@outerlayer/cli 0.8.6 → 0.10.0

package/dist/{inspect-XAUSB7L3.js → chunk-6MZSX4M7.js}

@@ -1,6 +1,5 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import './chunk-Z5GEFMRW.js';
 import { spawnSync } from 'child_process';
 import { statSync, readFileSync } from 'fs';
 import { join } from 'path';
@@ -15,11 +14,18 @@ function holdsGroup(status, gid) {
   const supplementary = /^Groups:[ \t]*(.*)$/m.exec(status)?.[1]?.trim().split(/\s+/).filter((g) => g !== "") ?? [];
   return [primary, ...supplementary].some((g) => g !== void 0 && Number(g) === gid);
 }
+function parseRunnerEnv(text) {
+  const env = {};
+  for (const line of text.split("\n")) {
+    const match = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.*)$/.exec(line);
+    if (match === null) continue;
+    env[match[1]] = match[2].trim().replace(/^(["'])(.*)\1$/, "$2");
+  }
+  return env;
+}
 function credentialNames(env) {
-  const set = new Set(
-    (env ?? "").split("\n").map((line) => /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.+)$/.exec(line)).flatMap((m) => m === null || m[2].trim() === "" ? [] : [m[1]])
-  );
-  return CREDENTIAL_VARIABLES.filter((name) => set.has(name));
+  const set = parseRunnerEnv(env ?? "");
+  return CREDENTIAL_VARIABLES.filter((name) => (set[name] ?? "").trim() !== "");
 }
 function inspectService(unit, configDir, probes) {
   const shown = probes.show(unit);
@@ -60,4 +66,4 @@ function realInspectProbes() {
   };
 }
 
-export { inspectService, realInspectProbes };
+export { inspectService, parseRunnerEnv, realInspectProbes };

package/dist/{chunk-IS4DIGBQ.js → chunk-ABIWDUMS.js}

@@ -6,18 +6,6 @@ import { join, dirname } from 'path';
 import { createHash } from 'crypto';
 
 createRequire(import.meta.url);
-
-// src/runner/update/installed-switch.ts
-function decideInstalledSwitch(input) {
-  const to = input.current;
-  if (to === void 0 || to === input.own || !input.fromCurrent) return { kind: "none" };
-  if (!input.installed) return { kind: "missing", to };
-  if (!input.underService) return { kind: "foreground", to };
-  return { kind: "restart", to };
-}
-function startedByService(env, parentPid) {
-  return (env.INVOCATION_ID ?? "") !== "" && parentPid === 1;
-}
 var REGISTRY_URL = "https://registry.npmjs.org";
 var PACKAGE_NAME = "@outerlayer/cli";
 var PACKAGE_PATH = "@outerlayer%2fcli";
@@ -113,4 +101,4 @@ async function auditSignatures(runNpm, dir) {
   return { ok: true };
 }
 
-export { auditSignatures, decideInstalledSwitch, fetchProvenance, fetchTarballDigest, fetchVersionMeta, installVersion, npmSupportsProvenance, npmVersion, realRunNode, realRunNpm, startedByService };
+export { auditSignatures, fetchProvenance, fetchTarballDigest, fetchVersionMeta, installVersion, npmSupportsProvenance, npmVersion, realRunNode, realRunNpm };

package/dist/{chunk-WLV4KCAW.js → chunk-BGWTYRSS.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { splitRawFile } from './chunk-NKU5OPYP.js';
+import { splitRawFile } from './chunk-TB7EP24C.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, readdirSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-2MFYKH3C.js → chunk-BMX3L7CR.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { CONTEXT_PIN_SCHEMA_VERSION, CONTEXT_PIN_FILENAME } from './chunk-NKU5OPYP.js';
+import { CONTEXT_PIN_SCHEMA_VERSION, CONTEXT_PIN_FILENAME } from './chunk-TB7EP24C.js';
 import { readFileSync, existsSync, writeFileSync, mkdirSync, utimesSync, statSync, unlinkSync } from 'fs';
 import { join, dirname } from 'path';
 

