@outerlayer/cli 0.1.1 → 0.4.0

package/CHANGELOG.md

@@ -1,5 +1,139 @@
 # @outerlayer/cli
 
+## 0.4.0
+
+### Minor Changes
+
+- 1cffcc2: `outerlayer connect` now checks that the repository is linked to the factory it chose. When it is not, `connect` saves the connection as before, prints the factory's Work page link where the setup panel links a repository, and exits 2. `init` reports its connect step as done with `linked: false` and repeats the link under "Next", and still exits 0. A factory key skips the check. `connect` also takes `--json`, which writes one document with `linked` and, when it is false, `linkUrl`.
+- ecc937a: Add `outerlayer emit criteria <file> [--item <number>]`, which records a work item's acceptance criteria as one list. The list is validated before anything is sent: an empty list, a repeated id or a reserved id is refused. The newest recorded list is what the item's Criteria tab, its count and its status read, and criteria written in an issue body are no longer read. Once an item has a list, only a person can replace it.
+- 6bde8e9: `outerlayer init` now sets up Claude Code in the repository: it installs the starter skills and a new `outerlayer` skill, writes `.outerlayer/config.json` when there is none, runs `outerlayer context emit`, and adds the OuterLayer MCP server to `.mcp.json`. It asks nothing and changes nothing you wrote. It skips this in a repository whose context comes from a control plane, and `--local` skips it too.
+- 69e695a: Adds `builtin:vm`, a third built-in runner backend. On a Linux x86_64 host where the runner's user can use `/dev/kvm`, each build runs in a Firecracker microVM made from the recipe's image. The microVM has no network device. It reaches the runner's tunnel over vsock, and it has the vCPUs, memory and disk that `runner.build` sets.
+
+  The guest kernel and helper are not published yet, and the hashes pinned in the CLI are placeholders. Until they are published, `outerlayer runner init` does not name `builtin:vm` on any host, and `outerlayer doctor` fails `builtin:vm` hooks with that reason. After the first publish, `runner init` names `builtin:vm` on a Linux x86_64 host where the user can use `/dev/kvm`. A host without usable KVM keeps `builtin:container` or `builtin:process`, unchanged. `outerlayer doctor` adds a `KVM` check, which names the group to join, and a `MicroVM memory` check, which warns when `runner.concurrency` times `runner.build.memory` is more than the host's memory.
+
+  The first microVM build downloads Firecracker, a guest kernel and a guest helper from github.com, and checks each against a sha256 pinned in the CLI.
+
+- b678856: A runner now keeps itself at the CLI version its gateway names. When it has no build in flight, it installs that version beside its current one, checks the version's tarball and provenance against this repository's release workflow, and switches to it. If the new version fails its own checks, the runner goes back to the previous version. Turn this off with `runner.autoUpdate: false`. Run `outerlayer runner install` once on an existing host to move it onto the install layout.
+
+### Patch Changes
+
+- 48352ce: The starter `build` skill now records the item's acceptance criteria at intake with `outerlayer emit criteria`. It reads an `## Acceptance criteria` section with ids, or a bullet list under an `Acceptance:` line and adds `AC-<item number>-NN` ids. A list a person already recorded is never replaced. The criteria judge reads the recorded list from the build's state file.
+- 93695bc: `init` ends by saying to commit and push `.outerlayer/` when its agent setup step left files in the repository. The factory reads the policy from the default branch, so no check runs on the repository's pull requests until it is there. The line is left out with `--local`, outside a repository, and under `--json`.
+- d7d56d3: The microVM build disk's copy step can now be supplied by the host that builds the disk. The runner still copies with GNU `cp --sparse=always` by default, so builds on Linux are unchanged.
+- e1a440f: A `builtin:vm` build runs Docker when its recipe asks for it. A recipe asks by listing the `ghcr.io/devcontainers/features/docker-in-docker` feature, at any tag or digest. The microVM then starts its own Docker daemon, and the agent user can run `docker` before the clone starts. Image pulls go through the runner's tunnel like the rest of the build's traffic. Containers the build starts have no route out. If the daemon does not answer within 60 seconds, provisioning fails and names the daemon. Its reason includes the end of the daemon's log. A recipe that does not list the feature runs no daemon. The build's recorded recipe report says whether Docker was asked for.
