@outerlayer/cli 0.1.1 → 0.4.0

package/dist/{cli-EFJIG2VT.js → cli-NHUXABYH.js}

@@ -1,23 +1,35 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { pinExists, readPin, readContextManifest, readDegraded, readSourceCache } from './chunk-A3WLZX2F.js';
-import './chunk-KFYJV2ZG.js';
-import { readStatuslineState, STATE_FRESH_MS } from './chunk-NTTPJV35.js';
-import { compareVersions, SUPPORTED_VERSIONS, readSessionRepos } from './chunk-BQB3U2VD.js';
+import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-NYC54VBD.js';
+import './chunk-3TT7RQYB.js';
+import './chunk-F47JBIAW.js';
+import './chunk-BKO6JEZI.js';
+import './chunk-5DLBAXY5.js';
+import './chunk-BFESLKPP.js';
+import './chunk-6Y63SXFO.js';
+import './chunk-G7FSV7JX.js';
+import './chunk-USO2DKBD.js';
+import './chunk-N6LURUEF.js';
 import { C, NO_COLOR_FLAG, warnDeprecated, stripNoColor, API_KEY_FLAG_DEPRECATION } from './chunk-YRYMNBGQ.js';
-import { parseTrackerNumber, trackerNumberError } from './chunk-RCQXYLMO.js';
-import './chunk-ZJSNLVCE.js';
-import { hookFiredMarkerPath, installedCliDistDir, sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, refreshCommand } from './chunk-3VQ4XXQA.js';
-import { managedHookScripts, installPostRewriteHook, installPreCommitGuardHook, removePostRewriteHook, removePreCommitGuardHook, deadHooksState, preparePackageManagerCommand, contextExcludesPresent, postRewriteHookPresence } from './chunk-IWIUYLDR.js';
-import './chunk-YOOSBOKS.js';
-import { SettingsParseError, settingsPath, readSettings, listHookCandidates, wrapHooks, writeSettings, unwrapHooks, REGISTERED_EVENTS, removeHooks, removeStatusline, cliBinResolvable, mergeHooks, repointWrappedHooks, AUTO_WRAP_EVENTS, mergeStatusline, isOurStatuslineSlot, statuslineWrappedOriginal, isOurHookCommand, ourCommandBins, wrappedOriginalCommand } from './chunk-R5KBGVII.js';
-import { readCloudConfig } from './chunk-TFUIDMOB.js';
+import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
+import { settingsPath, readSettings, SettingsParseError, listHookCandidates, wrapHooks, writeSettings, unwrapHooks, REGISTERED_EVENTS, cliCommand, removeHooks, removeStatusline, cliBinResolvable, mergeHooks, repointWrappedHooks, AUTO_WRAP_EVENTS, mergeStatusline } from './chunk-5QRP3MVS.js';
+import { pinExists } from './chunk-WIOZAJ2W.js';
+import './chunk-EMY4I27X.js';
+import './chunk-BCLJSQCV.js';
+import './chunk-BOLTI6LR.js';
+import './chunk-EABW6AJQ.js';
+import { resolveVersion } from './chunk-RA3O54FC.js';
+import './chunk-M5POMKKW.js';
+import './chunk-ZM2IMMYN.js';
+import { hookFiredMarkerPath, installedCliDistDir } from './chunk-UFFXNXLQ.js';
+import { managedHookScripts, removeJournalHooks, installPreCommitGuardHook, removePreCommitGuardHook } from './chunk-XCCLFVXM.js';
+import './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import './chunk-Z5GEFMRW.js';
 import { EventEmitter } from 'events';
 import childProcess, { execFileSync } from 'child_process';
-import path, { dirname, join, isAbsolute } from 'path';
-import fs, { existsSync, unlinkSync, readFileSync, mkdirSync, cpSync, readdirSync, renameSync, statSync, rmSync, writeFileSync, accessSync, constants, realpathSync } from 'fs';
+import path, { isAbsolute, dirname, join } from 'path';
+import fs, { existsSync, unlinkSync, mkdirSync, cpSync, readdirSync, renameSync, statSync, rmSync, readFileSync, writeFileSync, realpathSync } from 'fs';
 import process2 from 'process';
 import { stripVTControlCharacters } from 'util';
 import { fileURLToPath } from 'url';
@@ -3396,6 +3408,19 @@ function samePath(a, b) {
     return false;
   }
 }
+function sameContent(a, b) {
+  try {
+    const sa = statSync(a);
+    const sb = statSync(b);
+    if (sa.isDirectory() !== sb.isDirectory()) return false;
+    if (!sa.isDirectory()) return sa.size === sb.size && readFileSync(a).equals(readFileSync(b));
+    const na = readdirSync(a).sort();
+    const nb = readdirSync(b).sort();
+    return na.length === nb.length && na.every((n, i) => n === nb[i] && sameContent(join(a, n), join(b, n)));
+  } catch {
+    return false;
+  }
+}
 function installCliCopy(opts) {
   const rename = opts.rename ?? renameSync;
   const now = opts.now ?? Date.now;
@@ -3410,12 +3435,28 @@ function installCliCopy(opts) {
     cpSync(sourceDist, join(staged, "dist"), { recursive: true });
     const sourcePkg = join(dirname(sourceDist), "package.json");
     if (existsSync(sourcePkg)) cpSync(sourcePkg, join(staged, "package.json"));
+    const sourcePack = join(dirname(sourceDist), "skill-pack");
+    if (existsSync(sourcePack)) cpSync(sourcePack, join(staged, "skill-pack"), { recursive: true });
     const incoming = readdirSync(join(staged, "dist"));
     for (const name of incoming) {
-      if (name !== "index.js") rename(join(staged, "dist", name), join(targetDist, name));
+      if (name !== "index.js" && !sameContent(join(staged, "dist", name), join(targetDist, name))) {
+        rename(join(staged, "dist", name), join(targetDist, name));
+      }
     }
-    if (existsSync(join(staged, "package.json"))) rename(join(staged, "package.json"), join(targetRoot, "package.json"));
-    rename(join(staged, "dist", "index.js"), bin);
+    if (existsSync(join(staged, "package.json")) && !sameContent(join(staged, "package.json"), join(targetRoot, "package.json"))) rename(join(staged, "package.json"), join(targetRoot, "package.json"));
+    if (existsSync(join(staged, "skill-pack")) && !sameContent(join(staged, "skill-pack"), join(targetRoot, "skill-pack"))) {
+      const livePack = join(targetRoot, "skill-pack");
+      const asidePack = join(staged, "previous-skill-pack");
+      const hadPack = existsSync(livePack);
+      if (hadPack) rename(livePack, asidePack);
+      try {
+        rename(join(staged, "skill-pack"), livePack);
+      } catch (err) {
+        if (hadPack) rename(asidePack, livePack);
+        throw err;
+      }
+    }
+    if (!sameContent(join(staged, "dist", "index.js"), bin)) rename(join(staged, "dist", "index.js"), bin);
