@outerlayer/cli 0.6.0 → 0.8.0

package/dist/chunk-HKMPVPO7.js

@@ -0,0 +1,55 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+
+createRequire(import.meta.url);
+
+// src/runner/commit-identity.ts
+var NOREPLY_SUFFIX = "@users.noreply.github.com";
+var MAX_LENGTH = 200;
+function parseIdentity(value) {
+  if (typeof value !== "object" || value === null) return void 0;
+  const { name, email } = value;
+  if (typeof name !== "string" || typeof email !== "string") return void 0;
+  if (name.trim() === "" || name.length > MAX_LENGTH || /[\r\n\0<>]/.test(name)) return void 0;
+  if (email.length > MAX_LENGTH || !email.endsWith(NOREPLY_SUFFIX) || /[\s\0<>]/.test(email) || email.length === NOREPLY_SUFFIX.length) return void 0;
+  return { name, email };
+}
+function parseClaimIdentity(data) {
+  const author = parseIdentity(data.commitAuthor);
+  if (author === void 0) return void 0;
+  const coAuthor = parseIdentity(data.coAuthor);
+  return coAuthor === void 0 ? { author } : { author, coAuthor };
+}
+function authorEnvironment(identity) {
+  if (identity === void 0) return {};
+  return {
+    GIT_AUTHOR_NAME: identity.name,
+    GIT_AUTHOR_EMAIL: identity.email,
+    GIT_COMMITTER_NAME: identity.name,
+    GIT_COMMITTER_EMAIL: identity.email
+  };
+}
+function configCount(env) {
+  const raw = String(env.GIT_CONFIG_COUNT);
+  return /^[0-9]+$/.test(raw) ? Number(raw) : 0;
+}
+function withGitConfig(env, key, value) {
+  const at = configCount(env);
+  return {
+    ...env,
+    GIT_CONFIG_COUNT: String(at + 1),
+    [`GIT_CONFIG_KEY_${at}`]: key,
+    [`GIT_CONFIG_VALUE_${at}`]: value
+  };
+}
+function withHooksPath(env, dir) {
+  return withGitConfig(env, "core.hooksPath", dir);
+}
+function commitIdentityRecord(identity) {
+  return {
+    author: identity === void 0 ? "host" : "app",
+    coAuthor: identity?.coAuthor !== void 0 && identity.hooksPath !== void 0 ? "credited" : "none"
+  };
+}
+
+export { authorEnvironment, commitIdentityRecord, parseClaimIdentity, withGitConfig, withHooksPath };