+
+## 0.3.0
+
+### Minor Changes
+
+- 9b8ebd0: Adds `outerlayer work open-pr --title <text> --body-file <path>`. A host build sends it to the gateway, which opens or edits the item's pull request as the factory's GitHub App. A person's own session runs `gh` under their login and declares the pull request on the item.
+
+  The runner now speaks protocol 4. A claim names the branch the build works on, and the runner checks that branch out in the provisioned workdir before the command starts. It also sets `OUTERLAYER_BRANCH` for every hook and the command. A container build gets `OUTERLAYER_BRANCH` but not the checkout, so it checks the branch out itself. The runner skips a claim the gateway refuses, such as a pull request from a fork, and logs the refusal code. A gateway from this release refuses a runner below protocol 4 with `runner_upgrade_required`, so upgrade runners to this version.
+
+- e377274: `outerlayer login` signs in to your account through the browser: it opens a page where you approve the CLI, then saves a token for your account. It chooses no organization or factory, so commands that need a factory tell you to run `outerlayer connect`. `outerlayer logout` revokes the token and removes it. A factory key, from a flag, `OUTERLAYER_API_KEY` or the config file, always wins over the login, so CI and runners keep acting as their key. Use `--no-browser` to print the link instead, `--no-input` to skip waiting on a person, and `--check` to finish a login that was still waiting.
+- 39f75bc: Adds `outerlayer connect`, which chooses the factory a repository's work goes to. It picks by itself when only one answer is possible, says what it picked and why, and saves the choice in the repository's git directory, shared by every worktree and never committed. With no terminal it exits 1 and lists the `--factory <org>/<factory>` values to pass.
+
+  `outerlayer init` now connects the repository, installs the hooks and runs `doctor`. It never signs in: with no login it skips the connect step and says to run `outerlayer login`. `init --local` is the old behavior, with no connect step and no network call. `init --json` prints one document naming the outcome of each step.
+
+  A login now takes its factory from the repository it runs in, not from `appId` in the config file. `--app-id` and `OUTERLAYER_APP_ID` still win. A factory key is unchanged. Run `outerlayer connect` once in each repository that used a login's saved factory.
+
+- 91c2778: A container build of a governed repository now starts with its control plane's context in the checkout: `AGENTS.md`, skills and validators, at the control plane's current head. The runner reads the control plane on the host with the host's own git login, and the build receives files, never a credential. A host whose git login cannot read the control plane fails the build at provision with `context_unavailable`, and `outerlayer doctor` checks this on a container host.
+
+  The runner now speaks protocol 9, because it asks the gateway which repository governs a build's repository. A gateway from this release still accepts a runner at protocol 8.
+
+- 3294997: `outerlayer doctor` now asks the gateway three questions. Does the saved credential work? Can it use the factory chosen for this repository? Is the repository linked to that factory? A login and a factory key are each checked the way a command would use them, and a factory key wins over a login. With no credential, the three checks are skipped and doctor makes no network call. The GitHub App check runs only when the credential check passes. Fix hints no longer name `--api-key`, `--root` or `npx @outerlayer/cli`.
+- 89a20a5: `outerlayer doctor` adds one check per repository connected to your factory, once `outerlayer login` has saved a factory key. It warns when the GitHub App installation has not accepted a permission builds need, naming each one and the installation's settings page, and when the default branch does not require a pull request. It reads `GET /v1/repositories/access` and changes nothing.
+- b0519e1: `outerlayer emit finding` now records a problem you hit in the factory. It takes `--category` (`context`, `flaky-test`, `tooling`, `environment`, `defect` or `other`) and drops `--subject`, `--kind`, `--severity`, `--verdict`, `--fixed` and `--source`; each removed flag is refused by name. A `context` finding names the instruction with `--rule-path` and `--rule-relation` (`wrong`, `broken` or `missing`), and quotes it with `--rule-quote` unless the relation is `missing`.
+
+  `outerlayer emit findings <file>` takes `"schemaVersion": 2` files. A `schemaVersion: 1` file is refused. The gateway refuses a `schemaVersion: 1` batch with a message to upgrade the CLI.
+
+  `outerlayer init --template default` and `outerlayer context emit` install a new maintained `reporting-findings` skill that tells agents when to record a finding.