     const shipped = new Set(incoming);
     for (const name of readdirSync(targetDist)) {
       const path2 = join(targetDist, name);
@@ -3426,96 +3467,6 @@ function installCliCopy(opts) {
   }
   return { bin, copied: true };
 }
-function manifestPath(home = homeFromEnv()) {
-  return join(home, ".outerlayer", "hooks-manifest.json");
-}
-function readManifestFile(home) {
-  try {
-    const parsed = JSON.parse(readFileSync(manifestPath(home), "utf8"));
-    if (parsed?.version !== 1) {
-      return { manifest: null, newerVersion: typeof parsed?.version === "number" && parsed.version > 1 };
-    }
-    return {
-      manifest: {
-        version: 1,
-        installs: parsed.installs ?? {},
-        wrapped: parsed.wrapped ?? {},
-        statusline: parsed.statusline ?? {}
-      },
-      newerVersion: false
-    };
-  } catch {
-    return { manifest: null, newerVersion: false };
-  }
-}
-function readManifest(home = homeFromEnv()) {
-  return readManifestFile(home).manifest;
-}
-function writeManifest(home, manifest) {
-  const path2 = manifestPath(home);
-  try {
-    mkdirSync(dirname(path2), { recursive: true });
-    const tmp = `${path2}.tmp`;
-    writeFileSync(tmp, JSON.stringify(manifest, null, 2) + "\n", { mode: 384 });
-    renameSync(tmp, path2);
-  } catch {
-  }
-}
-function emptyManifest() {
-  return { version: 1, installs: {}, wrapped: {}, statusline: {} };
-}
-function updateManifest(home, opts, mutate) {
-  const { manifest, newerVersion } = readManifestFile(home);
-  if (newerVersion) return;
-  if (!manifest && !opts.createIfMissing) return;
-  const next = manifest ?? emptyManifest();
-  mutate(next);
-  writeManifest(home, next);
-}
-function recordInstall(home, settingsPath2, record, now = Date.now) {
-  updateManifest(home, { createIfMissing: true }, (manifest) => {
-    manifest.installs[settingsPath2] = {
-      cliBin: record.cliBin,
-      events: [...record.events],
-      updatedAt: new Date(now()).toISOString()
-    };
-  });
-}
-function recordRemoval(home, settingsPath2) {
-  updateManifest(home, { createIfMissing: false }, (manifest) => {
-    delete manifest.installs[settingsPath2];
-    delete manifest.wrapped[settingsPath2];
-    delete manifest.statusline[settingsPath2];
-  });
-}
-function recordWrapped(home, settingsPath2, wrapped, now = Date.now) {
-  if (wrapped.length === 0) return;
-  updateManifest(home, { createIfMissing: true }, (manifest) => {
-    const existing = manifest.wrapped[settingsPath2] ?? [];
-    const at = new Date(now()).toISOString();
-    for (const w of wrapped) {
-      if (existing.some((e) => e.event === w.event && e.original === w.original)) continue;
-      existing.push({ event: w.event, original: w.original, updatedAt: at });
-    }
-    manifest.wrapped[settingsPath2] = existing;
-  });
-}
-function recordUnwrapped(home, settingsPath2) {
-  updateManifest(home, { createIfMissing: false }, (manifest) => {
-    delete manifest.wrapped[settingsPath2];
-  });
-}
-function recordStatusline(home, settingsPath2, outcome, original, now = Date.now) {
-  updateManifest(home, { createIfMissing: true }, (manifest) => {
-    manifest.statusline[settingsPath2] = {
-      outcome,
-      ...original !== void 0 ? { original } : {},
-      updatedAt: new Date(now()).toISOString()
-    };
-  });
-}
-
-// src/init.ts
 function runInit(opts) {
   const scope = opts.scope ?? "user";
   const path2 = settingsPath(scope, { home: opts.home, cwd: opts.cwd });
@@ -3527,7 +3478,7 @@ function runInit(opts) {
     const statuslineRemoved = removeStatusline(hooksUnwrapped.next, opts.cliBin);
     const changed2 = hooksRemoved.changed || hooksUnwrapped.changed || statuslineRemoved.changed;
     const backupPath2 = changed2 ? writeSettings(path2, statuslineRemoved.next) : void 0;
-    const gitHookRemoval = removePostRewriteHook(opts.cwd ?? process.cwd());
+    const gitHookRemoval2 = removeJournalHooks(opts.cwd ?? process.cwd());
     const guardHookRemoval = removePreCommitGuardHook(opts.cwd ?? process.cwd());
     recordRemoval(manifestHome, path2);
     const remaining = readManifest(manifestHome);
@@ -3545,7 +3496,7 @@ function runInit(opts) {
       backupPath: backupPath2,
       events: REGISTERED_EVENTS,
       removed: true,
-      gitHookRemoved: gitHookRemoval.removed,
+      gitHookRemoved: gitHookRemoval2.removed,
       guardHookRemoved: guardHookRemoval.removed,
       wrapped: [],
       unwrappedCount: hooksUnwrapped.unwrapped,
@@ -3585,9 +3536,7 @@ function runInit(opts) {
   if (statusline && statusline !== "skipped") {
     recordStatusline(manifestHome, path2, statuslineWrappedCommand !== void 0 ? "wrapped" : "installed", statuslineWrappedCommand);
   }
-  const gitHook = installPostRewriteHook(opts.cwd ?? process.cwd(), {
-    stampTrailers: readCloudConfig().gitHooks?.stampTrailers !== false
-  });
+  const gitHookRemoval = removeJournalHooks(opts.cwd ?? process.cwd());
   const guardHook = installPreCommitGuardHook(opts.cwd ?? process.cwd());
   let gitignoreUpdated = false;
   if (scope === "project" && opts.addGitignore) {
@@ -3599,7 +3548,7 @@ function runInit(opts) {
     backupPath,
     events: REGISTERED_EVENTS,
     gitignoreUpdated,
-    gitHook,
+    ...gitHookRemoval.removed ? { gitHookRemoved: true } : {},
     guardHook,
     wrapped,
     ...statusline ? { statusline } : {},
@@ -3637,7 +3586,7 @@ function ensureGitignore(cwd) {
 function orgRolloutSnippet(cliBin) {
   const hooks = {};
   for (const event of REGISTERED_EVENTS) {
-    hooks[event] = [{ hooks: [{ type: "command", command: `${cliBin} hook ${event}` }] }];
+    hooks[event] = [{ hooks: [{ type: "command", command: `${cliCommand(cliBin)} hook ${event}` }] }];
   }
   const managed = JSON.stringify({ hooks }, null, 2);
   return [
@@ -3657,617 +3606,6 @@ function orgRolloutSnippet(cliBin) {
     "Each developer still runs `outerlayer login` once to attribute sessions."