package/dist/{chunk-HKMPVPO7.js → chunk-BYT5O5RV.js}

@@ -42,6 +42,12 @@ function withGitConfig(env, key, value) {
     [`GIT_CONFIG_VALUE_${at}`]: value
   };
 }
+function tokenHeader(token) {
+  return `Authorization: Basic ${Buffer.from(`x-access-token:${token}`).toString("base64")}`;
+}
+function withTokenHeader(env, url, token) {
+  return withGitConfig(env, `http.${url}.extraHeader`, tokenHeader(token));
+}
 function withHooksPath(env, dir) {
   return withGitConfig(env, "core.hooksPath", dir);
 }
@@ -52,4 +58,4 @@ function commitIdentityRecord(identity) {
   };
 }
 
-export { authorEnvironment, commitIdentityRecord, parseClaimIdentity, withGitConfig, withHooksPath };
+export { authorEnvironment, commitIdentityRecord, parseClaimIdentity, tokenHeader, withGitConfig, withHooksPath, withTokenHeader };

package/dist/{chunk-WGLWDX5J.js → chunk-FKFGQJNN.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { RecipeError } from './chunk-QOZKPLVJ.js';
-import { trackImageBuild, isOutOfMemory, ensureBuilder } from './chunk-DE4GLH3P.js';
+import { trackImageBuild, isOutOfMemory, ensureBuilder } from './chunk-TV36SKEN.js';
 import { spawn } from 'child_process';
 import { existsSync, mkdirSync, createWriteStream, rmSync, readFileSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-MSV44EB5.js → chunk-KPUJGBA4.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-TFJGK4UB.js';
-import { resolveRepoIdentity } from './chunk-CDISNKM4.js';
+import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-LYESSQUA.js';
+import { resolveRepoIdentity } from './chunk-LTJPX7TX.js';
 import { resolveGatewayCredentials } from './chunk-PLMTLGYH.js';
 import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-TY7EZC7U.js → chunk-KWCJLAHQ.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { autoConnect } from './chunk-MSV44EB5.js';
+import { autoConnect } from './chunk-KPUJGBA4.js';
 import { detectActiveSession } from './chunk-BFESLKPP.js';
-import { sanitizeTerminal } from './chunk-BL63NBJZ.js';
-import { resolveRepoIdentity } from './chunk-CDISNKM4.js';
+import { sanitizeTerminal } from './chunk-ZEQMTBRD.js';
+import { resolveRepoIdentity } from './chunk-LTJPX7TX.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { defaultFetch } from './chunk-YO4PSLVB.js';
 import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-PLMTLGYH.js';
@@ -347,7 +347,7 @@ async function runWorkLinkSession(opts) {
     return await linkSession(opts);
   } catch (err) {
     if (opts.logFailures) {
-      const { logHookError } = await import('./hook-fast-CFLLVMSV.js');
+      const { logHookError } = await import('./hook-fast-AQCAQIA6.js');
       const reason = err instanceof Error ? err.message : String(err);
       logHookError(opts.home ?? homeFromEnv(opts.env ?? process.env), new Error(`work link-session #${opts.number} failed: ${reason}`));
     }
@@ -505,4 +505,4 @@ async function runWorkList(opts) {
   return { data, output };
 }
 
-export { WorkCommandError, findLiveItem, getJson, isSignatureRefusal, parsePositiveInt, postJson, resolveCredentials, resolveRepository, runWorkBuild, runWorkLinkSession, runWorkList, runWorkRemove, runWorkStatus, signatureRefusalMessage };
+export { WorkCommandError, environmentFacts, findLiveItem, getJson, isSignatureRefusal, parsePositiveInt, postJson, resolveCredentials, resolveRepository, runWorkBuild, runWorkLinkSession, runWorkList, runWorkRemove, runWorkStatus, signatureRefusalMessage };