+
+- 6bddf79: Uploads now carry the session's token counts so far, split per model, speed and input size, so the gateway can price the whole session itself. Each turn's usage also names its 5-minute cache writes and the request's speed. The gateway stores its own price and keeps the cost the CLI worked out only for a turn it has no price for.
+
+  The CLI's local cost estimate now prices a turn as unknown when the model has no rate for a token class the turn used, such as cache reads. It used to price that class at zero, so the status line showed a lower cost than the true one.
+
+- e3f8d26: The runner sends a heartbeat at the end of every poll — its CLI version, poll interval, slots in use and total, and the result of that poll's own request for work. A key without the new `hosts.ingest` permission still polls and claims normally; the heartbeat is refused, logged once, then every tenth poll while it continues, and the host stays off `GET /v1/hosts` until the key is edited to add it.
+- 9de5518: A build the runner starts now holds an item key, not the runner's own key. The claim response carries the key, and the runner passes it as `OUTERLAYER_API_KEY` to the hooks, the command, the sync step and the cleanup hook. It acts only on the claimed item, and only while the claim is live. The runner keeps its own key for renewing and releasing the claim and for heartbeats, and it runs the final sync under the item key before it releases. The runner protocol is now 2, so a gateway that predates the item key does not return one. The runner then releases the claim without starting the build and says so in its log.
+- ea3130e: `outerlayer runner image --repository <owner/name>` builds the image a repository's builds run in, from the devcontainer file on its default branch. It ignores every setting that reaches the host or widens the container's privileges, and lists each one it ignored. It adds this CLI and a pinned Claude Code to the image, reuses the image until the recipe or the tools change, and keeps the newest three. `outerlayer doctor` on a runner host now checks each fetched repository's recipe, the devcontainer CLI, and whether the pinned Claude Code version is behind. The CLI now depends on `@devcontainers/cli`.
+- 1834f72: A build's commits are now authored by the GitHub App's bot account, and credit the member who asked for the build. The claim response carries `commitAuthor` and, when the requester signed in with GitHub, `coAuthor`. The runner sets `GIT_AUTHOR_NAME`, `GIT_AUTHOR_EMAIL`, `GIT_COMMITTER_NAME` and `GIT_COMMITTER_EMAIL` for every process an attempt starts, so a host's own git identity no longer authors a commit.
+
+  For a co-author, the runner writes a hooks directory into the build's directory and points git at it through `GIT_CONFIG_COUNT`, after any entries the host already passes. Each hook runs the repository's own hook of the same name with the same arguments, input and exit status. `prepare-commit-msg` then adds one `Co-authored-by` line. A build run through an `exec` gets the bot as author and no co-author line.
+
+  The release records `environment.commitIdentity`. The runner now speaks protocol 8. A gateway that predates the field refuses a release that names it, and the runner sends the release again without it.
+
+- c2032f3: A runner whose provision and cleanup hooks are `builtin:container` now runs each build in its own hardened container: no network but loopback, no Linux capabilities, a read-only root filesystem and one volume. The build reaches public addresses only through a tunnel the runner serves, which refuses private, link-local, shared-address and the host's own addresses and records every host the build reached. The runner config gains a `build` block (`memory`, `cpus`, `pids`, `disk`, `variables`), the image's tools layer gains an unprivileged user, `gh` and `tini`, and every release now carries an `environment` object recording what the attempt ran in. The runner protocol is now 2.
+- ca1cc05: A container build no longer holds a credential that can write to its repository. The runner serves the build a local git remote and holds the repository tokens itself. It asks the gateway for a read token before it provisions anything, and for a push token on the build's first push. It renews each token within ten minutes of expiry and revokes every one when the attempt ends. The build's `gh` holds only the read token.
+
+  The runner forwards a push only when every ref it updates is the branch the claim names. On a branch outside `outerlayer/`, it forwards only creating the branch or a fast-forward. `GH_TOKEN`, `GITHUB_TOKEN`, `GH_ENTERPRISE_TOKEN` and `GITHUB_ENTERPRISE_TOKEN` in `runner.build.variables` are no longer passed into a build. The runner logs each name it skips.
+
+  A container build now needs a gateway with a GitHub App configured. Without one, every claim ends as `failed` at provision with the reason `repository_tokens_unavailable`. The release records which kinds of token the build used as `environment.credentials`.
