@outerlayer/cli 0.6.0 → 0.8.0

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # @outerlayer/cli
 
+## 0.8.0
+
+### Minor Changes
+
+- 8da1a39: The runner now builds every image in a Buildx builder of its own, whose container has a memory limit of `runner.build.memory`. A recipe step that uses more memory is stopped, and the build is released failed at provision with a reason that names the limit. Hosts need Docker's Buildx plugin (`docker-buildx-plugin`, version 0.18 or later); a host without it claims no work, and `outerlayer doctor` fails an "Image build limit" check that names the package. Housekeeping now trims the runner's builder cache, not Docker's default builder.
+
+  `outerlayer runner install`, `runner install --service` and `runner init` also write `~/.local/bin/outerlayer`, a launcher that runs the CLI in the runner's `current` link, so the command on PATH follows a self-update. `runner install --replace` replaces a launcher file the runner did not write.
+
+### Patch Changes
+
+- 983c221: A build whose clone fails now says why: the release reason ends with the fatal or error line git printed, not only its exit status.
+- 5a7ca29: The README now says the `OuterLayer evidence` check on GitHub completes once the automated checks pass, without waiting for a person's review in OuterLayer. It also gives the `review` policy key's default correctly as `required`.
+- 628c6c9: A `builtin:vm` build's host checks now run in a new microVM booted from the build's image, where they used to always fail.
+- c2a0315: `outerlayer runner init --vm` sizes the VM's disk with room for the free-disk minimum and the Docker build cache, so the runner in the VM keeps claiming work once its disk fills. With the default limits the disk is 90 GiB, allocated as it is used.
+- 983c221: On WSL2, `outerlayer runner install --service` makes no scheduled task when `WSL_DISTRO_NAME` is unset, as under `sudo`, and prints the `schtasks` command to run instead. It no longer guesses `Ubuntu`, which made a task that started nothing.
+
+## 0.7.0
+
+### Minor Changes
+
+- b4fdd73: The runner now runs a repository's `where: host` validators itself after a build, in a new container from the build's image, and records each result under the host's own key. A check that cannot run is recorded as a fail with a reason. `runner.checks.timeLimitMinutes` (default 10, 1 to 240) bounds the environment setup and each check command. The runner CLI is not updated for you on a host with `runner.autoUpdate` off: refresh it by hand on each host to get host checks.
+
+### Patch Changes
+
+- 35b0fed: Fixes found by running the runner service on real machines:
+
+  - A repository fetch with a claim's read token keeps the git settings the host passes in `GIT_CONFIG_*`, such as one in `runner.env`. It added the token over them.
+  - `runner install --service --user <account>` refuses when that account cannot execute the Node the install runs on, or read the runner's CLI, instead of installing a service that cannot start.
+  - A microVM the kernel kills at its memory limit while it is still starting is released with a reason saying the build ran out of memory, not that the microVM did not start.
+  - A microVM build's cgroup reclaims above `build.memory` plus 256 MiB and kills above `build.memory` plus 1 GiB. A real build was killed at plus 256 MiB, because the page cache of its disks' writes is charged to the same cgroup.
+
+- f633a70: The template build skill's `record-criteria.mjs` now records a criterion that declares `(proof: test)` with proof `test`. Test results for that criterion now count toward it.
+- 735d939: `work` and `emit` commands now connect the repository themselves when you are logged in, the repository has no saved connection, and exactly one factory fits. They print one line naming the factory and why, save the connection, and carry on. When several factories fit, they refuse and list the `--factory` value for each.
+
 ## 0.6.0
 