package/dist/{chunk-GJ3OWUFO.js → chunk-LBU4CLK5.js}

@@ -1,24 +1,24 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-Y7UQHKFY.js';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-3FMPZPJQ.js';
 import { startTimeOf, isSameProcess } from './chunk-N5FOE5PS.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
-import { createDockerHost, childEnvironment, spawnRun } from './chunk-WGLWDX5J.js';
+import { createDockerHost, childEnvironment, spawnRun } from './chunk-FKFGQJNN.js';
 import { RecipeError } from './chunk-QOZKPLVJ.js';
-import { builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, containerExecArgs } from './chunk-DE4GLH3P.js';
+import { builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, containerExecArgs } from './chunk-TV36SKEN.js';
 import { CLAUDE_CODE_VERSION, firecrackerArch, MICROVM_ARCHES, DEFAULT_BASE_IMAGE, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GUEST_ASSETS_VERSION } from './chunk-CX22S5BA.js';
-import { execCapture } from './chunk-HWMYGAKF.js';
-import { GUEST_CID } from './chunk-2E2MG3KW.js';
-import { WorkCommandError, postJson } from './chunk-TY7EZC7U.js';
-import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-CDISNKM4.js';
+import { execCapture } from './chunk-6CXYORUS.js';
+import { GUEST_CID } from './chunk-S6IUUNCD.js';
+import { WorkCommandError, postJson } from './chunk-KWCJLAHQ.js';
+import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-LTJPX7TX.js';
 import { hostAllowed } from './chunk-UXYLWVTQ.js';
 import { parseDuKilobytes } from './chunk-7RQ73DLO.js';
-import { RELAY_PORT, CHECKOUT_DIR, JOB_MOUNT, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING } from './chunk-2FWL7CE2.js';
-import { defaultGitRunner, materializeContext } from './chunk-6AFQOYO3.js';
-import { readContextManifest, readSourceCache } from './chunk-2MFYKH3C.js';
-import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-NKU5OPYP.js';
+import { RELAY_PORT, CHECKOUT_DIR, JOB_MOUNT, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING } from './chunk-M6G7TJVF.js';
+import { defaultGitRunner, materializeContext } from './chunk-RWQWPZB4.js';
+import { readContextManifest, readSourceCache } from './chunk-BMX3L7CR.js';
+import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-TB7EP24C.js';
 import { signingFetchFor } from './chunk-YO4PSLVB.js';
-import { downconvertSession } from './chunk-PK5NANMT.js';
+import { downconvertSession } from './chunk-YT35WGIP.js';
 import { signerFor } from './chunk-V7NIVOFD.js';
 import { rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, stagedContextDir, contextHomeDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, RUNNER_DIR_MODE, vmAssetsDir } from './chunk-ZM2IMMYN.js';
 import { relative, join, dirname, basename } from 'path';
@@ -125,6 +125,7 @@ function classifyRefusal(err) {
   if (!(err instanceof WorkCommandError)) return { kind: "retry" };
   if (err.status === 401 || err.code === "claim_expired" || err.code === "claim_not_held") return { kind: "lease_lost" };
   if (err.code === "github_unavailable") return { kind: "retry" };
+  if (err.code === "github_request_failed") return { kind: "failed", reason: refusalCode(err) };
   if (err.retryable && err.code !== "repository_tokens_unavailable") return { kind: "retry" };
   return { kind: "failed", reason: refusalCode(err) };
 }
@@ -140,6 +141,7 @@ var BuildTokens = class {
     this.issued = [];
     this.usedKinds = /* @__PURE__ */ new Set();
     this.revoked = false;
+    this.controlPlaneRetry = false;
   }
   now() {
     return (this.options.now ?? (() => /* @__PURE__ */ new Date()))();
@@ -165,9 +167,10 @@ var BuildTokens = class {
       throw err;
     }
   }
-  async issue(kind) {
+  /** Asks the gateway for a token with `body`, retrying a failure about the moment. */
+  ask(body) {
     const { config, item, fetchImpl } = this.options;
-    const asked = await retrySend(
+    return retrySend(
       async () => {
         try {
           return await postJson(
@@ -175,20 +178,51 @@ var BuildTokens = class {
             `/v1/work-items/${item}/claim/tokens`,
             config.apiKey,
             config.appId,
-            { access: kind },
+            body,
             fetchImpl,
             void 0,
             await signerFor(config.configPath)
           );
-        } catch (err2) {
-          if (err2 instanceof WorkCommandError && err2.code === "repository_tokens_unavailable") {
-            throw new WorkCommandError(err2.message, false, err2.status, err2.code);
+        } catch (err) {
