_CODE_VERSION, firecrackerArch, MICROVM_ARCHES, DEFAULT_BASE_IMAGE, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GUEST_ASSETS_VERSION } from './chunk-Z62HNKEJ.js';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage, CLAUDE_CODE_VERSION, firecrackerArch, MICROVM_ARCHES, DEFAULT_BASE_IMAGE, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GUEST_ASSETS_VERSION } from './chunk-CEBIA5FD.js';
 import { startTimeOf, isSameProcess } from './chunk-N5FOE5PS.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
 import { createDockerHost, childEnvironment, spawnRun } from './chunk-774HEQL6.js';
 import { RecipeError } from './chunk-QOZKPLVJ.js';
-import { execCapture } from './chunk-W4SQCOZU.js';
-import { GUEST_CID } from './chunk-B2G7JHHB.js';
-import { WorkCommandError, postJson } from './chunk-BNMCXPG7.js';
+import { execCapture } from './chunk-ZOAEPWGL.js';
+import { GUEST_CID } from './chunk-R7STSBLC.js';
+import { WorkCommandError, postJson } from './chunk-DGAIVMMN.js';
 import { parseDuKilobytes, hostAllowed } from './chunk-F6GFZXZ3.js';
-import { RELAY_PORT, CHECKOUT_DIR, JOB_MOUNT, claudeCredential, buildEnvironment, startBuildServices, AGENT_CREDENTIAL_MISSING, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT } from './chunk-AUFG23AA.js';
-import { defaultGitRunner, materializeContext } from './chunk-OIRNH6UO.js';
-import { readContextManifest, readSourceCache } from './chunk-WIOZAJ2W.js';
+import { RELAY_PORT, CHECKOUT_DIR, JOB_MOUNT, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT } from './chunk-OD2VTIHN.js';
+import { defaultGitRunner, materializeContext } from './chunk-5FWNEQNZ.js';
+import { readContextManifest, readSourceCache } from './chunk-ZZXLM64C.js';
 import { signingFetchFor } from './chunk-BCLJSQCV.js';
 import { signerFor } from './chunk-M5POMKKW.js';
 import { rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, stagedContextDir, contextHomeDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, runnerDir, RUNNER_DIR_MODE, vmAssetsDir } from './chunk-ZM2IMMYN.js';
@@ -283,12 +283,14 @@ function prepareRunnerCgroup(setup) {
   fs.write(join(root, "cgroup.subtree_control"), "+memory");
   return { root };
 }
+var BUILD_RECLAIM_HEADROOM_BYTES = 256 * 1024 ** 2;
+var BUILD_KILL_HEADROOM_BYTES = 1024 ** 3;
 function createBuildCgroup(fs, root, buildId, buildMemoryBytes) {
   const path = join(root, `${BUILD_PREFIX}${buildId}`);
-  const firecrackerOverheadBytes = 256 * 1024 ** 2;
   fs.mkdir(path);
   try {
-    fs.write(join(path, "memory.max"), String(buildMemoryBytes + firecrackerOverheadBytes));
+    fs.write(join(path, "memory.high"), String(buildMemoryBytes + BUILD_RECLAIM_HEADROOM_BYTES));
+    fs.write(join(path, "memory.max"), String(buildMemoryBytes + BUILD_KILL_HEADROOM_BYTES));
     fs.write(join(path, "memory.swap.max"), "0");
   } catch (err) {
     removeBuildCgroup(fs, path);
@@ -296,6 +298,9 @@ function createBuildCgroup(fs, root, buildId, buildMemoryBytes) {
   }
   return path;
 }
+function outOfMemoryReason(memory) {
+  return `the build ran out of memory: the kernel killed its microVM at the limit of runner.build.memory (${memory ?? "8g"}) plus 1 GiB for Firecracker and its disks' page cache. Raise runner.build.memory, or lower runner.concurrency`;
+}
 function oomKills(fs, path) {
   const match = /^oom_kill (\d+)$/m.exec(fs.read(join(path, "memory.events")) ?? "");
   return match === null ? 0 : Number(match[1]);
@@ -536,12 +541,12 @@ function containerRunArgs(input) {
       "--forward",
       `${DESTINATION_BASE_PORT + index}=${JOB_MOUNT}/dest-${index}.sock`
     ]).flat(),
-    ...[
+    ...input.builtIns === true ? [
       "--forward",
       `${GATEWAY_PORT}=${JOB_MOUNT}/${GATEWAY_SOCKET}`,
       "--forward",
       `${CLAUDE_PORT}=${JOB_MOUNT}/${CLAUDE_SOCKET}`
-    ] 
+    ] : []
   ];
 }
 function prepareRunArgs(input) {
@@ -1537,6 +1542,11 @@ function createGitRemote(options) {
       req.resume();
       return plain(res, 404, "not found\n");
     }
+    if (options.readOnly === true && (route.kind === "receive-pack" || route.kind === "info-refs" && route.service === "git-receive-pack")) {
+      log(`push refused: this remote is read-only`);
+      req.resume();
+      return plain(res, 403, "this remote is read-only: a check cannot push\n");
+    }
     const own = isOwnRepository(options.repository, route.owner, route.name);
     if (own && route.kind === "receive-pack") return push(req, res, route);
     let kind = route.kind === "info-refs" && route.service === "git-receive-pack" ? "push" : "read";
@@ -1545,6 +1555,7 @@ function createGitRemote(options) {
       body = await readBody(req, maxLfsBodyBytes);
       if (body === void 0) return plain(res, 413, "the request is too large\n");
       kind = isLfsUpload(body) ? "push" : "read";
+      if (options.readOnly === true && kind === "push") return plain(res, 403, "this remote is read-only: a check cannot upload\n");
     }