 ### Minor Changes

package/README.md

@@ -101,6 +101,12 @@ content:
   work — success, or the error code and message the platform returned.
   When a build's command exits 0, it reads that work item once more, for its
   evidence verdict, before releasing it: it sends nothing but the request.
+  Just before that read, the runner runs the repository's host checks. A host
+  check is a command the repository's `where: host` validators declare. The
+  runner reads the definitions with the host's own git credentials, runs each
+  command in a new container, and sends one `POST /v1/emitted-results` for
+  each: the check's name, pass or fail, and for a fail the exit status and the
+  last line of its output, scrubbed.
   Before a build's command starts, the runner also runs `git ls-remote` and
   `git fetch` in the job's workdir, with the host's own git credentials, to
   put it on the branch the claim named. Nothing about the job leaves the host
@@ -133,6 +139,10 @@ content:
   never printed. If this machine held a token from an earlier login, login
   asks the dashboard to revoke it. A key piped on stdin makes no network
   call.
+- **`outerlayer work`** and **`outerlayer emit`**, in the subcommands named below, with a login and no saved
+  connection for the repository send the same `GET /v1/me/factories?repository=<host/owner/name>`
+  request before their own, to connect the repository when exactly one factory
+  fits. They send nothing extra with a factory key, `--app-id` or `OUTERLAYER_APP_ID`. The subcommands are `work build`, `list`, `status`, `remove` and `pr`, and `emit artifact`, `result`, `criteria`, `finding` and `findings`. Other `work` subcommands never connect.
 - **`outerlayer connect`**, and the first step of `outerlayer init`, send a
   request with your login's token: `GET /v1/me/factories?repository=<host/owner/name>`,
   naming this checkout's remote. The gateway answers with the factories you can
@@ -403,11 +413,11 @@ pass or fail on an item that is closed or shipped, has no evaluation yet,
 or whose evaluation is still waiting on a session link, with the code
 `not_reviewable`. A recorded pass on the general thread carries the head
 commit of every pull request the item had at the time; once one of them
-moves, that pass stops counting and a fresh review is needed. A repository
-can require a current pass before the evidence check completes by setting
-the base branch's `review` policy key to `required` (default `optional`,
-alongside `merge_gate`) — the check then stays in progress, not failed,
-until a current pass exists.
+moves, that pass stops counting and a fresh review is needed. The base
+branch's `review` policy key (default `required`, beside `merge_gate`)
+holds the item at "Awaiting a person's review" until a current pass
+exists. The evidence check on GitHub does not wait for that review: it
+completes once the automated checks pass and says the review is pending.
 
 A criterion thread is scoped to one acceptance criterion rather than the
 whole item: an agent attaches proof with `outerlayer work comment

package/dist/{agent-setup-USZ2SAXC.js → agent-setup-C7PLRXZO.js}

@@ -1,16 +1,17 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { installStarterPack } from './chunk-ZMYPLFG3.js';
-import { runEmit } from './chunk-H5NCNVDA.js';
 import { addStdioMcpEntryIfAbsent } from './chunk-MQ3IPHIZ.js';
+import { installStarterPack } from './chunk-M3SQ4YGD.js';
+import { runEmit } from './chunk-EV3M3EH7.js';
 import { C } from './chunk-YRYMNBGQ.js';
-import { resolveGitCommonDir, defaultGitRunner } from './chunk-OIRNH6UO.js';
+import { resolveGitCommonDir, defaultGitRunner } from './chunk-5FWNEQNZ.js';
 import './chunk-ZJSNLVCE.js';
-import { pinExists, readContextManifest } from './chunk-WIOZAJ2W.js';
-import { loadTemplateFiles, loadMaintainedFiles, skillDir } from './chunk-WO2BXCTQ.js';
-import { generatedHeaderSource } from './chunk-EMY4I27X.js';
+import { pinExists, readContextManifest } from './chunk-ZZXLM64C.js';
+import { loadTemplateFiles, loadMaintainedFiles, skillDir } from './chunk-VXLJORHL.js';
+import { generatedHeaderSource } from './chunk-7ZR5UPMB.js';
 import './chunk-BCLJSQCV.js';
 import './chunk-BOLTI6LR.js';
+import './chunk-YNJEOGDL.js';
 import './chunk-EABW6AJQ.js';
 import './chunk-RA3O54FC.js';
 import './chunk-M5POMKKW.js';