+          if (err instanceof WorkCommandError && (err.code === "repository_tokens_unavailable" || err.code === "github_request_failed")) {
+            throw new WorkCommandError(err.message, false, err.status, err.code);
           }
-          throw err2;
+          throw err;
         }
       },
       { now: this.options.now, sleep: this.options.sleep, windowMs: ISSUE_RETRY_WINDOW_MS }
     );
+  }
+  /**
+   * A read-only token for the repository that governs the item's, which the
+   * runner uses on the host to fetch its context. It is revoked with the
+   * others when the attempt ends. It is not held or renewed: nothing uses it
+   * after the fetch. A refusal is thrown with the gateway's code. A lost
+   * lease is kept for `refusal()`, and a failure about the moment for
+   * `controlPlaneUnavailable()`, as the read token's are.
+   */
+  async controlPlane() {
+    const asked = await this.ask({ access: "read", target: "control_plane" });
+    if (!asked.ok) {
+      const err = new WorkCommandError(asked.message ?? asked.reason, asked.retryable, asked.status, asked.code);
+      const refusal = classifyRefusal(err);
+      if (refusal.kind === "lease_lost") this.failure = refusal;
+      if (refusal.kind === "retry") this.controlPlaneRetry = true;
+      throw err;
+    }
+    const { token, expiresAt, repository } = asked.value.data;
+    if (typeof token !== "string" || token === "" || typeof expiresAt !== "string" || typeof repository !== "string" || repository === "") {
+      throw new WorkCommandError("the gateway's token answer carried no token, expiry or repository", false, void 0, "malformed_token_response");
+    }
+    if (this.revoked) {
+      await this.revoke([token]);
+      throw new WorkCommandError("the build's tokens were already revoked", false, void 0, "tokens_revoked");
+    }
+    this.issued.push(token);
+    return { token, expiresAt, repository };
+  }
+  async issue(kind) {
+    const asked = await this.ask({ access: kind });
     let err;
     if (!asked.ok) {
       err = new WorkCommandError(asked.message ?? asked.reason, asked.retryable, asked.status, asked.code);
@@ -236,6 +270,10 @@ var BuildTokens = class {
   refusal() {
     return this.failure;
   }
+  /** Whether a control plane token request failed for a reason about the moment, which a later attempt may not meet. */
+  controlPlaneUnavailable() {
+    return this.controlPlaneRetry;
+  }
   /** Revokes every token this holder was issued, the superseded ones too, at GitHub with the token itself. A failure is not an error: the token lapses within the hour. */
   async revokeAll() {
     this.revoked = true;
@@ -1152,6 +1190,17 @@ async function resolveAgentUser(input) {
   if (uid === null) throw new AgentUserError(`the user "${candidate}" is not in the image, so no command can run as it`);
   return uid === 0 ? ADDED_USER : candidate;
 }
+var TokenRefused = class extends Error {
+  constructor(code, detail) {
+    super(code);
+    this.code = code;
+    this.detail = detail;
+  }
+};
+var NoControlPlane = class extends Error {
+};
+var GatewayConflict = class extends Error {
+};
 var unavailable = (why) => ({ kind: "refused", reason: `context_unavailable: ${why}` });
 function makeReadable(tree, dir, files) {
   chmodSync(dir, 493);
@@ -1181,6 +1230,9 @@ async function stageGovernedContext(input) {
       if (!done.ok) return finish(unavailable(`the staging directory could not be prepared: ${done.stderr.trim().split("\n")[0] ?? ""}`));
     }
     const { url, apiKey, appId, configPath } = input.config;
+    let tokenRepository;
+    const credentialFor = (repository) => tokenRepository !== void 0 && tokenRepository.toLowerCase() === repository.toLowerCase() ? "the token the gateway issued" : "the host's git login";
+    const unreadable = (repositories) => repositories.map((repository) => `${credentialFor(repository)} cannot read ${repository}`).join(" and ");
     const result = await materializeContext({
       cwd: tree,
       sessionId: `build-${input.buildId}`,
@@ -1189,12 +1241,17 @@ async function stageGovernedContext(input) {
       fetchImpl: signingFetchFor(input.fetchImpl, configPath, apiKey),
       git: git2,
       now: input.now,
-      resolveControlPlaneUrl: (repository) => input.controlPlaneUrl(repository)
+      resolveControlPlaneUrl: (repository) => input.controlPlaneUrl(repository),
+      controlPlaneAccess: input.controlPlaneToken === void 0 ? void 0 : async (candidates) => {