package/dist/{chunk-43J3M6KB.js → chunk-IJBVPLZZ.js}

@@ -1,22 +1,24 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-ABIWDUMS.js';
-import { readMarker, currentVersion, removeMarker, writeMarker, entryIn, versionDir, switchCurrent, cleanVersions, isInLayout, startedThroughCurrent, stagingDir } from './chunk-YYYXRJUW.js';
-import { LEASE_SECONDS, releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, ALREADY_RELEASED } from './chunk-VMJ3MMBX.js';
+import { LEASE_SECONDS, releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, ALREADY_RELEASED } from './chunk-7VNURP6M.js';
 import { writeJobFile, readJobFile, readJobFileChecked } from './chunk-T6OIJQRT.js';
 import { RUNNER_PROTOCOL } from './chunk-AIW6GLET.js';
 import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-UGP76IZ5.js';
-import { placeholderQueues, placeholderProblem } from './chunk-MXB5VB4Y.js';
+import { placeholderQueues, placeholderProblem } from './chunk-IRCBTGWF.js';
+import { readMarker, currentVersion, removeMarker, writeMarker, entryIn, versionDir, switchCurrent, cleanVersions, isInLayout, startedThroughCurrent, stagingDir } from './chunk-TI7B7UEO.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { checkFit } from './chunk-OUUINEYB.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, BuildTokens, classifyRefusal, refusalCode, formatClock, measureDisk, createRunnerLog, setUpRunnerCgroup, ensureTunnel, keepGhConfigCurrent, createContainerRuntime, runnerLabelValue, BUILD_LABEL, RUNNER_LABEL } from './chunk-RZSF5B46.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, BuildTokens, classifyRefusal, refusalCode, measureDisk, createRunnerLog, setUpRunnerCgroup, ensureTunnel, keepGhConfigCurrent, createContainerRuntime, formatClock } from './chunk-CM5QTKM4.js';
+import { checkFit } from './chunk-JKIWMRFH.js';
 import { startTimeOf, claimPidFile, readPidFile, isSameProcess, releasePidFile } from './chunk-N5FOE5PS.js';
-import { spawnRun } from './chunk-774HEQL6.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-BNMCXPG7.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind } from './chunk-3DD6AOWC.js';
-import { exceedsDisk } from './chunk-F6GFZXZ3.js';
-import { parseClaimIdentity, sharedUserEnvironment, JOB_MOUNT, claudeCredential } from './chunk-AUFG23AA.js';
+import { spawnRun } from './chunk-U3GOI2B4.js';
+import { builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, BUILD_LABEL, RUNNER_LABEL } from './chunk-5TNS3PL7.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-5QLNZGAQ.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind } from './chunk-PWBILI5P.js';
+import { exceedsDisk } from './chunk-7RQ73DLO.js';
+import { sharedUserEnvironment, JOB_MOUNT, claudeCredential } from './chunk-OD2VTIHN.js';
+import { parseClaimIdentity } from './chunk-HKMPVPO7.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
 import { loadHostKey, ensureHostKey, signerFor } from './chunk-M5POMKKW.js';
 import { RUNNER_DIR_MODE, runnerDir, buildDir, attemptStamp, jobDir, jobsDir, pidFilePath, spoolDir, RUNNER_FILE_MODE, rootfsDir } from './chunk-ZM2IMMYN.js';
@@ -36,7 +38,7 @@ function openKvm() {
   }
 }
 function realBlockedProbes() {
-  return { env: process.env, kvm: openKvm, totalMemoryBytes: totalmem };
+  return { env: process.env, kvm: openKvm, totalMemoryBytes: totalmem, imageBuilder: "unknown" };
 }
 var DEFAULT_BUILD_MEMORY = "8g";
 function checkBlocked(config, probes) {
@@ -60,6 +62,13 @@ function checkBlocked(config, probes) {
       reason: "the runner cannot open /dev/kvm, so builtin:vm cannot start a microVM. Add the runner's account to the kvm group, then restart the service, because a service reads its groups only when it starts"
     };
   }
+  if (kind === "container" || kind === "vm") {
+    const builder = probes.imageBuilder;
+    if (builder === "unknown") {
+      return { reason: "the runner is still preparing its image builder, the container that limits image builds to runner.build.memory, so it claims nothing yet" };
+    }
+    if (builder !== "usable") return { reason: `${builder.problem}. The runner takes work again once its image builder works` };
+  }
   if (kind !== "own" && claudeCredential(probes.env) === void 0) {
     return {