   ].join("\n");
 }
-function runDoctor(env = {}) {
-  const home = env.home ?? homeFromEnv();
-  const now = env.now ?? Date.now;
-  const transcripts = scanTranscripts(home);
-  return [
-    checkClaudeDir(home),
-    checkTranscripts(transcripts, now),
-    ...checkHooks(home, env.cwd, transcripts, now),
-    ...checkDeadHooksState(env.cwd),
-    checkSpoolWritable(home),
-    checkLastSync(home, now),
-    checkDaemon(home),
-    checkCleanupPeriod(home),
-    checkDiskHeadroom(home),
-    checkClaudeVersion(env),
-    checkSettingsValid(home, env.cwd),
-    ...checkStatusline(home, now, env.cwd),
-    ...checkInstalls(env),
-    ...checkContextSource(home, env.cwd),
-    ...checkInstalledCli(home, env.cwd ?? process.cwd())
-  ];
-}
-function checkInstalledCli(home, cwd) {
-  const name = "Installed CLI";
-  const result = checkInstalledCliStaleness({ home, cwd });
-  if (result === null) return [];
-  const installedLabel = result.installedId !== null ? sanitizeForContext(result.installedId) : "unknown";
-  const workspaceLabel = result.workspaceId !== null ? sanitizeForContext(result.workspaceId) : null;
-  const at = result.workspaceDistDir !== null ? ` at ${sanitizeForContext(workspaceRootOf(result.workspaceDistDir))}` : "";
-  if (result.stale) {
-    return [
-      {
-        name,
-        status: "warn",
-        detail: `installed copy (${installedLabel}) is behind the workspace build${at} (${workspaceLabel})`,
-        fix: installedCliFix(result.workspaceDistDir, result.workspaceRootTrusted)
-      }
-    ];
-  }
-  if (workspaceLabel === null) {
-    const detail = result.ambiguousWorkspace ? `installed (${installedLabel}) \u2014 more than one candidate workspace build found nearby; refusing to guess which one to compare against` : `installed (${installedLabel}) \u2014 no workspace build to compare (comparison needs a nearby checkout with a stamped build)`;
-    return [{ name, status: "pass", detail }];
-  }
-  if (result.unorderable) {
-    return [
-      {
-        name,
-        status: "pass",
-        detail: `installed (${installedLabel}) differs from the workspace build${at} (${workspaceLabel}) \u2014 build order could not be established`
-      }
-    ];
-  }
-  if (result.installedAhead) {
-    return [{ name, status: "pass", detail: `installed (${installedLabel}) is ahead of the workspace build${at} (${workspaceLabel})` }];
-  }
-  if (result.installedId !== result.workspaceId) {
-    return [{ name, status: "pass", detail: `installed (${installedLabel}) differs from the workspace build${at} (${workspaceLabel})` }];
-  }
-  return [{ name, status: "pass", detail: `matches the workspace build${at} (${installedLabel})` }];
-}
-function installedCliFix(workspaceDistDir, trusted) {
-  const command = refreshCommand(workspaceDistDir, trusted);
-  if (command) return `Refresh it: ${command}`;
-  const root = sanitizeForContext(workspaceRootOf(workspaceDistDir));
-  return `Workspace build found at ${root}. Rebuild it (yarn workspace @outerlayer/cli build) and copy packages/cli/dist to ~/.outerlayer/cli/dist to refresh the installed copy.`;
-}
-function checkStatusline(home, now, cwd) {
-  const name = "Status line";
-  let installed = false;
-  let wrapping;
-  let foreign;
-  for (const scope of ["user", "project"]) {
-    let settings;
-    try {
-      settings = readSettings(settingsPath(scope, { home, cwd }));
-    } catch {
-      continue;
-    }
-    const slot = settings?.statusLine;
-    if (!slot || typeof slot !== "object") continue;
-    if (isOurStatuslineSlot(slot)) {
-      installed = true;
-      const original = statuslineWrappedOriginal(slot);
-      if (original !== null) wrapping = original;
-      break;
-    }
-    if (typeof slot.command === "string") foreign = slot.command;
-  }
-  if (!installed) {
-    const manifest = readManifest(home);
-    const record = ["user", "project"].map((scope) => manifest?.statusline[settingsPath(scope, { home, cwd })]).find((r) => r !== void 0);
-    if (record) {
-      return [{
-        name,
-        status: "warn",
-        detail: `the OuterLayer segment was installed (recorded ${record.updatedAt}) but the slot no longer holds it \u2014 settings were rewritten or reset${record.original !== void 0 ? `; it wrapped: ${record.original}` : ""}`,
-        fix: "Run `outerlayer init` to reinstall the segment."
-      }];
-    }
-    return [
-      foreign !== void 0 ? { name, status: "warn", detail: `slot occupied by: ${foreign}`, fix: "Run `outerlayer init` to add the OuterLayer segment (wraps the existing command, never replaces it)." } : { name, status: "warn", detail: "not installed", fix: "Run `outerlayer init`." }
-    ];
-  }
-  const checks = [
-    { name, status: "pass", detail: wrapping ? `installed, wrapping: ${wrapping}` : "installed" }
-  ];
-  const stateName = "Status-line state";
-  const state = readStatuslineState(home);
-  if (!state) {
-    checks.push({ name: stateName, status: "warn", detail: "no state file \u2014 line runs degraded (session cost only)", fix: "Start `outerlayer daemon` (it maintains this file)." });
-    return checks;
-  }
-  const age = now() - Date.parse(state.generatedAt);
-  if (!Number.isFinite(age) || age > STATE_FRESH_MS) {
-    checks.push({ name: stateName, status: "warn", detail: `state ${formatAgo(age)} \u2014 line runs degraded`, fix: "Restart `outerlayer daemon`." });
-    return checks;
-  }
-  checks.push({ name: stateName, status: "pass", detail: `fresh (${formatAgo(age)})` });
-  return checks;
-}
-function checkClaudeDir(home) {
-  const dir = join(home, ".claude");
-  return existsSync(dir) ? { name: "Claude Code home", status: "pass", detail: dir } : { name: "Claude Code home", status: "fail", detail: `${dir} not found`, fix: "Install Claude Code, or pass --root to point at your transcripts." };
-}
-function scanTranscripts(home) {
-  const root = join(home, ".claude", "projects");
-  let count = 0;
-  let newest = 0;
-  if (!existsSync(root)) return { exists: false, count, newest };
-  const walk = (dir) => {
-    let entries;
-    try {
-      entries = readdirSync(dir, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    for (const entry of entries) {
-      const p = join(dir, entry.name);
-      if (!entry.isDirectory() && !entry.isSymbolicLink() && !entry.name.endsWith(".jsonl")) continue;
-      let st;
-      try {
-        st = statSync(p);
-      } catch {
-        continue;
-      }
-      if (st.isDirectory()) walk(p);
-      else if (entry.name.endsWith(".jsonl") && st.size > 0) {
-        count += 1;
-        if (st.mtimeMs > newest) newest = st.mtimeMs;
-      }
-    }
-  };
-  walk(root);
-  return { exists: true, count, newest };
-}
-function checkTranscripts(transcripts, now) {
-  if (!transcripts.exists) {
-    return { name: "Transcripts", status: "warn", detail: "no projects directory yet", fix: "Run a Claude Code session, then re-check." };
-  }
-  if (transcripts.count === 0) {
-    return { name: "Transcripts", status: "warn", detail: "0 transcripts found", fix: "Run a Claude Code session, then run `outerlayer doctor` again." };
-  }
-  const age = formatAgeH(now() - transcripts.newest);
-  return { name: "Transcripts", status: "pass", detail: `${transcripts.count} transcripts, newest ${age}` };
-}
-function formatAgeH(ms) {
-  const ageH = ms / 36e5;
-  return ageH < 1 ? "<1h ago" : ageH < 48 ? `${Math.round(ageH)}h ago` : `${Math.round(ageH / 24)}d ago`;
-}
-var HOOK_FIRING_GAP_MS = 24 * 60 * 60 * 1e3;
-function newestHookFiring(home) {
-  let newest = null;
-  for (const event of REGISTERED_EVENTS) {
-    try {
-      const ms = statSync(hookFiredMarkerPath(event, home)).mtimeMs;
-      if (newest === null || ms > newest) newest = ms;
-    } catch {
-    }
-  }
-  return newest;
-}
-function checkHooks(home, cwd, transcripts, now) {
-  const lastFired = newestHookFiring(home);
-  const firingFresh = lastFired !== null && transcripts.count > 0 && transcripts.newest - lastFired <= HOOK_FIRING_GAP_MS;
-  const checks = [checkHooksInstalled(home, cwd, firingFresh)];
-  const firing = checkHooksFiring(transcripts, lastFired, now);
-  if (firing) checks.push(firing);
-  const wrapped = checkWrappedHooks(home, cwd);
-  if (wrapped) checks.push(wrapped);
-  const journal = checkJournalHookCoverage(home);
-  if (journal) checks.push(journal);
-  return checks;
-}
-function checkJournalHookCoverage(home) {
-  const name = "Rewrite journal hooks";
-  const repos = readSessionRepos(home).filter((r) => existsSync(r.repoRoot));
-  if (repos.length === 0) return null;
-  let ours = 0;
-  let managed = 0;
-  let foreign = 0;
-  const absentRepos = [];
-  for (const r of repos) {
-    switch (postRewriteHookPresence(r.repoRoot)) {
-      case "ours":
-        ours += 1;
-        break;
-      case "custom-hooks-path":
-        managed += 1;
-        break;
-      case "foreign":
-        foreign += 1;
-        break;
-      case "absent":
-        absentRepos.push(r.gitRepo || r.repoRoot);
-        break;
-    }
-  }
-  const parts = [`${ours}/${repos.length} synced repos covered`];
-  if (managed > 0) parts.push(`${managed} hook-managed (README has the snippet)`);
-  if (foreign > 0) parts.push(`${foreign} foreign hook`);
-  if (absentRepos.length > 0) {
-    const sample = absentRepos.slice(0, 3).join(", ") + (absentRepos.length > 3 ? ", \u2026" : "");
-    return {
-      name,
-      status: "warn",
-      detail: `${parts.join(", ")} \u2014 ${absentRepos.length} without rewrite journaling: ${sample}`,
-      fix: 'Run `outerlayer hooks install-git` in each repo, or set {"gitHooks":{"autoInstall":true}} in ~/.outerlayer/config.json.'