package/dist/{build-PAEKVYVK.js → build-MS34XEGN.js}

@@ -1,8 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { buildRepositoryImage } from './chunk-Z62HNKEJ.js';
+export { buildRepositoryImage } from './chunk-TTNFGMHO.js';
 import './chunk-N5FOE5PS.js';
 export { RecipeError } from './chunk-QOZKPLVJ.js';
+import './chunk-CX22S5BA.js';
+import './chunk-HKMPVPO7.js';
 import './chunk-ZM2IMMYN.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-04T12:35:01.048Z+a19ef31","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-05T12:31:55.812Z+ff35a38","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/builder-G52A6GW2.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-5TNS3PL7.js';
+import './chunk-CX22S5BA.js';
+import './chunk-GAYWY4GI.js';
+import './chunk-7RQ73DLO.js';
+import './chunk-OD2VTIHN.js';
+import './chunk-HKMPVPO7.js';
+import './chunk-YNJEOGDL.js';
+import './chunk-ZM2IMMYN.js';
+import './chunk-Z5GEFMRW.js';
+
+createRequire(import.meta.url);

package/dist/{check-CCVPBN7A.js → check-FOF3PUKI.js}

@@ -1,55 +1,64 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-43J3M6KB.js';
+import { probeCredentials } from './chunk-IJBVPLZZ.js';
 import './chunk-ABIWDUMS.js';
-import './chunk-YYYXRJUW.js';
-import './chunk-VMJ3MMBX.js';
+import './chunk-7VNURP6M.js';
 import './chunk-T6OIJQRT.js';
 import './chunk-AIW6GLET.js';
 import './chunk-UGP76IZ5.js';
-import './chunk-ZILGTTY6.js';
-import './chunk-CBPPJSAR.js';
-import './chunk-UMFWVGJO.js';
+import './chunk-3S4P55NE.js';
+import './chunk-WVGSB3Z2.js';
+import './chunk-AIL2R4SI.js';
 import './chunk-HHJDN6AU.js';
-import { placeholderQueues, placeholderProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem } from './chunk-MXB5VB4Y.js';
+import { placeholderQueues, placeholderProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem } from './chunk-IRCBTGWF.js';
+import './chunk-TI7B7UEO.js';
 import './chunk-YYYRBYWG.js';
 import './chunk-TBT347UY.js';
-import './chunk-OUUINEYB.js';
-import './chunk-4NLKY4WR.js';
-import './chunk-RBOMWNOG.js';
-import './chunk-RZSF5B46.js';
-import './chunk-Z62HNKEJ.js';
+import './chunk-NALVDFIS.js';
+import './chunk-TUUMW4TC.js';
+import './chunk-CM5QTKM4.js';
+import './chunk-JKIWMRFH.js';
+import './chunk-TTNFGMHO.js';
 import './chunk-N5FOE5PS.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-774HEQL6.js';
+import './chunk-U3GOI2B4.js';
 import './chunk-QOZKPLVJ.js';
-import './chunk-W4SQCOZU.js';
-import './chunk-B2G7JHHB.js';
+import './chunk-5TNS3PL7.js';
+import './chunk-CX22S5BA.js';
+import './chunk-ZOAEPWGL.js';
+import './chunk-R7STSBLC.js';
 import './chunk-F7CU5ABH.js';
 import './chunk-BKO6JEZI.js';
-import './chunk-BNMCXPG7.js';
+import './chunk-5QLNZGAQ.js';
+import './chunk-4ACZCY4I.js';
 import './chunk-BFESLKPP.js';
-import './chunk-3DEVYTNQ.js';
-import './chunk-ANK2B36Y.js';
+import './chunk-ILEA3YHM.js';
+import './chunk-ZYHKJKSU.js';
+import './chunk-GAYWY4GI.js';
+import './chunk-USO2DKBD.js';
+import './chunk-N6LURUEF.js';
 import './chunk-YRYMNBGQ.js';
-import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-3DD6AOWC.js';
-import './chunk-F6GFZXZ3.js';
-import './chunk-AUFG23AA.js';
+import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-PWBILI5P.js';
+import './chunk-UXYLWVTQ.js';
+import './chunk-7RQ73DLO.js';
+import './chunk-OD2VTIHN.js';
+import './chunk-HKMPVPO7.js';
 import './chunk-GQD22KKN.js';
 import './chunk-WZBHBH3J.js';
 import './chunk-5QRP3MVS.js';
-import './chunk-OIRNH6UO.js';
+import './chunk-5FWNEQNZ.js';
 import './chunk-ZJSNLVCE.js';
-import './chunk-WIOZAJ2W.js';
-import './chunk-WO2BXCTQ.js';
-import './chunk-EMY4I27X.js';
+import './chunk-ZZXLM64C.js';
+import './chunk-VXLJORHL.js';
+import './chunk-7ZR5UPMB.js';
 import './chunk-BCLJSQCV.js';
 import './chunk-BOLTI6LR.js';
+import './chunk-YNJEOGDL.js';
 import './chunk-EABW6AJQ.js';
 import './chunk-RA3O54FC.js';
 import './chunk-M5POMKKW.js';
 import './chunk-ZM2IMMYN.js';
-import './chunk-FA2BOX4O.js';
+import './chunk-JPR2WHHF.js';
 import './chunk-XCCLFVXM.js';
 import './chunk-BJ3KTMDH.js';
 import './chunk-VNVZDWO3.js';