       reason: "there is no Claude credential in the runner's environment. Put CLAUDE_CODE_OAUTH_TOKEN (from `claude setup-token`) or ANTHROPIC_API_KEY in the runner.env beside the config, then restart the service"
@@ -670,8 +679,9 @@ function createHousekeepingDocker(deps) {
       if (result.status !== 0) throw failure(result, `docker rmi ${id}`);
     },
     async builderPrune(keepBytes) {
-      const result = await run("docker", ["builder", "prune", "--force", "--keep-storage", String(keepBytes)]);
-      if (result.status !== 0) throw failure(result, "docker builder prune");
+      const result = await run("docker", ["buildx", "prune", "--builder", deps.builder, "--force", "--max-used-space", String(keepBytes)]);
+      if (result.status !== 0 && /no builder .* found/i.test(result.stderr)) return { freedBytes: 0 };
+      if (result.status !== 0) throw failure(result, "docker buildx prune");
       return { freedBytes: parsePrunedBytes(result.stdout) };
     }
   };
@@ -690,7 +700,7 @@ function selectJobDirs(entries, nowMs, keepDays) {
 function liveBuildIds(jobs) {
   const ids = /* @__PURE__ */ new Set();
   for (const job of jobs) {
-    for (const id of [job.container?.buildId, job.microvm?.buildId, job.build?.buildId]) if (id !== void 0) ids.add(id);
+    for (const id of [job.container?.buildId, job.microvm?.buildId, job.build?.buildId, job.checkContainer?.buildId]) if (id !== void 0) ids.add(id);
   }
   return ids;
 }
@@ -842,7 +852,7 @@ async function runHousekeeping(options) {
       try {
         const pruned = await docker.builderPrune(options.buildCacheMax);
         freed += pruned.freedBytes;
-        log.line(`housekeeping: pruned the build cache down to ${formatBytes(options.buildCacheMax)}, freed ${formatBytes(pruned.freedBytes)}`);
+        log.line(`housekeeping: pruned the image builder's build cache down to ${formatBytes(options.buildCacheMax)}, freed ${formatBytes(pruned.freedBytes)}`);
       } catch (err) {
         log.error(`housekeeping: the build cache could not be pruned: ${describeCallFailure(err)}`);
       }
@@ -1136,10 +1146,39 @@ async function tick(state) {
   }
   await sendTickHeartbeat(state, state.lastWorkRequest);
 }
+function imageBuilderState(state) {
+  const kind = builtinKind(state.config.hooks.provision);
+  if (kind !== "container" && kind !== "vm") return "usable";
+  if (state.deps.container?.buildImage !== void 0 || state.deps.container?.imageHost !== void 0) return "usable";
+  const memory = state.config.build?.memory ?? "8g";
+  let probe = state.imageBuilder;
+  if (probe === void 0 || probe.memory !== memory) probe = state.imageBuilder = { memory, at: 0, running: false };
+  if (probe.result?.ok === true && !probe.running && probe.failures !== void 0 && ensureFailureCount() !== probe.failures) probe.result = void 0;
+  const nowMs = nowOf(state).getTime();
+  const recheckMs = 10 * 6e4;
+  const due = !probe.running && (probe.result === void 0 || !probe.result.ok || nowMs - probe.at >= recheckMs);
+  if (due) {
+    const checking = probe;
+    checking.running = true;
+    const spec = builderSpec(state.config.configPath, memory, state.deps.container?.hostEnv ?? process.env);
+    const check = state.deps.builderProbe ?? ((s) => ensureBuilder(spawnRun, s, { bootstrap: true }));
+    void check(spec).catch((err) => ({ ok: false, problem: `the image builder could not be checked: ${describeCallFailure(err)}` })).then((result2) => {
+      checking.result = result2;
+      checking.failures = ensureFailureCount();
+      checking.at = nowOf(state).getTime();
+      checking.running = false;
+      if (result2.ok && state.blocked !== void 0 && state.pollTimerSeconds !== void 0) void tick(state);
+    });
+  }
+  const result = probe.result;
+  if (result === void 0) return "unknown";
+  return result.ok ? "usable" : { problem: result.problem };
+}
 function holdWhenBlocked(state) {
   const probes = {
     ...realBlockedProbes(),
     ...state.deps.container?.hostEnv === void 0 ? {} : { env: state.deps.container.hostEnv },
+    ...state.deps.blocked?.imageBuilder === void 0 ? { imageBuilder: imageBuilderState(state) } : {},
     ...state.deps.blocked
   };
   const blocked = checkBlocked(state.config, probes);
@@ -1193,7 +1232,7 @@ async function housekeepingPass(state) {
   state.housekeepingRunning = true;
   try {
     state.deps.housekeeping ??= {};