-    };
-  }
-  return { name, status: "pass", detail: parts.join(", ") };
-}
-function checkHooksInstalled(home, cwd, firingFresh) {
-  const name = "Hooks installed";
-  const readablePaths = [];
-  for (const scope of ["user", "project"]) {
-    const path2 = settingsPath(scope, { home, cwd });
-    let settings;
-    try {
-      settings = readSettings(path2);
-    } catch {
-      continue;
-    }
-    readablePaths.push(path2);
-    if (!settings?.hooks) continue;
-    const installed = REGISTERED_EVENTS.filter(
-      (event) => (settings.hooks?.[event] ?? []).some((b) => (b.hooks ?? []).some(isOurHookCommand))
-    );
-    if (installed.length === REGISTERED_EVENTS.length) {
-      const missing = ourCommandBins(settings).filter((bin) => !cliBinResolvable(bin));
-      if (missing.length > 0) {
-        return {
-          name,
-          status: "fail",
-          detail: `hooks in ${path2} run ${missing.join(", ")}, which no longer exists \u2014 no session is being captured`,
-          fix: "Run `npx @outerlayer/cli init` to reinstall."
-        };
-      }
-      return { name, status: "pass", detail: `${installed.join(", ")} (${scope})` };
-    }
-    if (installed.length > 0) {
-      return { name, status: "warn", detail: `only ${installed.join(", ")} installed`, fix: "Run `outerlayer init` to (re)install all lifecycle hooks." };
-    }
-  }
-  const manifest = readManifest(home);
-  const recorded = readablePaths.find((p) => manifest?.installs[p]);
-  if (recorded) {
-    const record = manifest.installs[recorded];
-    return {
-      name,
-      status: "fail",
-      detail: `hooks were installed into ${recorded} (recorded ${record.updatedAt}) but the settings file no longer contains them \u2014 it was rewritten or reset`,
-      fix: "Run `outerlayer init` to reinstall."
-    };
-  }
-  if (firingFresh) {
-    return { name, status: "pass", detail: "not in user/project settings, but hooks are firing \u2014 installed in another scope (managed settings?)" };
-  }
-  return { name, status: "fail", detail: "no OuterLayer hooks found", fix: "Run `outerlayer init`." };
-}
-function checkWrappedHooks(home, cwd) {
-  const manifest = readManifest(home);
-  if (!manifest) return null;
-  const missing = [];
-  for (const scope of ["user", "project"]) {
-    const path2 = settingsPath(scope, { home, cwd });
-    const records = manifest.wrapped[path2];
-    if (!records || records.length === 0) continue;
-    let settings;
-    try {
-      settings = readSettings(path2);
-    } catch {
-      continue;
-    }
-    const present = /* @__PURE__ */ new Set();
-    const hooks = settings?.hooks ?? {};
-    for (const event of Object.keys(hooks)) {
-      for (const block of hooks[event] ?? []) {
-        for (const h of block.hooks ?? []) {
-          const original = wrappedOriginalCommand(h);
-          if (original !== null) present.add(`${event}\0${original}`);
-        }
-      }
-    }
-    for (const r of records) {
-      if (!present.has(`${r.event}\0${r.original}`)) missing.push(`${r.event}: ${r.original}`);
-    }
-  }
-  if (missing.length === 0) return null;
-  return {
-    name: "Wrapped hooks",
-    status: "warn",
-    detail: `recorded as wrapped but the settings no longer carry the wrapped form \u2014 ${missing.join("; ")}`,
-    fix: "Run `outerlayer hooks wrap` to re-wrap, or `outerlayer hooks unwrap` if the wrap is no longer wanted."
-  };
-}
-function checkHooksFiring(transcripts, lastFired, now) {
-  const name = "Hooks firing";
-  if (transcripts.count === 0) return null;
-  if (lastFired === null) {
-    return {
-      name,
-      status: "warn",
-      detail: "no firing evidence recorded yet \u2014 every hook run writes a marker, and none exists",
-      fix: "Start a Claude Code session, then re-run doctor."
-    };
-  }
-  if (transcripts.newest - lastFired > HOOK_FIRING_GAP_MS) {
-    return {
-      name,
-      status: "fail",
-      detail: `sessions as recent as ${formatAgeH(now() - transcripts.newest)}, but no lifecycle hook has fired since ${formatAgeH(now() - lastFired)}`,
-      fix: "Hooks are configured but not running \u2014 run `outerlayer init` and check `claude --debug` hook output."
-    };
-  }
-  return { name, status: "pass", detail: `last fired ${formatAgeH(now() - lastFired)}` };
-}
-function checkDeadHooksState(cwd) {
-  const dir = cwd ?? process.cwd();
-  const state = deadHooksState(dir);
-  if (state.hooksDir === void 0) return [];
-  const name = "Git hooks directory";
-  if (state.unreadableError) {
-    return [
-      {
-        name,
-        status: "fail",
-        detail: `${sanitizeForContext(state.hooksDir)} could not be read (${state.unreadableError.code ?? state.unreadableError.message}) \u2014 git's hooks status is unknown, not confirmed healthy`,
-        fix: "Fix the directory's permissions so it can be listed, then re-run `outerlayer doctor`."