+        const access = await controlPlaneAccess(input.controlPlaneToken, candidates, input.repository, input.log, input.tag);
+        tokenRepository = access?.repository;
+        return access;
+      }
     });
     switch (result.status) {
       case "materialized": {
         if (result.unfetched !== void 0 && result.unfetched.length > 0) {
-          return finish(unavailable(`the host's git login cannot read ${result.unfetched.join(" or ")}, a control plane named for ${input.repository}, so it cannot be ruled out as a second claimant`));
+          return finish(unavailable(`${unreadable(result.unfetched)}, a control plane named for ${input.repository}, so it cannot be ruled out as a second claimant`));
         }
         const manifest = readContextManifest(join(tree, ".git"));
         const source = readSourceCache(join(tree, ".git"));
@@ -1211,7 +1268,7 @@ async function stageGovernedContext(input) {
       }
       case "self":
         if (result.unfetched !== void 0 && result.unfetched.length > 0) {
-          return finish(unavailable(`the host's git login cannot read ${result.unfetched.join(" or ")}, the control plane named for ${input.repository}`));
+          return finish(unavailable(`${unreadable(result.unfetched)}, the control plane named for ${input.repository}`));
         }
         if (result.designation === "answered") return finish({ kind: "none" });
         if (result.authRejected === true) {
@@ -1224,9 +1281,38 @@ async function stageGovernedContext(input) {
         return finish(unavailable(result.message ?? `the context of ${input.repository} could not be materialized (${result.status})`));
     }
   } catch (err) {
+    if (err instanceof NoControlPlane) return finish({ kind: "none" });
+    if (err instanceof GatewayConflict) return finish({ kind: "refused", reason: `context_conflict: ${err.message}` });
+    if (err instanceof TokenRefused) {
+      return finish(
+        unavailable(
+          err.detail === void 0 ? `the gateway refused a token for the control plane named for ${input.repository} (${err.code})` : `the token request for the control plane named for ${input.repository} failed: ${err.detail}`
+        )
+      );
+    }
     return finish(unavailable(`the context of ${input.repository} could not be staged: ${err instanceof Error ? err.message : String(err)}`));
   }
 }
+async function controlPlaneAccess(ask, candidates, repository, log, tag) {
+  let answer;
+  try {
+    answer = await ask();
+  } catch (err) {
+    const code = refusalCode(err);
+    if (code === "repository_tokens_unavailable") return void 0;
+    if (code === "no_control_plane") throw new NoControlPlane(code);
+    if (code === "context_conflict") throw new GatewayConflict(err instanceof Error ? err.message : code);
+    throw new TokenRefused(code, err instanceof WorkCommandError && err.code === void 0 && err.status === void 0 ? describeCallFailure(err) : void 0);
+  }
+  const named = candidates.some((candidate) => candidate.repository.toLowerCase() === answer.repository.toLowerCase());
+  if (!named) {
+    log?.line(
+      `${tag === void 0 ? "" : `${tag} `}the gateway issued a control plane token for ${answer.repository}, which is none of the repositories named for ${repository} (${candidates.map((candidate) => candidate.repository).join(", ")}) \xB7 fetching with the host's git login`
+    );
+    return void 0;
+  }
+  return answer;
+}
 function removeStagedContext(buildDir2) {
   rmSync(stagedContextDir(buildDir2), { recursive: true, force: true });
 }
@@ -2396,14 +2482,17 @@ async function provisionContainer(input) {
     log,
     tag,
     aborted: input.aborted,
-    // The control plane is read on the host, with the host's git login. The container reads the staged files from its mount of the build's directory.
+    // The control plane is read on the host, with a token the gateway issues (or the host's git login when it has no GitHub App). The container reads the staged files from its mount of the build's directory.
     stageContext: () => stageGovernedContext({
       config,
       repository,
       buildId,
       buildDir: buildDir2,
       fetchImpl: input.fetchImpl,
-      controlPlaneUrl: (controlPlane) => runtime.remoteFor?.(controlPlane) ?? `${runtime.github.gitUrl}/${controlPlane}.git`
+      controlPlaneUrl: (controlPlane) => runtime.remoteFor?.(controlPlane) ?? `${runtime.github.gitUrl}/${controlPlane}.git`,
+      controlPlaneToken: () => tokens.controlPlane(),
+      log,
+      tag
     }),
     removeStagedContext: () => removeStagedContext(buildDir2)
   });