-    state.deps.housekeeping.docker ??= createHousekeepingDocker({ runnerId: runnerLabelValue(state.config.configPath) });
+    state.deps.housekeeping.docker ??= createHousekeepingDocker({ runnerId: runnerLabelValue(state.config.configPath), builder: builderName(state.config.configPath) });
     const result = await runHousekeeping({
       configPath: state.config.configPath,
       keepDays: config.jobsKeepDays,
@@ -1267,7 +1306,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-OVNF44FY.js');
+  const { postJson: postJson2 } = await import('./work-cmd-B3FOXZAL.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -1395,6 +1434,7 @@ async function startJob(state, item, queue, claimId, itemKey, branch, identity)
     itemKey,
     branch,
     commitIdentity: identity,
+    ...item.specRepository === void 0 || item.specRepository === null || item.specRepository === "" ? {} : { repository: item.specRepository },
     startedAt: startedAt.toISOString()
   };
   writeJobFile(jobFilePath, job);
@@ -1864,8 +1904,39 @@ async function endJob(state, active, outcome, ending) {
     state.jobs.delete(active.dirPath);
   }
 }
+async function renewLeaseIfDue(state, active, nowMs) {
+  const log = logOf(state);
+  const tag = `#${active.job.item}`;
+  if (!needsRenew(active.lastRenewAtMs, nowMs)) return true;
+  const renew = await retrySend(() => renewLease(state.config, active.job.item, state.deps.fetchImpl), {
+    now: state.deps.now,
+    sleep: state.deps.sleep
+  });
+  const result = renew.ok ? renew.value : "retry_later";
+  if (result === "lease_lost") {
+    if (active.ending) {
+      log.error(`${tag} lease lost while the checks ran`);
+      return false;
+    }
+    log.error(`${tag} lease lost \xB7 ending job as lease_lost`);
+    await endJob(state, active, "lease_lost");
+    return false;
+  }
+  if (result === "renewed") {
+    active.job.lastRenewAt = new Date(nowMs).toISOString();
+    writeJobFile(join(active.dirPath, "job.json"), active.job);
+    log.line(`${tag} lease renewed \xB7 expires ${formatClock(new Date(nowMs + LEASE_SECONDS * 1e3), new Date(nowMs))}`);
+  } else {
+    log.error(`${tag} renew did not land \xB7 retrying in ${RENEW_INTERVAL_SECONDS / 60}m`);
+  }
+  active.lastRenewAtMs = nowMs;
+  return true;
+}
 async function watchTick(state, active, nowMs, logMtimeMs) {
-  if (active.ending) return;
+  if (active.ending) {
+    if (active.job.stage === "checks") await renewLeaseIfDue(state, active, nowMs);
+    return;
+  }
   const log = logOf(state);
   const tag = `#${active.job.item}`;
   const pid = active.job.pid;
@@ -1883,26 +1954,7 @@ async function watchTick(state, active, nowMs, logMtimeMs) {
     }
     return;
   }
-  if (needsRenew(active.lastRenewAtMs, nowMs)) {
-    const renew = await retrySend(() => renewLease(state.config, active.job.item, state.deps.fetchImpl), {
-      now: state.deps.now,
-      sleep: state.deps.sleep
-    });
-    const result = renew.ok ? renew.value : "retry_later";
-    if (result === "lease_lost") {
-      log.error(`${tag} lease lost \xB7 ending job as lease_lost`);
-      await endJob(state, active, "lease_lost");
-      return;
-    }
-    if (result === "renewed") {
-      active.job.lastRenewAt = new Date(nowMs).toISOString();
-      writeJobFile(join(active.dirPath, "job.json"), active.job);
-      log.line(`${tag} lease renewed \xB7 expires ${formatClock(new Date(nowMs + LEASE_SECONDS * 1e3), new Date(nowMs))}`);
-    } else {
-      log.error(`${tag} renew did not land \xB7 retrying in ${RENEW_INTERVAL_SECONDS / 60}m`);
-    }
-    active.lastRenewAtMs = nowMs;
-  }
+  if (!await renewLeaseIfDue(state, active, nowMs)) return;
   const tokens = active.job.container === void 0 && active.job.microvm === void 0 ? void 0 : runtimeOf(state).credentials.get(active.dirPath);
   if (tokens !== void 0) {
     await tokens.renewReadIfDue();
@@ -1978,7 +2030,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     const outcome = await onStartUnderMarker({
       configPath,
       own: ownVersionOf(deps),
-      check: update.check ? () => update.check(configPath) : async () => (await import('./check-CCVPBN7A.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
+      check: update.check ? () => update.check(configPath) : async () => (await import('./check-FOF3PUKI.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
     });