-      }
-    ];
-  }
-  if (!state.dead) {
-    return [{ name, status: "pass", detail: `hooks present at ${sanitizeForContext(state.hooksDir)}` }];
-  }
-  const fix = `Run \`${preparePackageManagerCommand(state.repoRoot ?? dir)}\` to (re)generate the hooks directory.`;
-  return [
-    {
-      name,
-      status: "fail",
-      detail: `${sanitizeForContext(state.hooksDir)} is missing or empty \u2014 core.hooksPath points at a dead directory, so git runs no hooks at all`,
-      fix
-    }
-  ];
-}
-function checkSpoolWritable(home) {
-  const dir = spoolDir(home);
-  try {
-    if (!existsSync(dir)) return { name: "Spool writable", status: "warn", detail: "spool not created yet", fix: "Run `outerlayer init` (creates the spool on first hook)." };
-    accessSync(dir, constants.W_OK);
-    return { name: "Spool writable", status: "pass", detail: dir };
-  } catch {
-    return { name: "Spool writable", status: "fail", detail: `${dir} not writable`, fix: "Fix permissions on ~/.outerlayer/spool." };
-  }
-}
-function checkLastSync(home, now) {
-  const name = "Cloud sync";
-  if (!existsSync(join(home, ".outerlayer", "config.json"))) {
-    return { name, status: "warn", detail: "not configured \u2014 sessions stay on this machine", fix: "Run `outerlayer sync --url <url> --api-key <key> --app-id <id>` once to connect." };
-  }
-  const health = assessSyncHealth(readSyncStatus(home), now(), SYNC_STALE_AFTER_MS);
-  const detail = [health.headline, ...health.details].join("; ");
-  if (health.level === "error") {
-    return { name, status: "fail", detail, fix: "Check the destination and API key in ~/.outerlayer/config.json, then run `outerlayer sync` to see the full error." };
-  }
-  if (health.level === "warn" || health.level === "unknown") {
-    return { name, status: "warn", detail, fix: "Run `outerlayer sync` to confirm the connection works." };
-  }
-  return { name, status: "pass", detail };
-}
-function checkDaemon(home) {
-  const pidfile = join(home, ".outerlayer", "daemon.pid");
-  const heartbeat = join(home, ".outerlayer", "daemon.heartbeat");
-  if (!existsSync(pidfile)) {
-    return { name: "Daemon running", status: "warn", detail: "not running", fix: "Start it with `outerlayer daemon` (or a login agent)." };
-  }
-  try {
-    const beatMs = statSync(heartbeat).mtimeMs;
-    const staleMin = (Date.now() - beatMs) / 6e4;
-    if (staleMin > 30) {
-      return { name: "Daemon running", status: "warn", detail: `heartbeat ${Math.round(staleMin)}m stale`, fix: "Restart `outerlayer daemon`." };
-    }
-    return { name: "Daemon running", status: "pass", detail: "heartbeat fresh" };
-  } catch {
-    return { name: "Daemon running", status: "warn", detail: "pidfile present, no heartbeat", fix: "Restart `outerlayer daemon`." };
-  }
-}
-function checkCleanupPeriod(home) {
-  const path2 = join(home, ".claude", "settings.json");
-  let settings;
-  try {
-    settings = readSettings(path2);
-  } catch {
-    return { name: "Retention (cleanupPeriodDays)", status: "warn", detail: "settings unreadable" };
-  }
-  const raw = settings?.cleanupPeriodDays;
-  const days = typeof raw === "number" ? raw : 30;
-  if (days === 0) {
-    return {
-      name: "Retention (cleanupPeriodDays)",
-      status: "fail",
-      detail: "set to 0 \u2014 this DISABLES transcript persistence (upstream anthropics/claude-code#23710 and #59248)",
-      fix: "Remove cleanupPeriodDays or set it \u226514; run `outerlayer daemon` to mirror before deletion."
-    };
-  }
-  if (days < 14) {
-    return { name: "Retention (cleanupPeriodDays)", status: "warn", detail: `${days}d \u2014 transcripts deleted quickly`, fix: "Run `outerlayer daemon` so raws are mirrored before cleanup." };
-  }
-  return { name: "Retention (cleanupPeriodDays)", status: "pass", detail: `${days}d` };
-}
-function checkDiskHeadroom(home) {
-  try {
-    accessSync(home, constants.W_OK);
-    return { name: "Disk headroom", status: "pass", detail: "home writable (raw mirror capped at 5 GiB, LRU)" };
-  } catch {
-    return { name: "Disk headroom", status: "fail", detail: "home not writable", fix: "Free space / fix permissions on your home directory." };
-  }
-}
-function checkClaudeVersion(env) {
-  let version;
-  try {
-    version = (env.claudeVersion ?? defaultClaudeVersion)();
-  } catch {
-    return { name: "Claude Code version", status: "warn", detail: "could not run `claude --version`", fix: "Ensure `claude` is on PATH." };
-  }
-  const parsed = version.match(/\d+\.\d+\.\d+/)?.[0];
-  if (!parsed) return { name: "Claude Code version", status: "warn", detail: `unrecognized: ${version}` };
-  if (compareVersions(parsed, SUPPORTED_VERSIONS.max) > 0) {
-    return { name: "Claude Code version", status: "warn", detail: `${parsed} is newer than validated (${SUPPORTED_VERSIONS.max}) \u2014 parser runs best-effort`, fix: "Update OuterLayer if you see parse warnings." };
-  }
-  if (compareVersions(parsed, SUPPORTED_VERSIONS.min) < 0) {
-    return { name: "Claude Code version", status: "warn", detail: `${parsed} is older than validated (${SUPPORTED_VERSIONS.min})` };
-  }
-  return { name: "Claude Code version", status: "pass", detail: parsed };
-}
-function checkSettingsValid(home, cwd) {
-  for (const scope of ["user", "project"]) {
-    const path2 = settingsPath(scope, { home, cwd });
-    if (!existsSync(path2)) continue;
-    try {
-      readSettings(path2);
-    } catch (err) {
-      return { name: "Settings JSON valid", status: "fail", detail: `${path2} is corrupt`, fix: err instanceof Error ? err.message : "Fix the JSON syntax." };
-    }
-  }
-  return { name: "Settings JSON valid", status: "pass", detail: "all settings files parse" };
-}
-function checkInstalls(env) {
-  let installs;
-  try {
-    installs = (env.claudeInstalls ?? defaultClaudeInstalls)();
-  } catch {
-    return [];
-  }
-  if (installs.length > 1) {
-    return [{ name: "Claude Code installs", status: "warn", detail: `multiple found: ${installs.join(", ")}`, fix: "Multiple installs can diverge in version; keep one." }];
-  }
-  return [];
-}
-function defaultClaudeVersion() {
-  return execFileSync("claude", ["--version"], { encoding: "utf8", timeout: 5e3 }).trim();
-}
-function defaultClaudeInstalls() {
-  try {
-    const out = execFileSync(process.platform === "win32" ? "where" : "which", ["-a", "claude"], { encoding: "utf8", timeout: 5e3 });
-    return out.split(/\r?\n/).filter((l) => l.trim().length > 0);
-  } catch {
-    return [];
-  }
-}
-function contextDegradedFix(kind) {
-  switch (kind) {
-    case "unreachable":
-      return "Check network/VPN access to the control plane, then run `outerlayer context materialize`.";
-    case "no-access":
-      return "Check your git credentials (SSH key or token) and org/SSO access to the control plane, then retry.";
-    case "designation-unverified":
-      return "Check OuterLayer cloud connectivity/config (~/.outerlayer/config.json), then run `outerlayer context materialize`.";
-    case "not-governed":
-      return "Expected if the control plane's `governs` list changed intentionally; otherwise re-designate the source.";
-    case "adoption-conflict":
-      return "Remove the committed AGENTS.md/.claude/.outerlayer files in a commit, then run `outerlayer context materialize`.";
-    case "conflict":
-      return "Revoke the designation from all but one of the claiming factories, then run `outerlayer context materialize`.";
-  }
-}
-function checkContextSource(home, cwd) {
-  const dir = cwd ?? process.cwd();
-  let repoRoot;
-  let gitCommonDir;
-  try {
-    repoRoot = execFileSync("git", ["-C", dir, "rev-parse", "--show-toplevel"], {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"],
-      timeout: 2e3
-    }).trim();
-    gitCommonDir = execFileSync("git", ["-C", dir, "rev-parse", "--path-format=absolute", "--git-common-dir"], {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"],
-      timeout: 2e3
-    }).trim();
-  } catch {
-    return [];
-  }
-  if (!repoRoot || !gitCommonDir) return [];
-  const pin = readPin(repoRoot);
-  const manifest = readContextManifest(gitCommonDir);
-  const degraded = readDegraded(gitCommonDir);
-  const sourceCache = readSourceCache(gitCommonDir);
-  const looksGoverned = pin !== void 0 || sourceCache?.status === "governed";
-  if (!pin && !manifest && !degraded && !looksGoverned) return [];
-  const checks = [];
-  const name = "Context source";
-  if (pin && manifest && pin.sha !== manifest.sha) {
-    checks.push({
-      name,
-      status: "warn",
-      detail: `pin (${pin.sha.slice(0, 7)}) and manifest (${manifest.sha.slice(0, 7)}) disagree`,
-      fix: "Run `outerlayer context materialize` to reconcile."