package/dist/{chunk-CDISNKM4.js → chunk-LTJPX7TX.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EVENT_TYPES, isHumanUserTurn, parseAgentSession, SCHEMA_VERSION, SPEED_MAX_LENGTH, inputBandOf, BUCKET_MODEL_MAX_LENGTH } from './chunk-PK5NANMT.js';
+import { EVENT_TYPES, isHumanUserTurn, parseAgentSession, SCHEMA_VERSION, SPEED_MAX_LENGTH, inputBandOf, BUCKET_MODEL_MAX_LENGTH } from './chunk-YT35WGIP.js';
 import { createHash } from 'crypto';
 import { readFileSync, readdirSync, statSync, mkdirSync, copyFileSync, renameSync, unlinkSync, writeFileSync, stat as stat$1, unwatchFile, watchFile, watch as watch$1 } from 'fs';
 import { type, homedir } from 'os';
@@ -21971,14 +21971,14 @@ var ModelRegistryImpl = class {
 };
 var models_default = {
   version: "1.0.0",
-  generatedAt: "2026-10-05T04:49:52.578Z",
+  generatedAt: "2026-10-06T05:36:56.720Z",
   sources: {
     litellm: {
-      fetchedAt: "2026-10-05T04:49:52.578Z",
-      modelCount: 1887
+      fetchedAt: "2026-10-06T05:36:56.720Z",
+      modelCount: 1890
     },
     openrouter: {
-      fetchedAt: "2026-10-05T04:49:52.578Z",
+      fetchedAt: "2026-10-06T05:36:56.720Z",
       modelCount: 198
     }
   },
@@ -22849,7 +22849,8 @@ var models_default = {
         parallelFunctionCalling: true,
         audioInput: true,
         audioOutput: true
-      }
+      },
+      deprecationDate: "2025-03-26"
     },
     "eu/gpt-4o-realtime-preview-2024-12-17": {
       provider: "azure",
@@ -24268,7 +24269,8 @@ var models_default = {
         parallelFunctionCalling: true,
         audioInput: true,
         audioOutput: true
-      }
+      },
+      deprecationDate: "2025-03-26"
     },
     "gpt-4o-realtime-preview-2024-12-17": {
       provider: "azure",
@@ -26309,7 +26311,8 @@ var models_default = {
         parallelFunctionCalling: true,
         audioInput: true,
         audioOutput: true
-      }
+      },
+      deprecationDate: "2025-03-26"
     },
     "us/gpt-4o-realtime-preview-2024-12-17": {
       provider: "azure",
@@ -43131,7 +43134,6 @@ var models_default = {
       supportedParameters: [
         "frequency_penalty",
         "max_tokens",
-        "presence_penalty",
         "temperature",
         "top_k",
         "top_p"
@@ -48576,7 +48578,8 @@ var models_default = {
       context: {
         maxInputTokens: 7e4,
         maxOutputTokens: 4096
-      }
+      },
+      deprecationDate: "2025-03-01"
     },
     "kimi-k2.5": {
       provider: "azure",
@@ -51841,6 +51844,7 @@ var models_default = {
         reasoning: false,
         pdfInput: true
       },
+      deprecationDate: "2027-06-28",
       supportedParameters: [
         "max_tokens",
         "temperature",
@@ -55463,7 +55467,8 @@ var models_default = {
         promptCaching: true,
         reasoning: false,
         pdfInput: true
-      }
+      },
+      deprecationDate: "2027-06-28"
     },
     "grok-4.6": {
       provider: "azure",
@@ -65893,6 +65898,68 @@ var models_default = {
         reasoning: true