package/dist/{chunk-ZILGTTY6.js → chunk-3S4P55NE.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-UMFWVGJO.js';
-import { CaptureDaemon } from './chunk-ANK2B36Y.js';
+import { LiveUploader } from './chunk-AIL2R4SI.js';
+import { CaptureDaemon } from './chunk-GAYWY4GI.js';
 import { parseWorkItemEnv } from './chunk-GQD22KKN.js';
-import { spoolDir } from './chunk-FA2BOX4O.js';
+import { spoolDir } from './chunk-JPR2WHHF.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, writeFileSync, rmSync } from 'fs';
 import { join } from 'path';

package/dist/{chunk-MIGEDH5P.js → chunk-4A5E2G4E.js}

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isLinkedRepository } from './chunk-7DBI6SNT.js';
 import { readStatuslineState, STATE_FRESH_MS } from './chunk-F47JBIAW.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-BNMCXPG7.js';
-import { sanitizeTerminal } from './chunk-3DEVYTNQ.js';
-import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-ANK2B36Y.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-5QLNZGAQ.js';
+import { isLinkedRepository } from './chunk-ILEA3YHM.js';
+import { sanitizeTerminal } from './chunk-ZYHKJKSU.js';
+import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-GAYWY4GI.js';
 import { C } from './chunk-YRYMNBGQ.js';
 import { readSettings, settingsPath, isOurStatuslineSlot, statuslineWrappedOriginal, REGISTERED_EVENTS, isOurHookCommand, ourCommandBins, cliBinResolvable, ourDirectScriptBins, wrappedOriginalCommand } from './chunk-5QRP3MVS.js';
-import { readPin, readContextManifest, readDegraded, readSourceCache } from './chunk-WIOZAJ2W.js';
+import { readPin, readContextManifest, readDegraded, readSourceCache } from './chunk-ZZXLM64C.js';
 import { defaultFetch } from './chunk-BCLJSQCV.js';
 import { resolveGatewayCredentials } from './chunk-BOLTI6LR.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
-import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-FA2BOX4O.js';
+import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-JPR2WHHF.js';
 import { deadHooksState, preparePackageManagerCommand, contextExcludesPresent } from './chunk-XCCLFVXM.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
@@ -1004,7 +1004,7 @@ function doctorExitCode(checks) {
 