     let authorization;
     if (own) {
@@ -2021,7 +2032,8 @@ function gitRemoteFor(runtime, input) {
     onWorkflowRefused: () => {
       input.tokens.reason = WORKFLOW_PERMISSION_REASON;
     },
-    log: input.log
+    log: input.log,
+    ...input.readOnly === true ? { readOnly: true } : {}
   });
 }
 function firstLine4(text) {
@@ -2105,7 +2117,8 @@ async function provisionContainer(input) {
     repository,
     imageId: report.imageId,
     containerEnv: report.apply.containerEnv,
-    builtIns: true
+    builtIns: true,
+    lifecycle: report.apply.lifecycle
   };
   const env = buildEnvironment({
     config,
@@ -2171,7 +2184,9 @@ async function provisionContainer(input) {
     image: report.imageId,
     user: ADDED_USER,
     limits: limits2,
-    destinations: config.build?.destinations?.length ?? 0};
+    destinations: config.build?.destinations?.length ?? 0,
+    builtIns: true
+  };
   const prepared = await host.run(prepareRunArgs(runInput), { logPath });
   if (prepared.status !== 0) return dockerFailed("preparing the build's volume", prepared);
   const started = await host.run(containerRunArgs(runInput), { logPath });
@@ -2388,5 +2403,75 @@ async function cleanupContainer(runtime, state, jobDir) {
   rmSync(state.buildDir, { recursive: true, force: true });
   if (failures.length > 0) throw new Error(failures.join("; "));
 }
+async function startCheckContainer(input) {
+  const { config, runtime, job, jobDir, tokens, log } = input;
+  const { host } = runtime;
+  const tag = `#${job.item}`;
+  const built = job.container;
+  const repository = built?.repository ?? job.repository;
+  if (built === void 0 || built.imageId === void 0 || repository === void 0 || job.branch === void 0) {
+    return { ok: false, reason: "the build's image, repository or branch is not recorded" };
+  }
+  const buildId = randomBytes(6).toString("hex");
+  const name = `outerlayer-check-${buildId}`;
+  const buildDir2 = buildDir(config.configPath, buildId);
+  const agentUser = built.agentUser ?? ADDED_USER;
+  const state = { buildId, container: name, volume: name, buildDir: buildDir2, repository, imageId: built.imageId, agentUser };
+  const checksDir = join(jobDir, "checks");
+  mkdirSync(checksDir, { recursive: true });
+  const logPath = join(checksDir, "environment.log");
+  input.save(state);
+  const fail = async (reason) => {
+    try {
+      await cleanupContainer(runtime, state);
+    } catch (err) {
+      log.error(`${tag} cleanup of the check environment failed: ${describeCallFailure(err)}`);
+    }
+    return { ok: false, reason };
+  };
+  const dockerFailed = (what, result) => fail(`${what} failed (exit ${result.status})${firstLine4(result.stderr) === "" ? "" : `: ${firstLine4(result.stderr)}`}`);
+  mkdirSync(buildDir2, { recursive: true });
+  chmodSync(buildDir2, 493);
+  try {
+    const gitRemote = gitRemoteFor(runtime, { repository, branch: job.branch, tokens, buildDir: buildDir2, log: (line) => log.line(`${tag} ${line}`), readOnly: true });
+    runtime.tunnels.set(buildId, await startServicesFor(runtime, config, buildDir2, checksDir, void 0, false, gitRemote));
+  } catch (err) {
+    return fail(`the tunnel could not start: ${describeCallFailure(err)}`);
+  }
+  const limits2 = { memory: config.build?.memory ?? "8g", cpus: config.build?.cpus ?? 4, pids: config.build?.pids ?? 4096 };
+  const runnerId = runnerLabelValue(config.configPath);
+  const volume = await host.createVolume(name, { [BUILD_LABEL]: buildId, [RUNNER_LABEL]: runnerId });
+  if (volume.status !== 0) return dockerFailed("creating the check environment's volume", volume);
+  const runInput = {
+    buildId,
+    runnerId,
+    container: name,
+    volume: name,
+    buildDir: buildDir2,
+    image: built.imageId,
+    user: ADDED_USER,
+    limits: limits2,
+    destinations: config.build?.destinations?.length ?? 0,
+    builtIns: false
+  };
+  const prepared = await host.run(prepareRunArgs(runInput), { logPath });
+  if (prepared.status !== 0) return dockerFailed("preparing the check environment's volume", prepared);
+  const started = await host.run(containerRunArgs(runInput), { logPath });
+  if (started.status !== 0) return dockerFailed("starting the check environment's container", started);
+  if (!await waitForRelay(runtime, state)) return fail("the relay in the check environment's container did not start");
+  const env = checkEnvironment({ config, item: job.item, repository, hostEnv: runtime.hostEnv, containerEnv: built.containerEnv ?? {} });
+  return {
+    ok: true,
+    container: {
+      state,
+      exec: (argv, workdir, opts) => host.exec({ container: name, user: agentUser, workdir, env, argv }, opts?.logPath === void 0 ? void 0 : { logPath: opts.logPath }),
+      restart: async () => {
+        await host.stop(name);
+        const again = await host.start(name);
+        return again.status === 0 && await waitForRelay(runtime, state);
+      }
+    }
+  };
+}
 