       },
       deprecationDate: "2026-03-29"
+    },
+    "global.zai.glm-5.3": {
+      provider: "bedrock",
+      displayName: "Global.zai.glm 5.3",
+      mode: "chat",
+      source: "litellm",
+      pricing: {
+        inputCostPerToken: 168e-8,
+        outputCostPerToken: 528e-8,
+        cacheCreationCostPerToken: 21e-7,
+        cacheReadCostPerToken: 312e-9
+      },
+      context: {
+        maxInputTokens: 1e6,
+        maxOutputTokens: 128e3
+      },
+      capabilities: {
+        vision: false,
+        functionCalling: true,
+        structuredOutput: true,
+        promptCaching: true,
+        reasoning: true,
+        audioInput: false
+      }
+    },
+    "us.zai.glm-5.3": {
+      provider: "bedrock",
+      displayName: "Us.zai.glm 5.3",
+      mode: "chat",
+      source: "litellm",
+      pricing: {
+        inputCostPerToken: 1848e-9,
+        outputCostPerToken: 5808e-9,
+        cacheCreationCostPerToken: 231e-8,
+        cacheReadCostPerToken: 3432e-10
+      },
+      context: {
+        maxInputTokens: 1e6,
+        maxOutputTokens: 128e3
+      },
+      capabilities: {
+        vision: false,
+        functionCalling: true,
+        structuredOutput: true,
+        promptCaching: true,
+        reasoning: true,
+        audioInput: false
+      }
+    },
+    "amazon.nova-2-5-sonic": {
+      provider: "bedrock",
+      displayName: "Amazon.nova 2 5 Sonic",
+      mode: "chat",
+      source: "litellm",
+      pricing: {
+        inputCostPerToken: 33e-8,
+        outputCostPerToken: 275e-8
+      },
+      capabilities: {
+        audioInput: true,
+        audioOutput: true
+      }
     }
   }
 };
@@ -68227,13 +68294,26 @@ function git(cwd, args) {
     return void 0;
   }
 }
+function hasLoopbackHost(url2) {
+  var _a5;
+  const authority = url2.replace(/^[a-z][a-z0-9+.-]*:\/\//i, "").replace(/^[^@/]+@/, "");
+  const host = authority.startsWith("[") ? authority.slice(1, authority.indexOf("]")) : (_a5 = authority.split(/[:/]/, 1)[0]) != null ? _a5 : "";
+  return /^(localhost|127(\.\d{1,3}){3}|::1)$/i.test(host);
+}
+function remoteGetUrl(cwd, name) {
+  var _a5, _b;
+  const url2 = git(cwd, ["remote", "get-url", name]);
+  if (!url2 || !hasLoopbackHost(url2)) return url2;
+  const configured = (_b = (_a5 = git(cwd, ["config", "--get-all", `remote.${name}.url`])) == null ? void 0 : _a5.split("\n")[0]) == null ? void 0 : _b.trim();
+  return configured || url2;
+}
 function remoteUrl(cwd) {
   var _a5;
-  const origin = git(cwd, ["remote", "get-url", "origin"]);
+  const origin = remoteGetUrl(cwd, "origin");
   if (origin) return origin;
   const names = ((_a5 = git(cwd, ["remote"])) != null ? _a5 : "").split("\n").map((n) => n.trim()).filter(Boolean);
   const name = names.includes("upstream") ? "upstream" : names[0];
-  return name === void 0 ? void 0 : git(cwd, ["remote", "get-url", name]);
+  return name === void 0 ? void 0 : remoteGetUrl(cwd, name);
 }
 function remoteLookupFailed(cwd) {
   try {