package/dist/{chunk-PMAMOSTP.js → chunk-ILEA3YHM.js}

@@ -1,13 +1,62 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { dashboardBase, isRepositoryLinked, workPageUrl, notLinkedText } from './chunk-7DBI6SNT.js';
-import { sanitizeTerminal } from './chunk-3DEVYTNQ.js';
-import { remoteLookupFailed } from './chunk-ANK2B36Y.js';
+import { sanitizeTerminal } from './chunk-ZYHKJKSU.js';
+import { remoteLookupFailed } from './chunk-GAYWY4GI.js';
+import { DEFAULT_DASHBOARD } from './chunk-USO2DKBD.js';
 import { resolveGatewayCredentials } from './chunk-BOLTI6LR.js';
-import { findGitDirs, readRepoConnection, writeRepoConnection } from './chunk-BJ3KTMDH.js';
+import { readCloudConfig } from './chunk-EABW6AJQ.js';
+import { writeRepoConnection, findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { createInterface } from 'readline/promises';
 
 createRequire(import.meta.url);
+
+// src/repository-link.ts
+var LINKS_TIMEOUT_MS = 15e3;
+var GITHUB_PREFIX = "github.com/";
+function isLinkedRepository(local, linked) {
+  if (linked.provider !== "github" || typeof linked.repository !== "string") return false;
+  return local.toLowerCase() === `${GITHUB_PREFIX}${linked.repository.toLowerCase()}`;
+}
+function ownerAndName(repository) {
+  return repository.toLowerCase().startsWith(GITHUB_PREFIX) ? repository.slice(GITHUB_PREFIX.length) : repository;
+}
+async function isRepositoryLinked(fetchImpl, gatewayUrl, token, appId, repository) {
+  if (!repository.toLowerCase().startsWith(GITHUB_PREFIX)) return null;
+  let res;
+  try {
+    res = await fetchImpl(`${gatewayUrl.replace(/\/+$/, "")}/v1/apps/${encodeURIComponent(appId)}/git/links`, {
+      method: "GET",
+      headers: { authorization: `Bearer ${token}`, "x-outerlayer-app-id": appId },
+      signal: AbortSignal.timeout(LINKS_TIMEOUT_MS)
+    });
+  } catch {
+    return null;
+  }
+  if (!res.ok) return null;
+  const listed = (await res.json().catch(() => void 0))?.data;
+  if (!Array.isArray(listed)) return null;
+  return listed.some((entry) => isLinkedRepository(repository, entry ?? {}));
+}
+function dashboardBase(home) {
+  const saved = readCloudConfig(home).dashboard;
+  const base = typeof saved === "string" && saved.trim() !== "" ? saved : DEFAULT_DASHBOARD;
+  return base.replace(/\/+$/, "");
+}
+function workPageUrl(home, organization, factory) {
+  return `${dashboardBase(home)}/orgs/${encodeURIComponent(organization)}/factories/${encodeURIComponent(factory)}/work`;
+}
+function notLinkedText(factoryName, repository, url) {
+  const shown = sanitizeTerminal(repository);
+  const name = sanitizeTerminal(ownerAndName(repository));
+  return `${factoryName} has no link to ${shown} yet, so work from this repository cannot reach it.
+Link it on the factory's Work page: ${url}
+  1. Connect GitHub repository, and grant the App access to ${name}.
+  2. Link repository, and pick ${name} and its default branch.
+Then run \`outerlayer connect\` again.
+`;
+}
+
+// src/connect-cmd.ts
 var REQUEST_TIMEOUT_MS = 15e3;
 var EXIT_NOT_LINKED = 2;
 var REASON_TEXT = {
@@ -72,10 +121,10 @@ function parseFactories(body) {
 function listText(factories, repository) {
   return factories.map((f) => `  ${slug(f)}  ${f.displayName}${f.linked === true ? ` (linked to ${repository})` : ""}`).join("\n");
 }
-async function fetchFactories(deps, url, token, repository) {
+async function fetchFactories(fetchImpl, url, token, repository) {
   let res;
   try {
-    res = await deps.fetchImpl(`${url.replace(/\/+$/, "")}/v1/me/factories?${new URLSearchParams({ repository }).toString()}`, {
+    res = await fetchImpl(`${url.replace(/\/+$/, "")}/v1/me/factories?${new URLSearchParams({ repository }).toString()}`, {
       method: "GET",
       headers: { authorization: `Bearer ${token}` },
       signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
@@ -99,6 +148,26 @@ async function fetchFactories(deps, url, token, repository) {
   }
   return { ok: true, factories };
 }
+function selectFactory(factories, saved, repository) {
+  const remembered = saved && factories.find((f) => f.id === saved.appId);
+  if (remembered) return { factory: remembered, reason: "saved" };