-    });
-  } else if (pin ?? manifest) {
-    const sha = (pin ?? manifest).sha;
-    checks.push({ name, status: degraded ? "warn" : "pass", detail: `materialized at ${sha.slice(0, 7)}` });
-  }
-  if (degraded) {
-    checks.push({
-      name: "Context source degradation",
-      status: degraded.kind === "adoption-conflict" || degraded.kind === "conflict" ? "fail" : "warn",
-      detail: degraded.message,
-      fix: contextDegradedFix(degraded.kind)
-    });
-  }
-  if ((pin || manifest) && !contextExcludesPresent(gitCommonDir)) {
-    checks.push({
-      name: "Context exclude block",
-      status: "warn",
-      detail: "materialized paths are not excluded in .git/info/exclude",
-      fix: "Run `outerlayer context materialize` to repair it."
-    });
-  }
-  if (pin && !readCloudConfig(home).url) {
-    checks.push({
-      name,
-      status: "warn",
-      detail: "a pin exists but OuterLayer cloud sync isn't configured \u2014 the designation cannot be confirmed",
-      fix: "Run `outerlayer sync --url <url> --api-key <key> --app-id <id>` once to connect."
-    });
-  }
-  if (looksGoverned) {
-    let tracked = "";
-    try {
-      tracked = execFileSync("git", ["-C", repoRoot, "ls-files", "--", "AGENTS.md", ".claude", ".outerlayer"], {
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "ignore"],
-        timeout: 2e3
-      }).trim();
-    } catch {
-      tracked = "";
-    }
-    if (tracked) {
-      const paths = tracked.split("\n");
-      const sample = paths.slice(0, 3).join(", ") + (paths.length > 3 ? ", \u2026" : "");
-      checks.push({
-        name,
-        status: "fail",
-        detail: `committed context files shadow the control plane: ${sample}`,
-        fix: "Remove the committed AGENTS.md/.claude/.outerlayer files in a commit, then run `outerlayer context materialize`."
-      });
-    }
-  }
-  return checks;
-}
-function doctorExitCode(checks) {
-  return checks.some((c) => c.status === "fail") ? 1 : 0;
-}
-var FALLBACK_VERSION = "0.1.0";
-function readJson(path2) {
-  if (!existsSync(path2)) return null;
-  try {
-    return JSON.parse(readFileSync(path2, "utf8"));
-  } catch {
-    return null;
-  }
-}
-function resolveVersion(entryPath = fileURLToPath(import.meta.url)) {
-  const distDir = dirname(entryPath);
-  const pkg = readJson(join(dirname(distDir), "package.json"));
-  const version = typeof pkg?.version === "string" ? pkg.version : FALLBACK_VERSION;
-  const buildInfo = readJson(join(distDir, "build-info.json"));
-  const buildId = typeof buildInfo?.id === "string" ? buildInfo.id : null;
-  return buildId ? `${version} (build ${buildId})` : version;
-}
 
 // src/cli.ts
 function resolveCliBin() {
@@ -4278,11 +3616,6 @@ function resolveCliBin() {
   }
 }
 var SUPPORT_TEXT = "\nDocs:   https://github.com/outerlayerai/outerlayer#readme\nIssues: https://github.com/outerlayerai/outerlayer/issues\n";
-function icon(status) {
-  if (status === "pass") return `${C.green}\u2713${C.reset}`;
-  if (status === "warn") return `${C.yellow}!${C.reset}`;
-  return `${C.red}\u2717${C.reset}`;
-}
 function fail(message) {
   process.stderr.write(`${C.red}\u2717${C.reset} ${message}
 `);
@@ -4298,7 +3631,18 @@ function apiKeyOption() {
 function warnIfApiKeyFlag(opts) {
   if (opts.apiKey !== void 0) warnDeprecated(API_KEY_FLAG_DEPRECATION);
 }
-function formatInitOutput(result) {
+async function installStarterPackInRepo() {
+  const { installStarterPack, formatStarterPackOutput } = await import('./starter-pack-LIZYMKYQ.js');
+  const cwd = process.cwd();
+  let repoRoot = cwd;
+  try {
+    repoRoot = execFileSync("git", ["rev-parse", "--show-toplevel"], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || cwd;
+  } catch {
+  }
+  const result = installStarterPack({ repoRoot });
+  return { result, output: formatStarterPackOutput(result) };
+}
+function formatInitOutput(result, opts = {}) {
   const lines = [];
   if (result.removed) {
     lines.push(
@@ -4368,15 +3712,12 @@ cannot be disabled.
 `
   );
   lines.push(
-    `
+    (opts.next === false ? "\n" : `
 Next: launch a session naming its work item, then sync it:
   ${C.yellow}OUTERLAYER_WORK=42 claude${C.reset}
   ${C.yellow}outerlayer sync${C.reset}
 
-Once you have run outerlayer login, launched sessions sync
-automatically in the background after each agent turn and at the end
-of the session, at most once every five minutes.
-`
+`) + (opts.connected ? "This repository is connected to a factory, so launched sessions sync\nautomatically in the background after each agent turn and at the end\nof the session, at most once every five minutes.\n" : "Once you have run outerlayer login and outerlayer init in this repository,\nlaunched sessions sync automatically in the background after each agent\nturn and at the end of the session, at most once every five minutes.\n")
   );
   return lines.join("");
 }
@@ -4402,115 +3743,182 @@ function formatGuardInstallOutput(guard) {
       if (guard.adopted) {
         return { lines: [`${C.green}\u2713${C.reset} materialized-context commit guard hand-adopted at ${guard.path} (core.hooksPath) \u2014 left untouched.`] };
       }
-      return { lines: [] };
+      return {
+        lines: [
+          `${C.yellow}!${C.reset} this repo manages hooks in its working tree (core.hooksPath) \u2014 nothing written.`,
+          `  Add the script to your hook manager instead: ${C.yellow}outerlayer hooks install-git --print${C.reset}`
+        ],
+        exitCode: 1
+      };
     case "not-a-repo":
-      return { lines: [] };
+      return { lines: [], error: "not inside a git repository." };
   }
 }
+async function installHooks(opts, resolvedBin, connected, starterTemplate, withNext = true) {
+  const scope = opts.project ? "project" : "user";
+  let cliBin;
+  try {
+    cliBin = initHookBin({ home: homeFromEnv(), runningBin: resolvedBin, remove: opts.remove === true });
+  } catch (err) {
+    const text = `could not copy the CLI to ~/.outerlayer/cli: ${err instanceof Error ? err.message : String(err)}
+  Hooks were not changed. Fix the permissions on ~/.outerlayer, then re-run ${C.yellow}outerlayer init${C.reset}.`;
+    return { ok: false, text, detail: "could not copy the CLI to ~/.outerlayer/cli" };
+  }
+  try {
+    const result = runInit({
+      scope,
+      remove: opts.remove,
+      cliBin,
+      addGitignore: opts.gitignore,
+      wrapHooks: opts.wrapHooks,
+      statusline: opts.statusline
+    });
+    if (result.cliBinUnresolved) {
+      const text = `the resolved CLI path (${cliBin}) does not exist \u2014 refusing to write hook entries pointing at it.
+  Reinstall OuterLayer, then re-run ${C.yellow}outerlayer init${C.reset}.`;
+      return { ok: false, text, detail: "the CLI path does not exist" };
+    }
+    const starter = starterTemplate === void 0 ? null : await installStarterPackInRepo();
+    return {
+      ok: true,
+      text: formatInitOutput(result, { connected: connected === true, next: withNext }) + (starter === null ? "" : `
+${starter.output}`),
+      detail: result.changed ? `installed in ${result.path}` : `already installed in ${result.path}`,
+      result: starter === null ? result : { ...result, starterPack: starter.result }
+    };
+  } catch (err) {
+    if (err instanceof SettingsParseError) return { ok: false, text: err.message, detail: err.message };
+    throw err;
+  }
+}
+async function realConnectDepsForCwd() {
+  const { realConnectDeps } = await import('./connect-cmd-OOG4TPU7.js');
+  const { resolveRepoIdentity } = await import('./dist-RW4UPPC2.js');
+  return {
+    ...realConnectDeps(),
+    home: homeFromEnv(),
+    cwd: process.cwd(),
+    // Prompts need a person at both ends: stdin to answer on, stderr to ask on.