-export { ADDED_USER, AgentUserError, AssetError, BUILD_LABEL, BuildTokens, GH_CONFIG_YML, MIN_ENGINE_MAJOR, RUNNER_LABEL, classifyRefusal, cleanupContainer, containerCommandLine, containerSenderCommand, createBuildDisk, createContainerRuntime, createRunnerLog, deleteBuildDisk, describeCallFailure, ensureRootfs, ensureTunnel, formatClock, formatDuration, ghHostsYml, gitRemoteFor, isLiteralAddress, keepGhConfigCurrent, lifecycleFailureReason, lifecycleSteps, machineConfig, measureDisk, obtainImage, prepareBranch, provisionContainer, refusalCode, relativeToRunner, removeStagedContext, resolveAgentUser, retrySend, runBuildSteps, runnerLabelValue, senderSignalScript, setUpRunnerCgroup, shellQuote, shortClaim, signalInContainer, stageGovernedContext, startServicesFor, stopContainer, syncInContainer };
+export { ADDED_USER, AgentUserError, AssetError, BUILD_LABEL, BuildTokens, GH_CONFIG_YML, MIN_ENGINE_MAJOR, RUNNER_LABEL, classifyRefusal, cleanupContainer, containerCommandLine, containerSenderCommand, createBuildDisk, createContainerRuntime, createRunnerLog, deleteBuildDisk, describeCallFailure, ensureRootfs, ensureTunnel, formatClock, formatDuration, ghHostsYml, gitRemoteFor, isLiteralAddress, keepGhConfigCurrent, lifecycleFailureReason, lifecycleSteps, machineConfig, measureDisk, obtainImage, outOfMemoryReason, prepareBranch, provisionContainer, refusalCode, relativeToRunner, removeStagedContext, resolveAgentUser, retrySend, runBuildSteps, runnerLabelValue, senderSignalScript, setUpRunnerCgroup, shellQuote, shortClaim, signalInContainer, stageGovernedContext, startCheckContainer, startServicesFor, stopContainer, syncInContainer };