+
+  The runner now speaks protocol 6, because the release carries `credentials` and the runner calls the token route. A gateway that has not been upgraded refuses a release that names `credentials`, so upgrade the gateway first.
+
+- 3a32b01: A build the runner provisions with `builtin:container` or `builtin:process` no longer holds the item key or Claude's credential. The runner serves two built-in destinations, `gateway` and `claude`. The build's `OUTERLAYER_URL` and `ANTHROPIC_BASE_URL` point at local addresses, and its `OUTERLAYER_API_KEY` and Claude credential variable hold placeholders. The runner sets the item key and the host's credential on each request it forwards.
+
+  The runner reads `CLAUDE_CODE_OAUTH_TOKEN`, or else `ANTHROPIC_API_KEY`, from its own environment. A host that sets neither now ends each attempt as `failed` at `provision` with the reason `agent_credential_missing`, so set one before upgrading. Remove `CLAUDE_CODE_OAUTH_TOKEN` from `runner.build.variables`: a name there now gets a placeholder. A host may list at most 18 destinations, down from 20, and may not name one `gateway` or `claude`.
+
+- e07a51f: A host's own hooks can now report how their builds are isolated, and `outerlayer runner init` names the hooks that fit the machine. A provision hook can write `isolation`, `exec`, `broker` and `recipe` to `provision.out`. It receives the build's directory, the repository, the recipe commit and the four limits. The new `builtin:process` hooks run builds as processes on machines that cannot isolate them, through the same tunnel, and record `shared-user`. `runner init` names `builtin:container` on Linux or WSL2 with Docker Engine 26 or later, and `builtin:process` elsewhere, and no longer writes hook scripts. `outerlayer doctor` says what a host's builds get. A host can list credentialed services in `runner.build.destinations`. The runner forwards a build's requests to them over HTTPS with the host's header in place of any credential the build sent, so the secret never enters the build, and the release names the destinations a build called. The runner protocol is 4.
+- ad6979c: `outerlayer runner check` now exits 1, before the host takes work, when an enabled queue's command is still the placeholder `runner init` wrote, when built-in hooks find neither `CLAUDE_CODE_OAUTH_TOKEN` nor `ANTHROPIC_API_KEY` set, and when the key lacks `work.claim`. Each message names the queue, `claude setup-token` or the permission.
+
+  On a runner host, `outerlayer doctor` lists the laptop checks as skipped with one line that says why, adds a `Claude credential` check that names the variable and never its value, and names a missing permission instead of calling the key revoked or expired. Its GitHub App hint says whether the App's own settings must add a permission or an installation owner must accept it.
+
+  A container build fetches the image recipe of a private repository with the claim's read token, so the host needs no git login. `outerlayer runner image` exits 1 with one line naming the repository when its fetch fails. `outerlayer work build` warns when the gateway says the request cannot earn repository tokens.
+
+- b2a18b7: `outerlayer runner init` no longer chooses builds without isolation for you. On a machine that cannot isolate a build, it refuses and says what isolation needs; pass `--allow-process-builds` to run builds as processes under your user instead. On a Mac with no terminal to ask, it refuses and names `--vm`. A host can now list the public hosts its builds may reach in `runner.build.allowHosts`: the tunnel refuses every other name before resolving it, and records the refusal with the range `not-allowed`.
+- 3019459: A runner key now works only from the host that first used it, and the runner signs every request it makes. The runner makes an Ed25519 host key in `~/.outerlayer/runner/host-key.pem` the first time it starts. Its first claim binds the key's public half to the runner key. After that the gateway refuses any request made with that runner key unless the host key signed it.
+
+  The runner speaks protocol 7, and a gateway from this release refuses a runner below it with `runner_upgrade_required`, so upgrade every runner. To move a runner key to a new host, a member clears its binding on the factory's API keys page, and the new host's next claim binds its own key.
+
+  `outerlayer doctor` says whether the runner key is bound to this host, bound to another, or not yet bound. A refused signature is reported with its cause: a stale one names the host's clock. `outerlayer runner init` prints the host key's fingerprint.
+
+- 85fa250: On macOS, `outerlayer runner init` now offers to create a Linux VM with Lima and run the runner inside it, so builds run in containers and record `container`. `--vm` answers yes and `--no-vm` answers no; a run with no terminal answers no. The VM holds the runner key and the host key, and starts at login through a launch agent and a systemd service. The Mac's config loses `apiKey` and `runner` and gains a `runnerVm` note.