+  const linked = factories.filter((f) => f.linked === true);
+  if (linked.length === 1) return { factory: linked[0], reason: "linked" };
+  if (factories.length === 1) return { factory: factories[0], reason: "only" };
+  return { factory: void 0, values: factories.map(slug), text: listText(factories, repository) };
+}
+function saveFactoryConnection(gitCommonDir, saved, factory, now) {
+  if (saved?.appId === factory.id) return;
+  writeRepoConnection(gitCommonDir, {
+    appId: factory.id,
+    organization: { name: factory.organization.name, displayName: factory.organization.displayName },
+    factory: { name: factory.name, displayName: factory.displayName },
+    savedAt: now.toISOString()
+  });
+}
+function connectedLine(repository, factory, reason) {
+  return `Connected ${repository} to factory "${factory.displayName}" in ${factory.organization.displayName} (${REASON_TEXT[reason]}).`;
+}
 async function choose(flags, deps, factories, saved, repository) {
   if (flags.factory !== void 0) {
     const wanted = flags.factory.toLowerCase();
@@ -108,11 +177,9 @@ async function choose(flags, deps, factories, saved, repository) {
 ${listText(factories, repository)}`;
     return result(1, "failed", `--factory ${flags.factory} names no factory you can use`, message);
   }
-  const remembered = saved && factories.find((f) => f.id === saved.appId);
-  if (remembered) return { factory: remembered, reason: "saved" };
+  const decided = selectFactory(factories, saved, repository);
+  if (decided.factory) return { factory: decided.factory, reason: decided.reason };
   const linked = factories.filter((f) => f.linked === true);
-  if (linked.length === 1) return { factory: linked[0], reason: "linked" };
-  if (factories.length === 1) return { factory: factories[0], reason: "only" };
   if (!deps.isTerminal) {
     const why = linked.length > 1 ? `${repository} is linked to more than one factory you can use` : `you can use more than one factory, and none is the only one ${repository} is linked to`;
     const message = `${why}, and there is no terminal to ask on.
@@ -169,7 +236,7 @@ async function runConnect(flags, deps) {
     const message = "no gateway address is saved. Run `outerlayer login` to sign in.";
     return result(1, "failed", message, message);
   }
-  const listed = await fetchFactories(deps, creds.url, creds.credential, repository);
+  const listed = await fetchFactories(deps.fetchImpl, creds.url, creds.credential, repository);
   if (!listed.ok) return listed.result;
   const { factories } = listed;
   if (factories.length === 0) {
@@ -181,20 +248,13 @@ async function runConnect(flags, deps) {
   const choice = await choose(flags, deps, factories, saved, repository);
   if ("code" in choice) return choice;
   const { factory, reason } = choice;
-  if (saved?.appId !== factory.id) {
-    try {
-      writeRepoConnection(dirs.gitCommonDir, {
-        appId: factory.id,
-        organization: { name: factory.organization.name, displayName: factory.organization.displayName },
-        factory: { name: factory.name, displayName: factory.displayName },
-        savedAt: deps.now().toISOString()
-      });
-    } catch (err) {
-      const message = `could not save the connection under ${dirs.gitCommonDir}: ${err instanceof Error ? err.message : String(err)}`;
-      return result(1, "failed", "could not save the connection", message);
-    }
+  try {
+    saveFactoryConnection(dirs.gitCommonDir, saved, factory, deps.now());
+  } catch (err) {
+    const message = `could not save the connection under ${dirs.gitCommonDir}: ${err instanceof Error ? err.message : String(err)}`;
+    return result(1, "failed", "could not save the connection", message);
   }
-  const connected = `Connected ${repository} to factory "${factory.displayName}" in ${factory.organization.displayName} (${REASON_TEXT[reason]}).
+  const connected = `${connectedLine(repository, factory, reason)}
 `;
   const why = `connected to ${slug(factory)}: ${REASON_TEXT[reason]}`;
   const linked = await isRepositoryLinked(deps.fetchImpl, creds.url, creds.credential, factory.id, repository);
@@ -229,4 +289,4 @@ async function runConnectCommand(flags, deps, out) {
   return r.code;
 }
 