package/dist/{chunk-H5NCNVDA.js → chunk-EV3M3EH7.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { maintainedFilesForExistingSkills, loadMaintainedFiles, writeMaintainedFiles } from './chunk-WO2BXCTQ.js';
-import { emitTree, parseOuterlayerConfig, classifyTree, generatedHeaderSource, CONTEXT_PIN_FILENAME, normalizePath } from './chunk-EMY4I27X.js';
+import { maintainedFilesForExistingSkills, loadMaintainedFiles, writeMaintainedFiles } from './chunk-VXLJORHL.js';
+import { emitTree, parseOuterlayerConfig, classifyTree, generatedHeaderSource, CONTEXT_PIN_FILENAME, normalizePath } from './chunk-7ZR5UPMB.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, copyFileSync, readdirSync } from 'fs';
 import { join, dirname, relative, sep } from 'path';
 

package/dist/chunk-HKMPVPO7.js

@@ -0,0 +1,55 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+
+createRequire(import.meta.url);
+
+// src/runner/commit-identity.ts
+var NOREPLY_SUFFIX = "@users.noreply.github.com";
+var MAX_LENGTH = 200;
+function parseIdentity(value) {
+  if (typeof value !== "object" || value === null) return void 0;
+  const { name, email } = value;
+  if (typeof name !== "string" || typeof email !== "string") return void 0;
+  if (name.trim() === "" || name.length > MAX_LENGTH || /[\r\n\0<>]/.test(name)) return void 0;
+  if (email.length > MAX_LENGTH || !email.endsWith(NOREPLY_SUFFIX) || /[\s\0<>]/.test(email) || email.length === NOREPLY_SUFFIX.length) return void 0;
+  return { name, email };
+}
+function parseClaimIdentity(data) {
+  const author = parseIdentity(data.commitAuthor);
+  if (author === void 0) return void 0;
+  const coAuthor = parseIdentity(data.coAuthor);
+  return coAuthor === void 0 ? { author } : { author, coAuthor };
+}
+function authorEnvironment(identity) {
+  if (identity === void 0) return {};
+  return {
+    GIT_AUTHOR_NAME: identity.name,
+    GIT_AUTHOR_EMAIL: identity.email,
+    GIT_COMMITTER_NAME: identity.name,
+    GIT_COMMITTER_EMAIL: identity.email
+  };
+}
+function configCount(env) {
+  const raw = String(env.GIT_CONFIG_COUNT);
+  return /^[0-9]+$/.test(raw) ? Number(raw) : 0;
+}
+function withGitConfig(env, key, value) {
+  const at = configCount(env);
+  return {
+    ...env,
+    GIT_CONFIG_COUNT: String(at + 1),
+    [`GIT_CONFIG_KEY_${at}`]: key,
+    [`GIT_CONFIG_VALUE_${at}`]: value
+  };
+}
+function withHooksPath(env, dir) {
+  return withGitConfig(env, "core.hooksPath", dir);
+}
+function commitIdentityRecord(identity) {
+  return {
+    author: identity === void 0 ? "host" : "app",
+    coAuthor: identity?.coAuthor !== void 0 && identity.hooksPath !== void 0 ? "credited" : "none"
+  };
+}
+
+export { authorEnvironment, commitIdentityRecord, parseClaimIdentity, withGitConfig, withHooksPath };