+
+  `outerlayer doctor` on a Mac with process hooks now says builds are not isolated and names `outerlayer runner init --vm`. With the runner in a VM, it reports the VM's state and how to start it.
+
+- 365dab4: The runner and `outerlayer work claim` now send the runner protocol they were built with, as `runnerProtocol`, on every claim, and the runner sends it on every heartbeat. A gateway that needs a newer protocol refuses the claim with `426 runner_upgrade_required`. The runner then logs the minimum protocol and a link to the upgrade steps, and keeps polling so it takes work again once it is upgraded and restarted.
+- 02f7990: `outerlayer init --template default` installs a starter skill pack into `.outerlayer/skills/`. The templates `spec`, `writing-specs` and `build` are copied once and never overwritten. The maintained skills `emitting-evidence` and `amend` are rewritten from the installed CLI on every `outerlayer context emit`, and each carries the CLI version on its first line. `init --template default` also writes a starter `.outerlayer/policy.yaml` unless one exists.
+
+  `outerlayer context emit --check` now reports drift, and exits 1, when a maintained skill differs from the installed CLI's copy, for example after a CLI upgrade. `outerlayer import capture` rewrites both maintained skills instead of refusing to overwrite a skill with local edits.
+
+- 1177caa: `outerlayer work build` takes a Linear or Jira issue key, not only a GitHub issue number: `outerlayer work build --issue ENG-123 --tracker linear`. `--tracker` names which tracker a keyed issue belongs to, required only when a factory has connected more than one. `--repo` is the only way to attach a repository to a keyed issue. A new `--retry <count>` option sends a build request again, up to 4 more times, after any 5xx or 429 answer, including a 5xx from a proxy in front of the gateway. A retry after such an answer can record the request twice. It never resends after a network error or a 4xx other than 429.
+- 852946a: Add `outerlayer work build`, which asks a host to build a work item. `outerlayer work add` alone no longer queues an item for a host. A session launched with `OUTERLAYER_WORK` now holds a 20-minute lease on its item, renewed by a new `PostToolUse` hook and released when the session ends; run `outerlayer init` to add the hook to an existing install.
+- b52a19e: `outerlayer work build` is the one command that starts work on an item. `work build --issue <n>` asks a host to build it. `work build --issue <n> --local` puts it on Work for you to build, and prints the `OUTERLAYER_WORK=<n> claude` line that starts your session on it. `outerlayer work add` is removed; use `work build --local` where you used it.
+- cfddc47: Adds `outerlayer work comment` and `outerlayer work threads`. A work item's review, and each acceptance criterion's own proof, live on comment threads now: a person's pass or fail, an agent's attach or ready. `outerlayer emit`'s per-artifact verdict option is removed — record it as a comment instead.
+
+### Patch Changes
+
+- 9787d1c: The runner now sends the step an attempt ended in, its exit code, and a one-line reason from `$OUTERLAYER_JOB_DIR/reason` when it releases a work item claim. The reason comes only from a file the host's own cleanup hook writes, scrubbed and cut to 200 characters before it leaves the machine.
+- 22ce869: The status line now keeps the session cost Claude Code reports, and `sync` and the daemon send it with each Claude Code session as `totals.agentReportedCostUsd`. The daily pricing check compares it with the cost the gateway stored.
+- ac57469: Every command on a runner host signs its requests with the host key when it uses the saved runner key. `outerlayer doctor`, `work status`, `sync`, `emit` and the other commands no longer fail with `runner_key_signature_required` once the runner key is bound to the host.
+- 1ba39dc: A container build now starts on the branch its claim names, by the rule a host build uses, before its lifecycle commands run. The checkout is a partial clone that keeps every commit, so a merged `outerlayer/` branch starts from the default branch's head. The build image also writes Claude Code managed settings that run `outerlayer hook`, so the sessions a build starts are linked to the item and uploaded by its sync. The runner copies the build's hook error log into the job directory before it removes the container.
+- 4677cd6: A container or process build can run `yarn install`. The runner now also sets `YARN_HTTPS_PROXY` and `YARN_HTTP_PROXY`, because Yarn 2 and later ignore `HTTPS_PROXY` and could not reach the registry from a build.