 // src/doctor-report.ts
 async function gatherDoctorChecks() {
-  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-HL2AIR3K.js');
+  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-Z3USDBLU.js');
   const configPath = defaultRunnerConfigPath();
   const checks = runDoctor({ runnerHost: hasRunnerBlock(configPath) });
   const credential = await credentialChecks();
@@ -1016,7 +1016,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-VOMYOHQU.js');
+    const { runnerHostChecks } = await import('./doctor-WR6TRPSU.js');
     const hooks = (() => {
       try {
         return loadRunnerConfig(configPath).hooks;
@@ -1051,7 +1051,7 @@ async function gatherDoctorChecks() {
       const { existsSync: existsSync2 } = await import('fs');
       if (process.platform !== "linux" || !existsSync2("/run/systemd/system")) return void 0;
       const { inspectService, realInspectProbes } = await import('./inspect-XAUSB7L3.js');
-      const { DEFAULT_UNIT_NAME } = await import('./install-DSUZE2TJ.js');
+      const { DEFAULT_UNIT_NAME } = await import('./install-FHTVJZS6.js');
       const { dirname: dirname2 } = await import('path');
       return inspectService(DEFAULT_UNIT_NAME, dirname2(configPath), realInspectProbes());
     })();

package/dist/chunk-4ACZCY4I.js

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { fetchFactories, selectFactory, saveFactoryConnection, connectedLine } from './chunk-ILEA3YHM.js';
+import { resolveRepoIdentity } from './chunk-GAYWY4GI.js';
+import { resolveGatewayCredentials } from './chunk-BOLTI6LR.js';
+import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
+import { homeFromEnv } from './chunk-VNVZDWO3.js';
+
+createRequire(import.meta.url);
+
+// src/auto-connect.ts
+async function autoConnect(opts) {
+  const env = opts.env ?? process.env;
+  const home = opts.home ?? homeFromEnv(env);
+  const cwd = opts.cwd ?? process.cwd();
+  const resolved = resolveGatewayCredentials({ url: opts.url, apiKey: opts.apiKey, appId: opts.appId, home, env, cwd });
+  if (resolved.ok || resolved.kind !== "login" || !resolved.credential || !resolved.url) return void 0;
+  const dirs = findGitDirs(cwd);
+  const repository = resolveRepoIdentity(cwd).gitRepo;
+  if (dirs === void 0 || repository === void 0) return void 0;
+  const listed = await fetchFactories(opts.fetchImpl ?? fetch, resolved.url, resolved.credential, repository);
+  if (!listed.ok || listed.factories.length === 0) return void 0;
+  const chosen = selectFactory(listed.factories, readRepoConnection(cwd), repository);
+  if (chosen.factory === void 0) {
+    return `you are logged in, but no factory is chosen for this repository, and more than one fits. Run \`outerlayer connect --factory <org>/<factory>\` with one of:
+${chosen.text}
+Or pass --app-id / set OUTERLAYER_APP_ID.`;
+  }
+  try {
+    saveFactoryConnection(dirs.gitCommonDir, void 0, chosen.factory, /* @__PURE__ */ new Date());
+  } catch {
+    return void 0;
+  }
+  process.stderr.write(`${connectedLine(repository, chosen.factory, chosen.reason)}
+`);
+  return void 0;
+}
+
+export { autoConnect };

package/dist/{chunk-OIRNH6UO.js → chunk-5FWNEQNZ.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
-import { readPin, pinExists, readBuildHold, readContextManifest, manifestFilesPresent, writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, SOURCE_CACHE_TTL_SUCCESS_MS, isLastCheckFresh, readDegraded, touchLastCheck, clearDegraded, writeContextManifest, writePinIfChanged, readSourceCache, isSourceCacheFresh } from './chunk-WIOZAJ2W.js';
-import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-WO2BXCTQ.js';
-import { parseGoverns, normalizeRepoName, CONTEXT_SOURCE_CONFIG_PATH, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-EMY4I27X.js';
+import { readPin, pinExists, readBuildHold, readContextManifest, manifestFilesPresent, writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, SOURCE_CACHE_TTL_SUCCESS_MS, isLastCheckFresh, readDegraded, touchLastCheck, clearDegraded, writeContextManifest, writePinIfChanged, readSourceCache, isSourceCacheFresh } from './chunk-ZZXLM64C.js';
+import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-VXLJORHL.js';
+import { parseGoverns, normalizeRepoName, CONTEXT_SOURCE_CONFIG_PATH, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-7ZR5UPMB.js';
 import { defaultFetch } from './chunk-BCLJSQCV.js';
 import { resolveGatewayCredentials } from './chunk-BOLTI6LR.js';
 import { ensureContextExcludes, ensurePreCommitGuardHook } from './chunk-XCCLFVXM.js';