-export { promptOnTerminal, realConnectDeps, runConnect, runConnectCommand };
+export { connectedLine, fetchFactories, isLinkedRepository, promptOnTerminal, realConnectDeps, runConnect, runConnectCommand, saveFactoryConnection, selectFactory };

package/dist/{chunk-MXB5VB4Y.js → chunk-IRCBTGWF.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-4NLKY4WR.js';
-import { describeCallFailure } from './chunk-RZSF5B46.js';
-import { WorkCommandError, getJson } from './chunk-BNMCXPG7.js';
-import { sanitizeTerminal } from './chunk-3DEVYTNQ.js';
-import { builtinKind } from './chunk-3DD6AOWC.js';
-import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential } from './chunk-AUFG23AA.js';
+import { isPlaceholderCommand } from './chunk-NALVDFIS.js';
+import { describeCallFailure } from './chunk-CM5QTKM4.js';
+import { WorkCommandError, getJson } from './chunk-5QLNZGAQ.js';
+import { sanitizeTerminal } from './chunk-ZYHKJKSU.js';
+import { builtinKind } from './chunk-PWBILI5P.js';
+import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential } from './chunk-OD2VTIHN.js';
 import { signerFor } from './chunk-M5POMKKW.js';
 
 createRequire(import.meta.url);

package/dist/{chunk-OUUINEYB.js → chunk-JKIWMRFH.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { parseSize } from './chunk-F6GFZXZ3.js';
+import { parseSize } from './chunk-7RQ73DLO.js';
 
 createRequire(import.meta.url);
 

package/dist/{chunk-FA2BOX4O.js → chunk-JPR2WHHF.js}

@@ -628,7 +628,7 @@ async function runHookFast(event, home = homeFromEnv(), read = readStdin, env =
       recordHookErrorsSeen(home, hookErrorsBytes);
       if (contextPossiblyGoverned(sessionCwd, home)) {
         try {
-          const { materializeContext: materialize } = await import('./context-materialize-3HLPZAF6.js');
+          const { materializeContext: materialize } = await import('./context-materialize-QL33HDJN.js');
           const sessionId = typeof payload.session_id === "string" ? payload.session_id : "unknown";
           const result = await materialize({ cwd: sessionCwd, sessionId, home });
           materializeMessage = result.message;

package/dist/{chunk-IASWYRVG.js → chunk-K35RW5HP.js}

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
+import { autoConnect } from './chunk-4ACZCY4I.js';
 import { detectActiveSession } from './chunk-BFESLKPP.js';
-import { resolveRepoIdentity } from './chunk-ANK2B36Y.js';
+import { resolveRepoIdentity } from './chunk-GAYWY4GI.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { defaultFetch } from './chunk-BCLJSQCV.js';
 import { unauthorizedMessage, resolveGatewayCredentials } from './chunk-BOLTI6LR.js';
@@ -37,6 +38,8 @@ async function runWorkPr(opts) {
   const cwd = opts.cwd ?? process.cwd();
   const env = opts.env ?? process.env;
   const home = opts.home ?? homeFromEnv(env);
+  const refusal = await autoConnect(opts);
+  if (refusal !== void 0) throw new WorkPrCommandError(refusal);
   const creds = resolveCredentials(opts);
   const prNumber = resolvePrNumber(opts.number);
   const repository = resolveRepository(opts.repo, cwd);

package/dist/{chunk-ZMYPLFG3.js → chunk-M3SQ4YGD.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { C } from './chunk-YRYMNBGQ.js';
-import { resolvePackRoot, loadTemplateFiles, loadMaintainedFiles, TEMPLATE_SKILLS, skillDir, writeMaintainedFiles, MAINTAINED_SKILLS } from './chunk-WO2BXCTQ.js';
+import { resolvePackRoot, loadTemplateFiles, loadMaintainedFiles, TEMPLATE_SKILLS, skillDir, writeMaintainedFiles, MAINTAINED_SKILLS } from './chunk-VXLJORHL.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
 import { existsSync, mkdirSync, writeFileSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-4NLKY4WR.js → chunk-NALVDFIS.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-RBOMWNOG.js';
-import { MIN_ENGINE_MAJOR } from './chunk-RZSF5B46.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-TUUMW4TC.js';
+import { MIN_ENGINE_MAJOR } from './chunk-CM5QTKM4.js';
 import { RUNNER_DIR_MODE, runnerDir, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import { dirname } from 'path';

package/dist/{chunk-AUFG23AA.js → chunk-OD2VTIHN.js}

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
+import { authorEnvironment, withHooksPath } from './chunk-HKMPVPO7.js';
 import { existsSync, unlinkSync, chmodSync } from 'fs';
 import { request as request$1, createServer } from 'http';
 import { request } from 'https';
@@ -344,52 +345,6 @@ async function startBuildServices(input) {
   }
 }
 