package/dist/{chunk-FA2BOX4O.js → chunk-JPR2WHHF.js}

@@ -628,7 +628,7 @@ async function runHookFast(event, home = homeFromEnv(), read = readStdin, env =
       recordHookErrorsSeen(home, hookErrorsBytes);
       if (contextPossiblyGoverned(sessionCwd, home)) {
         try {
-          const { materializeContext: materialize } = await import('./context-materialize-3HLPZAF6.js');
+          const { materializeContext: materialize } = await import('./context-materialize-QL33HDJN.js');
           const sessionId = typeof payload.session_id === "string" ? payload.session_id : "unknown";
           const result = await materialize({ cwd: sessionCwd, sessionId, home });
           materializeMessage = result.message;

package/dist/{chunk-ZMYPLFG3.js → chunk-M3SQ4YGD.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { C } from './chunk-YRYMNBGQ.js';
-import { resolvePackRoot, loadTemplateFiles, loadMaintainedFiles, TEMPLATE_SKILLS, skillDir, writeMaintainedFiles, MAINTAINED_SKILLS } from './chunk-WO2BXCTQ.js';
+import { resolvePackRoot, loadTemplateFiles, loadMaintainedFiles, TEMPLATE_SKILLS, skillDir, writeMaintainedFiles, MAINTAINED_SKILLS } from './chunk-VXLJORHL.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
 import { existsSync, mkdirSync, writeFileSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-MIGEDH5P.js → chunk-MQPRB5K7.js}

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isLinkedRepository } from './chunk-7DBI6SNT.js';
 import { readStatuslineState, STATE_FRESH_MS } from './chunk-F47JBIAW.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-BNMCXPG7.js';
-import { sanitizeTerminal } from './chunk-3DEVYTNQ.js';
-import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-ANK2B36Y.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-DGAIVMMN.js';
+import { isLinkedRepository } from './chunk-SSU747O6.js';
+import { sanitizeTerminal } from './chunk-ZYHKJKSU.js';
+import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-D6FXM5OW.js';
 import { C } from './chunk-YRYMNBGQ.js';
 import { readSettings, settingsPath, isOurStatuslineSlot, statuslineWrappedOriginal, REGISTERED_EVENTS, isOurHookCommand, ourCommandBins, cliBinResolvable, ourDirectScriptBins, wrappedOriginalCommand } from './chunk-5QRP3MVS.js';
-import { readPin, readContextManifest, readDegraded, readSourceCache } from './chunk-WIOZAJ2W.js';
+import { readPin, readContextManifest, readDegraded, readSourceCache } from './chunk-ZZXLM64C.js';
 import { defaultFetch } from './chunk-BCLJSQCV.js';
 import { resolveGatewayCredentials } from './chunk-BOLTI6LR.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
-import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-FA2BOX4O.js';
+import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-JPR2WHHF.js';
 import { deadHooksState, preparePackageManagerCommand, contextExcludesPresent } from './chunk-XCCLFVXM.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
@@ -1004,7 +1004,7 @@ function doctorExitCode(checks) {
 
 // src/doctor-report.ts
 async function gatherDoctorChecks() {
-  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-HL2AIR3K.js');
+  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-I3TVFYLH.js');
   const configPath = defaultRunnerConfigPath();
   const checks = runDoctor({ runnerHost: hasRunnerBlock(configPath) });
   const credential = await credentialChecks();
@@ -1016,7 +1016,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-VOMYOHQU.js');
+    const { runnerHostChecks } = await import('./doctor-FVDT3KJZ.js');
     const hooks = (() => {
       try {
         return loadRunnerConfig(configPath).hooks;
@@ -1051,7 +1051,7 @@ async function gatherDoctorChecks() {
       const { existsSync: existsSync2 } = await import('fs');
       if (process.platform !== "linux" || !existsSync2("/run/systemd/system")) return void 0;
       const { inspectService, realInspectProbes } = await import('./inspect-XAUSB7L3.js');
-      const { DEFAULT_UNIT_NAME } = await import('./install-DSUZE2TJ.js');
+      const { DEFAULT_UNIT_NAME } = await import('./install-NMAPLLBQ.js');
       const { dirname: dirname2 } = await import('path');
       return inspectService(DEFAULT_UNIT_NAME, dirname2(configPath), realInspectProbes());
     })();

package/dist/{chunk-AUFG23AA.js → chunk-OD2VTIHN.js}

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
+import { authorEnvironment, withHooksPath } from './chunk-HKMPVPO7.js';
 import { existsSync, unlinkSync, chmodSync } from 'fs';
 import { request as request$1, createServer } from 'http';
 import { request } from 'https';
@@ -344,52 +345,6 @@ async function startBuildServices(input) {
   }
 }
 