package/dist/{chunk-TFJGK4UB.js → chunk-LYESSQUA.js}

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { sanitizeTerminal } from './chunk-BL63NBJZ.js';
-import { remoteLookupFailed } from './chunk-CDISNKM4.js';
+import { sanitizeTerminal } from './chunk-ZEQMTBRD.js';
+import { remoteLookupFailed } from './chunk-LTJPX7TX.js';
 import { DEFAULT_DASHBOARD } from './chunk-USO2DKBD.js';
 import { resolveGatewayCredentials } from './chunk-PLMTLGYH.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
 import { writeRepoConnection, findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
+import { execFileSync } from 'child_process';
 import { createInterface } from 'readline/promises';
 
 createRequire(import.meta.url);
@@ -58,6 +59,20 @@ Then run \`outerlayer connect\` again.
 
 // src/connect-cmd.ts
 var REQUEST_TIMEOUT_MS = 15e3;
+var COMMIT_LINE = "Commit and push .outerlayer/ so the factory reads your policy and skills. No checks run on your pull requests until the policy is on your default branch.";
+function hasUncommittedPolicy(cwd) {
+  try {
+    const status = execFileSync("git", ["status", "--porcelain", "--untracked-files=all", "--", ":/.outerlayer"], {
+      cwd,
+      encoding: "utf8",
+      stdio: "pipe",
+      timeout: REQUEST_TIMEOUT_MS
+    });
+    return status !== "";
+  } catch {
+    return false;
+  }
+}
 var EXIT_NOT_LINKED = 2;
 var REASON_TEXT = {
   flag: "you passed --factory",
@@ -281,7 +296,10 @@ function connectDocument(r) {
   };
 }
 async function runConnectCommand(flags, deps, out) {
-  const r = await runConnect(flags, deps);
+  const base = await runConnect(flags, deps);
+  const r = base.outcome === "done" && hasUncommittedPolicy(deps.cwd) ? { ...base, text: `${base.text}
+${COMMIT_LINE}
+` } : base;
   if (flags.json) {
     out.stdout.write(`${JSON.stringify(connectDocument(r), null, 2)}
 `);
@@ -292,4 +310,4 @@ async function runConnectCommand(flags, deps, out) {
   return r.code;
 }
 
-export { autoConnectedLine, fetchFactories, isLinkedRepository, promptOnTerminal, realConnectDeps, runConnect, runConnectCommand, saveFactoryConnection, selectFactory };
+export { COMMIT_LINE, autoConnectedLine, fetchFactories, isLinkedRepository, promptOnTerminal, realConnectDeps, runConnect, runConnectCommand, saveFactoryConnection, selectFactory };

package/dist/{chunk-7KI224YS.js → chunk-M2PBLRB7.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { MAX_ALLOW_HOSTS, allowHostProblem } from './chunk-UXYLWVTQ.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
-import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-2FWL7CE2.js';
+import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-M6G7TJVF.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { existsSync, statSync, accessSync, constants, readFileSync } from 'fs';
 import { hostname } from 'os';

package/dist/{chunk-2FWL7CE2.js → chunk-M6G7TJVF.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { authorEnvironment, withHooksPath } from './chunk-HKMPVPO7.js';
+import { authorEnvironment, withHooksPath } from './chunk-BYT5O5RV.js';
 import { existsSync, unlinkSync, chmodSync } from 'fs';
 import { request as request$1, createServer } from 'http';
 import { request } from 'https';