-// src/runner/commit-identity.ts
-var NOREPLY_SUFFIX = "@users.noreply.github.com";
-var MAX_LENGTH = 200;
-function parseIdentity(value) {
-  if (typeof value !== "object" || value === null) return void 0;
-  const { name, email } = value;
-  if (typeof name !== "string" || typeof email !== "string") return void 0;
-  if (name.trim() === "" || name.length > MAX_LENGTH || /[\r\n\0<>]/.test(name)) return void 0;
-  if (email.length > MAX_LENGTH || !email.endsWith(NOREPLY_SUFFIX) || /[\s\0<>]/.test(email) || email.length === NOREPLY_SUFFIX.length) return void 0;
-  return { name, email };
-}
-function parseClaimIdentity(data) {
-  const author = parseIdentity(data.commitAuthor);
-  if (author === void 0) return void 0;
-  const coAuthor = parseIdentity(data.coAuthor);
-  return coAuthor === void 0 ? { author } : { author, coAuthor };
-}
-function authorEnvironment(identity) {
-  if (identity === void 0) return {};
-  return {
-    GIT_AUTHOR_NAME: identity.name,
-    GIT_AUTHOR_EMAIL: identity.email,
-    GIT_COMMITTER_NAME: identity.name,
-    GIT_COMMITTER_EMAIL: identity.email
-  };
-}
-function configCount(env) {
-  const raw = String(env.GIT_CONFIG_COUNT);
-  return /^[0-9]+$/.test(raw) ? Number(raw) : 0;
-}
-function withHooksPath(env, dir) {
-  const at = configCount(env);
-  return {
-    ...env,
-    GIT_CONFIG_COUNT: String(at + 1),
-    [`GIT_CONFIG_KEY_${at}`]: "core.hooksPath",
-    [`GIT_CONFIG_VALUE_${at}`]: dir
-  };
-}
-function commitIdentityRecord(identity) {
-  return {
-    author: identity === void 0 ? "host" : "app",
-    coAuthor: identity?.coAuthor !== void 0 && identity.hooksPath !== void 0 ? "credited" : "none"
-  };
-}
-
 // src/runner/container/environment.ts
 var RELAY_PORT = 3128;
 var JOB_MOUNT = "/outerlayer/job";
@@ -498,6 +453,23 @@ function buildEnvironment(input) {
     skippedTokenVariables
   };
 }
+function checkEnvironment(input) {
+  const env = buildEnvironment({
+    config: input.config,
+    item: input.item,
+    itemKey: void 0,
+    repository: input.repository,
+    hostEnv: input.hostEnv,
+    containerEnv: input.containerEnv,
+    builtIns: false
+  });
+  const withheld = /* @__PURE__ */ new Set(["OUTERLAYER_URL", "OUTERLAYER_API_KEY", ...CLAUDE_CREDENTIAL_VARIABLES]);
+  const literals = {};
+  for (const [name, value] of Object.entries(env.literals)) if (!withheld.has(name)) literals[name] = value;
+  const passed = {};
+  for (const [name, value] of Object.entries(env.passed)) if (!withheld.has(name)) passed[name] = value;
+  return { literals, passed };
+}
 function parseIsolation(value) {
   return value === "container" || value === "vm" ? value : "shared-user";
 }
@@ -531,4 +503,4 @@ function withTunnelRecord(environment, record, onlyWhenUsed = false) {
   };
 }
 
-export { AGENT_CREDENTIAL_MISSING, BUILT_IN_NAMES, CHECKOUT_DIR, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, RELAY_PORT, authorEnvironment, buildEnvironment, builtInEnvironment, claudeCredential, commitIdentityRecord, containerLocalAddress, destinationEnvironment, headerVariables, isRefusedInConfig, isReservedVariable, parseClaimIdentity, parseIsolation, proxyEnvironment, resolveDestinations, sharedUserEnvironment, startBuildServices, withHooksPath, withTunnelRecord };
+export { AGENT_CREDENTIAL_MISSING, BUILT_IN_NAMES, CHECKOUT_DIR, CLAUDE_CREDENTIAL_VARIABLES, CLAUDE_PORT, CLAUDE_SOCKET, DESTINATION_BASE_PORT, GATEWAY_PORT, GATEWAY_SOCKET, JOB_MOUNT, RELAY_PORT, buildEnvironment, builtInEnvironment, checkEnvironment, claudeCredential, containerLocalAddress, destinationEnvironment, headerVariables, isRefusedInConfig, isReservedVariable, parseIsolation, proxyEnvironment, resolveDestinations, sharedUserEnvironment, startBuildServices, withTunnelRecord };