package/dist/{chunk-BNMCXPG7.js → chunk-5QLNZGAQ.js}

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
+import { autoConnect } from './chunk-4ACZCY4I.js';
 import { detectActiveSession } from './chunk-BFESLKPP.js';
-import { sanitizeTerminal } from './chunk-3DEVYTNQ.js';
-import { resolveRepoIdentity } from './chunk-ANK2B36Y.js';
+import { sanitizeTerminal } from './chunk-ZYHKJKSU.js';
+import { resolveRepoIdentity } from './chunk-GAYWY4GI.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { defaultFetch } from './chunk-BCLJSQCV.js';
 import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-BOLTI6LR.js';
@@ -79,6 +80,10 @@ function resolveCredentials(opts) {
   if (!resolved.ok) throw new WorkCommandError(resolved.message);
   return { url: resolved.url, apiKey: resolved.credential, appId: resolved.appId };
 }
+async function connectIfOneFits(opts) {
+  const refusal = await autoConnect(opts);
+  if (refusal !== void 0) throw new WorkCommandError(refusal);
+}
 function resolveRepository(repoFlag, cwd) {
   if (repoFlag) return repoFlag;
   const identity = resolveRepoIdentity(cwd);
@@ -299,6 +304,7 @@ async function runWorkBuild(opts) {
   const cwd = opts.cwd ?? process.cwd();
   const env = opts.env ?? process.env;
   const home = opts.home ?? homeFromEnv(env);
+  await connectIfOneFits(opts);
   const { url, apiKey, appId } = resolveCredentials(opts);
   const fetchImpl = opts.fetchImpl ?? defaultFetch;
   const facts = environmentFacts({ cwd, env, home, sessionIdOverride: opts.sessionId });
@@ -341,7 +347,7 @@ async function runWorkLinkSession(opts) {
     return await linkSession(opts);
   } catch (err) {
     if (opts.logFailures) {
-      const { logHookError } = await import('./hook-fast-NJBBZQ5Q.js');
+      const { logHookError } = await import('./hook-fast-XBOZ3N6L.js');
       const reason = err instanceof Error ? err.message : String(err);
       logHookError(opts.home ?? homeFromEnv(opts.env ?? process.env), new Error(`work link-session #${opts.number} failed: ${reason}`));
     }
@@ -389,6 +395,7 @@ async function runWorkRemove(opts) {
   const cwd = opts.cwd ?? process.cwd();
   const env = opts.env ?? process.env;
   const home = opts.home ?? homeFromEnv(env);
+  await connectIfOneFits(opts);
   const creds = resolveCredentials(opts);
   if (!opts.reason) {
     throw new WorkCommandError("--reason is required \u2014 a removal records why");
@@ -432,6 +439,7 @@ async function runWorkRemove(opts) {
 }
 async function runWorkStatus(opts) {
   const cwd = opts.cwd ?? process.cwd();
+  await connectIfOneFits(opts);
   const creds = resolveCredentials(opts);
   const fetchByItem = opts.item !== void 0 ? parsePositiveInt(opts.item, "--item") : void 0;
   if (fetchByItem !== void 0) {
@@ -461,6 +469,7 @@ async function runWorkStatus(opts) {
 }
 async function runWorkList(opts) {
   const cwd = opts.cwd ?? process.cwd();
+  await connectIfOneFits(opts);
   const { url, apiKey, appId } = resolveCredentials(opts);
   const fetchImpl = opts.fetchImpl ?? defaultFetch;
   const repository = opts.repo ?? resolveRepoIdentity(cwd).gitRepo;