+    isTerminal: Boolean(process.stdin.isTTY && process.stderr.isTTY),
+    resolveRepository: (cwd) => resolveRepoIdentity(cwd).gitRepo
+  };
+}
 function invokedCommandToken(argv) {
   return argv.slice(2).find((token) => !token.startsWith("-"));
 }
 function buildProgram(argv = process.argv) {
   const program2 = new Command();
   program2.name("outerlayer").description("OuterLayer \u2014 see what your coding agents actually do").enablePositionalOptions().version(resolveVersion()).option(NO_COLOR_FLAG, "disable color (NO_COLOR=1 does the same)").addHelpText("after", SUPPORT_TEXT);
-  program2.command("init").description("Install the Claude Code capture hooks and wrap tool hooks for evidence").option("--user", "install into user settings [default]").option("--project", "install into project settings (./.claude/settings.json)").option("--org", "print a managed-settings.json snippet for MDM/GPO rollout").option("--remove", "uninstall OuterLayer hooks").option("--gitignore", "also add .outerlayer/ to .gitignore (project scope)").option("--no-wrap-hooks", "leave PreToolUse/PostToolUse hooks unwrapped").option("--statusline", "install the status-line segment [default]").option("--no-statusline", "leave the statusLine slot untouched").option("--json", "machine-readable JSON output").addHelpText(
+  program2.command("init").description("Connect this repository, install hooks and agent skills, run doctor").option("--user", "install into user settings [default]").option("--project", "install into project settings (./.claude/settings.json)").option("--org", "print a managed-settings.json snippet for MDM/GPO rollout").option("--remove", "uninstall OuterLayer hooks").option("--local", "install the hooks only: no connect step and no network call").option("--factory <org/factory>", "the factory to connect this repository to (see `outerlayer connect`)").option("--gitignore", "also add .outerlayer/ to .gitignore (project scope)").option("--template <name>", "install the starter skills and a policy file (only: default)").option("--no-wrap-hooks", "leave PreToolUse/PostToolUse hooks unwrapped").option("--statusline", "install the status-line segment [default]").option("--no-statusline", "leave the statusLine slot untouched").option("--json", "machine-readable JSON output").addHelpText(
     "after",
-    "\nIdempotent: settings are backed up before any write, and a second run\nchanges nothing. Wrapping adds one spawn per hook firing; undo it with\n`outerlayer hooks unwrap`. An occupied status-line slot is wrapped, never\nreplaced.\n"
-  ).action((opts) => {
-    let cliBin = resolveCliBin();
+    "\nIn a repository, init runs four steps: connect the repository to a\nfactory (`outerlayer connect`), install the hooks, set up the coding agent,\nand run `outerlayer doctor`. It never signs in and asks nothing. With no\nlogin it skips the connect step and says to run `outerlayer login`. With\n--json it prints one document naming the outcome of each step: done,\nskipped or failed. The exit code is 1 when a step failed.\n\nThe agent setup step installs the starter skills and the `outerlayer` skill\ninto .outerlayer/skills/, writes .outerlayer/config.json for Claude Code when\nthere is none, runs `outerlayer context emit` so the skills appear in\n.claude/skills/, and adds the OuterLayer MCP server to .mcp.json. Nothing you\nwrote is changed: an existing config, policy, edited skill, MCP entry or root\nCLAUDE.md and AGENTS.md is left as it is, and a hand-written file the emit\nwould replace is kept and listed. The files are left uncommitted.\nThe step is skipped outside a git repository and in a repository whose\ncontext comes from a control plane, where it arrives at session start.\n\n--local installs only the hooks: no connect step, no agent setup and no\nnetwork call. Add `--template default` to also write the starter skills and\na policy file into .outerlayer/ without compiling them; `outerlayer context\nemit` does that.\n\nIdempotent: settings are backed up before any write, and a second run\nchanges nothing. Wrapping adds one spawn per hook firing; undo it with\n`outerlayer hooks unwrap`. An occupied status-line slot is wrapped, never\nreplaced.\n\nThree of the starter skills are copied once and are yours to edit. The\nothers are rewritten from this CLI on every `context emit`.\n"
+  ).action(async (opts) => {
+    let starterTemplate;
+    if (opts.template !== void 0) {
+      const { assertKnownTemplate, StarterPackError } = await import('./starter-pack-LIZYMKYQ.js');
+      try {
+        assertKnownTemplate(opts.template);
+      } catch (err) {
+        if (err instanceof StarterPackError) {
+          fail(err.message);
+          return;
+        }
+        throw err;
+      }
+      if (opts.remove || opts.org) {
+        fail("--template installs into a repository, so it cannot be combined with --remove or --org.");
+        return;
+      }
+      starterTemplate = opts.template;
+    }
+    const cliBin = resolveCliBin();
     if (opts.org) {
       process.stdout.write(orgRolloutSnippet(cliBin) + "\n");
       return;
     }
-    const scope = opts.project ? "project" : "user";
-    try {
-      cliBin = initHookBin({ home: homeFromEnv(), runningBin: cliBin, remove: opts.remove === true });
-    } catch (err) {
-      fail(
-        `could not copy the CLI to ~/.outerlayer/cli: ${err instanceof Error ? err.message : String(err)}
-  Hooks were not changed. Fix the permissions on ~/.outerlayer, then re-run ${C.yellow}outerlayer init${C.reset}.`
-      );
-      return;
-    }
-    try {
-      const result = runInit({
-        scope,
-        remove: opts.remove,
-        cliBin,
-        addGitignore: opts.gitignore,
-        wrapHooks: opts.wrapHooks,
-        statusline: opts.statusline
-      });
-      if (result.cliBinUnresolved) {
-        fail(
-          `the resolved CLI path (${cliBin}) does not exist \u2014 refusing to write hook entries pointing at it.