-// src/runner/commit-identity.ts
-var NOREPLY_SUFFIX = "@users.noreply.github.com";
-var MAX_LENGTH = 200;
-function parseIdentity(value) {
-  if (typeof value !== "object" || value === null) return void 0;
-  const { name, email } = value;
-  if (typeof name !== "string" || typeof email !== "string") return void 0;
-  if (name.trim() === "" || name.length > MAX_LENGTH || /[\r\n\0<>]/.test(name)) return void 0;
-  if (email.length > MAX_LENGTH || !email.endsWith(NOREPLY_SUFFIX) || /[\s\0<>]/.test(email) || email.length === NOREPLY_SUFFIX.length) return void 0;
-  return { name, email };
-}
-function parseClaimIdentity(data) {
-  const author = parseIdentity(data.commitAuthor);
-  if (author === void 0) return void 0;
-  const coAuthor = parseIdentity(data.coAuthor);
-  return coAuthor === void 0 ? { author } : { author, coAuthor };
-}
-function authorEnvironment(identity) {
-  if (identity === void 0) return {};
-  return {
-    GIT_AUTHOR_NAME: identity.name,
-    GIT_AUTHOR_EMAIL: identity.email,
-    GIT_COMMITTER_NAME: identity.name,
-    GIT_COMMITTER_EMAIL: identity.email
-  };
-}
-function configCount(env) {
-  const raw = String(env.GIT_CONFIG_COUNT);
-  return /^[0-9]+$/.test(raw) ? Number(raw) : 0;
-}
-function withHooksPath(env, dir) {
-  const at = configCount(env);
-  return {
-    ...env,
-    GIT_CONFIG_COUNT: String(at + 1),
-    [`GIT_CONFIG_KEY_${at}`]: "core.hooksPath",
-    [`GIT_CONFIG_VALUE_${at}`]: dir
-  };
-}
-function commitIdentityRecord(identity) {
-  return {
-    author: identity === void 0 ? "host" : "app",
-    coAuthor: identity?.coAuthor !== void 0 && identity.hooksPath !== void 0 ? "credited" : "none"
-  };
-}
-
 // src/runner/container/environment.ts
 var RELAY_PORT = 3128;
 var JOB_MOUNT = "/outerlayer/job";
@@ -498,6 +453,23 @@ function buildEnvironment(input) {
     skippedTokenVariables
   };
 }
+function checkEnvironment(input) {
+  const env = buildEnvironment({
+    config: input.config,
+    item: input.item,
+    itemKey: void 0,
+    repository: input.repository,
+    hostEnv: input.hostEnv,
+    containerEnv: input.containerEnv,
+    builtIns: false
+  });
+  const withheld = /* @__PURE__ */ new Set(["OUTERLAYER_URL", "OUTERLAYER_API_KEY", ...CLAUDE_CREDENTIAL_VARIABLES]);
+  const literals = {};
+  for (const [name, value] of Object.entries(env.literals)) if (!withheld.has(name)) literals[name] = value;
+  const passed = {};
+  for (const [name, value] of Object.entries(env.passed)) if (!withheld.has(name)) passed[name] = value;
+  return { literals, passed };
+}
 function parseIsolation(value) {
   return value === "container" || value === "vm" ? value : "shared-user";
 }
@@ -531,4 +503,4 @@ function withTunnelRecord(environment, record, onlyWhenUsed = false) {
   };
 }
 