+- 1e2f5e3: `outerlayer doctor` checks that a container host can read the control plane of every repository the runner builds. With no `repos.include`, which is how `runner init` leaves the config, it checks every repository connected to the factory instead of nothing.
+- e4f5e1e: `outerlayer sync` no longer writes `~/.outerlayer/spool/session-repos.json`. Nothing reads that file, so it is safe to delete.
+- 0248261: Hooks written by `outerlayer init` run the CLI through `node`, so they keep working when a copy of the CLI loses its execute bit. Run `outerlayer init` again to rewrite hooks written by an earlier version. `outerlayer doctor` now fails "Hooks installed" when a hook runs the CLI script directly and the script is not executable.
+- f90e444: Help and error text use the product's own words. Every `--app-id` option is described as the factory id, no text calls the Work page "Floor", and a key bound to another factory is refused with "bound to a different factory". The package description names only commands the CLI has.
+- e78d9a9: The cost estimate charges 1-hour cache writes at the model's published 1-hour rate. It also charges a request whose total input exceeds a model's long-request threshold at the higher rates for every token, and charges fast mode at its multiplier for models that have one, such as Opus 5.5.
+- 0db0425: The provision hook written by `outerlayer runner init` clones the repository the work item records (`specRepository` in `outerlayer work status --json`) instead of reading it off the tracker key. A Linear or Jira item, whose key such as `ENG-123` names no repository, now clones the right one. An item that records no repository fails its job with one line saying so, rather than trying to clone a URL that does not exist. `runner init` never overwrites a hook, so delete an existing `provision.sh` written by an earlier version before running it again, or make the same edit by hand.
+- 112813e: No change in behavior. The committed `.outerlayer-pin.json` is still written and read the same way; the server no longer compares sessions against it.
+- 02db30e: The `reporting-findings` skill that `outerlayer init` installs now describes the moments it applies to: writing a "Factory problems" section, a build or review report, or noticing a stale instruction, a flaky test or a misbehaving gate. Its batch shape is spelled out so `outerlayer emit findings` files can be written from the skill alone.
+- 4c5a9ea: `outerlayer emit <name>` from inside a recorded session can now record checks on the work item the session was launched for, stored as the session's own. A session still cannot clear a person's fail. The help text and README say so.
+- 7720377: `outerlayer sync` no longer guesses a price for a model name it doesn't recognize exactly, case-insensitively, or as a listed variant (a provider prefix, a region prefix, a date suffix, a `-vN:M` suffix, or a `[1m]` suffix). A name like `claude-opus-4-9` now shows the existing unknown-model warning and stores an unpriced cost, instead of silently pricing as `claude-opus-4` — a different model, at a different rate.
+- 07c2785: `outerlayer work comment` now says that a person's `fail` on the item's general thread is what hands the item to an agent, and that a plain comment or a criterion `fail` no longer does. The README describes the item page in place of the removed Review tab.
+- d15ccf4: `outerlayer work comment` and `outerlayer work threads` print a failed request as a one-line error and exit 1, as the other `work` commands do, instead of a stack trace.
+- dec3f5b: `outerlayer work list --claimed` lists only the work items a host holds right now. Each claimed row shows which host holds it, as which kind of claim, since when and until when. With `--json`, each row carries its `claim` object.
+
+## 0.2.0
+
+### Minor Changes
+
+- 4757f83: Remove `outerlayer emit commit-credit` and the commit journal hooks. `init` no longer installs the `post-rewrite`, `post-commit` and `prepare-commit-msg` hooks, commits no longer get an `OuterLayer-Session` trailer, and sync no longer recovers commits from the reflog. `init`, `hooks install-git` and `sync` remove the copies of those hooks an earlier version installed, and leave hooks you wrote alone. The `gitHooks` setting in `~/.outerlayer/config.json` is ignored.
+
+### Patch Changes
+
+- 1251e83: Permissions are named over product nouns. A CLI login key now holds the `agent` preset (`sessions.ingest`, `sessions.read`, `evidence.insert`, `work.read`, `work.insert`, `git.read`, `context.read`), and the documented key presets are `agent`, `runner`, `reader` and `custom`.
+
 ## 0.1.1
 
 ### Patch Changes