-export { AGENT_CREDENTIAL_MISSING, BUILT_IN_NAMES, CHECKOUT_DIR, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, RELAY_PORT, authorEnvironment, buildEnvironment, builtInEnvironment, claudeCredential, commitIdentityRecord, containerLocalAddress, destinationEnvironment, headerVariables, isRefusedInConfig, isReservedVariable, parseClaimIdentity, parseIsolation, proxyEnvironment, resolveDestinations, sharedUserEnvironment, startBuildServices, withHooksPath, withTunnelRecord };
+export { AGENT_CREDENTIAL_MISSING, BUILT_IN_NAMES, CHECKOUT_DIR, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, RELAY_PORT, buildEnvironment, builtInEnvironment, checkEnvironment, claudeCredential, containerLocalAddress, destinationEnvironment, headerVariables, isRefusedInConfig, isReservedVariable, parseIsolation, proxyEnvironment, resolveDestinations, sharedUserEnvironment, startBuildServices, withTunnelRecord };

package/dist/chunk-PUN7LMNS.js

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { fetchFactories, selectFactory, saveFactoryConnection, connectedLine } from './chunk-SSU747O6.js';
+import { resolveRepoIdentity } from './chunk-D6FXM5OW.js';
+import { resolveGatewayCredentials } from './chunk-BOLTI6LR.js';
+import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
+import { homeFromEnv } from './chunk-VNVZDWO3.js';
+
+createRequire(import.meta.url);
+
+// src/auto-connect.ts
+async function autoConnect(opts) {
+  const env = opts.env ?? process.env;
+  const home = opts.home ?? homeFromEnv(env);
+  const cwd = opts.cwd ?? process.cwd();
+  const resolved = resolveGatewayCredentials({ url: opts.url, apiKey: opts.apiKey, appId: opts.appId, home, env, cwd });
+  if (resolved.ok || resolved.kind !== "login" || !resolved.credential || !resolved.url) return void 0;
+  const dirs = findGitDirs(cwd);
+  const repository = resolveRepoIdentity(cwd).gitRepo;
+  if (dirs === void 0 || repository === void 0) return void 0;
+  const listed = await fetchFactories(opts.fetchImpl ?? fetch, resolved.url, resolved.credential, repository);
+  if (!listed.ok || listed.factories.length === 0) return void 0;
+  const chosen = selectFactory(listed.factories, readRepoConnection(cwd), repository);
+  if (chosen.factory === void 0) {
+    return `you are logged in, but no factory is chosen for this repository, and more than one fits. Run \`outerlayer connect --factory <org>/<factory>\` with one of:
+${chosen.text}
+Or pass --app-id / set OUTERLAYER_APP_ID.`;
+  }
+  try {
+    saveFactoryConnection(dirs.gitCommonDir, void 0, chosen.factory, /* @__PURE__ */ new Date());
+  } catch {
+    return void 0;
+  }
+  process.stderr.write(`${connectedLine(repository, chosen.factory, chosen.reason)}
+`);
+  return void 0;
+}
+
+export { autoConnect };

package/dist/{chunk-JWOQNNN2.js → chunk-Q5G2ODUZ.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isInLayout, packageRootIn, versionDir, switchCurrent, execStartLine } from './chunk-YYYXRJUW.js';
+import { isInLayout, packageRootIn, versionDir, switchCurrent, execStartLine } from './chunk-TI7B7UEO.js';
 import { RUNNER_DIR_MODE } from './chunk-ZM2IMMYN.js';
 import { realpathSync, readFileSync, mkdirSync, rmSync, cpSync, existsSync } from 'fs';
 import { dirname, sep, join } from 'path';

package/dist/{chunk-B2G7JHHB.js → chunk-R7STSBLC.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RELAY_PORT, GATEWAY_SOCKET, GATEWAY_PORT, CLAUDE_SOCKET, CLAUDE_PORT, DESTINATION_BASE_PORT } from './chunk-AUFG23AA.js';
+import { RELAY_PORT, GATEWAY_SOCKET, GATEWAY_PORT, CLAUDE_SOCKET, CLAUDE_PORT, DESTINATION_BASE_PORT } from './chunk-OD2VTIHN.js';
 import { symlinkSync, unlinkSync } from 'fs';
 import { join } from 'path';