-  Reinstall OuterLayer, then re-run ${C.yellow}outerlayer init${C.reset}.`
-        );
-        return;
-      }
-      if (opts.json) {
-        writeJson(result);
+    if (opts.remove || opts.local) {
+      const outcome = await installHooks(opts, cliBin, void 0, starterTemplate);
+      if (!outcome.ok) {
+        fail(outcome.text);
         return;
       }
-      process.stdout.write(formatInitOutput(result));
-    } catch (err) {
-      if (err instanceof SettingsParseError) {
-        fail(err.message);
-        return;
-      }
-      throw err;
+      if (opts.json) writeJson(outcome.result);
+      else process.stdout.write(outcome.text);
+      return;
     }
+    const { runInitCommand } = await import('./init-cmd-NHR7PRSQ.js');
+    const code = await runInitCommand(
+      { json: opts.json, factory: opts.factory },
+      {
+        connect: await realConnectDepsForCwd(),
+        stdout: process.stdout,
+        stderr: process.stderr,
+        runHooks: async (hooksOpts) => {
+          const { ok, text, detail } = await installHooks(opts, cliBin, hooksOpts?.connected, void 0, false);
+          return { ok, text, detail };
+        },
+        runAgentSetup: async () => {
+          const { runAgentSetup } = await import('./agent-setup-IFH3FB5X.js');
+          return runAgentSetup({ cwd: process.cwd() });
+        },
+        runDoctorChecks: gatherDoctorChecks
+      }
+    );
+    if (code !== 0) process.exitCode = code;
+  });
+  program2.command("connect").description("Choose the factory this repository's work goes to").option("--factory <org/factory>", "the factory to use: <org>/<factory> as in its dashboard address, or a factory id").option("--json", "write one JSON document to stdout; the text goes to stderr").addHelpText(
+    "after",
+    "\nRun it in a repository, after `outerlayer login`. With a login, connect lists\nthe factories you can use and takes the first rule that leaves one answer:\n  1. --factory <org>/<factory>, or a factory id\n  2. the factory this repository is already connected to\n  3. the one factory this repository is linked to\n  4. the one factory you can use\n  5. on a terminal, ask; with no terminal, exit 1 and list each --factory value\n\nIt says what it chose and why. The choice is saved in this repository's git\ndirectory (outerlayer/connection.json), shared by every worktree of the\nclone and never committed. A factory key already belongs to one factory, so\nconnect changes nothing for it. Connect never links a repository.\n\nAfter it saves the choice, connect checks that this repository is linked to\nthe factory. If it is not, connect says so, prints the factory's Work page\nlink where you link it, and exits 2. The choice is saved either way. Run\nconnect again once the repository is linked. With --json, the document has\nlinked (true, false, or null when it could not be checked) and, when false,\nlinkUrl.\n"
+  ).action(async (opts) => {
+    const { runConnectCommand } = await import('./connect-cmd-OOG4TPU7.js');
+    const code = await runConnectCommand({ factory: opts.factory, json: opts.json }, await realConnectDepsForCwd(), {
+      stdout: process.stdout,
+      stderr: process.stderr
+    });
+    if (code !== 0) process.exitCode = code;
   });
-  program2.command("doctor").description("Diagnose the capture setup; every failing check names its fix").option("--json", "machine-readable JSON output").action((opts) => {
-    const checks = runDoctor();
-    const fails = checks.filter((c) => c.status === "fail").length;
-    const warns = checks.filter((c) => c.status === "warn").length;
-    const passed = checks.length - fails - warns;
+  program2.command("doctor").description("Diagnose the capture setup; every failing check names its fix").option("--json", "machine-readable JSON output").action(async (opts) => {
+    const checks = await gatherDoctorChecks();
     process.exitCode = doctorExitCode(checks);
     if (opts.json) {
-      writeJson({ checks, summary: { passed, warnings: warns, failures: fails } });
+      writeJson({ checks, summary: summarizeChecks(checks) });
       return;
     }
-    process.stdout.write("\nOuterLayer doctor\n\n");
-    for (const c of checks) {
-      process.stdout.write(`  ${icon(c.status)} ${c.name}${C.dim} \u2014 ${c.detail}${C.reset}
-`);
-      if (c.fix && c.status !== "pass") process.stdout.write(`      ${C.dim}\u21B3 ${c.fix}${C.reset}
-`);
-    }
-    process.stdout.write(`
-${fails === 0 ? `${C.green}\u2713${C.reset}` : `${C.red}\u2717${C.reset}`} ${passed} passed, ${warns} warnings, ${fails} failures
-`);
+    process.stdout.write(renderDoctorText(checks));
   });
-  program2.command("login").description("Save the cloud URL, app id, and API key to ~/.outerlayer/config.json").option("--url <url>", "gateway base URL (required; there is no default)").option("--app-id <id>", "factory id the key is bound to (Settings \u2192 General)").option("--no-input", "never prompt; fail if the key is not on stdin").option("--json", "machine-readable JSON output").addHelpText(
+  program2.command("login").description("Sign in to your account by browser approval, or save a piped factory key").option("--dashboard <address>", "the dashboard to sign in on (default: https://app.outerlayer.ai)").option("--no-browser", "print the approve link without opening a browser").option("--check <id>", "check a login that is still waiting for approval, once").option("--url <url>", "gateway base URL for a piped key (browser login gets it from the dashboard)").option("--app-id <id>", "factory id a piped key is bound to (Settings \u2192 General)").option("--no-input", "never wait on a person; fail if the key is not on stdin").option("--json", "machine-readable JSON output").addHelpText(
     "after",
-    '\nThe key is read from stdin when stdin is a pipe, otherwise from a prompt\nwith echo off. It is never a flag and never printed back.\n\n  echo "$OUTERLAYER_KEY" | outerlayer login --app-id <factory id>\n\nEvery later command reads the saved file, so none of them needs a key on\nits command line. A saved key is checked for real on the first `sync`.\n'
+    '\nWith no key on stdin, login prints an approve link and a code. A signed-in\nperson approves it on the dashboard. The login is a token for that person\'s\naccount, made for this machine, saved here and never printed. It picks no\nfactory: run `outerlayer connect` for that. `outerlayer logout` revokes it.\n\nWhen stdout is not a terminal, login does not wait. It prints one JSON\ndocument with the link, the code and a `login --check <id>` command, and\nexits 75. Run the check until it stops exiting 75: 0 is signed in, 1 is\ndenied or expired. A dropped connection or a 5xx also exits 75.\n\nA factory key piped on stdin is saved as it always was, never as a flag and\nnever printed back. A factory key always wins over the login, so CI and\nrunners keep acting as their key.\n\n  echo "$OUTERLAYER_KEY" | outerlayer login --url <gateway url> --app-id <factory id>\n\nEvery later command reads the saved file, so none of them needs a key on\nits command line. A saved key is checked for real on the first `sync`.\n'
   ).action(async (opts) => {
-    const { runLogin, readApiKey, LoginError } = await import('./login-cmd-IRX6LZT7.js');
-    try {
-      const apiKey = await readApiKey({ noInput: opts.input === false });
-      const result = runLogin({ apiKey, url: opts.url, appId: opts.appId });
-      if (opts.json) {
-        writeJson(result);
-        return;
-      }
-      process.stdout.write(
-        `${C.green}\u2713${C.reset} Saved credentials to ${result.path}` + (result.url ? ` for ${result.url}` : "") + (result.appId ? ` (app ${result.appId})` : "") + "\n"
-      );
-    } catch (err) {
-      if (err instanceof LoginError) {
-        fail(err.message);
-        return;
-      }
-      throw err;
-    }
+    const { runLoginCommand, realLoginDeps } = await import('./login-browser-7XGSV7MA.js');
+    const code = await runLoginCommand(
+      {
+        browser: opts.browser !== false,
+        dashboard: opts.dashboard,
+        json: opts.json,
+        check: opts.check,
+        noInput: opts.input === false,
+        url: opts.url,
+        appId: opts.appId
+      },
+      realLoginDeps()
+    );
+    if (code !== 0) process.exitCode = code;
+  });
+  program2.command("logout").description("Revoke this machine's login and remove it").addHelpText(
+    "after",
+    "\nRevokes the token `outerlayer login` saved, then deletes it from the config\nfile. A factory key and the chosen factory are left alone. When the\ndashboard cannot be reached the local copy is still deleted and the exit\ncode is 1: revoke the token on /profile/security.\n"
+  ).action(async () => {
+    const { runLogoutCommand, realLogoutDeps } = await import('./logout-cmd-QAUFDJ6J.js');
+    const code = await runLogoutCommand(realLogoutDeps());
+    if (code !== 0) process.exitCode = code;
   });
-  program2.command("sync").description("Send local coding-agent sessions to OuterLayer cloud").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "app id the key is bound to (or OUTERLAYER_APP_ID / config)").option("--tier <tier>", "capture tier: metrics | redacted | full (default: full)").option("--dry-run", "print what would leave this machine, send nothing").option("--all", "ignore the sync checkpoint and re-send everything").option("--limit <n>", "only the N most recent sessions", (v) => parseInt(v, 10)).option("--json", "machine-readable JSON output").option("--quiet", "no output; exit code only").option("--root <dir>", "Claude Code transcript root (default ~/.claude/projects)").option("--codex-root <dir>", "Codex sessions root (default ~/.codex/sessions)").option("--cursor-root <dir>", "Cursor chats root (default ~/.cursor/chats)").addHelpText(
+  program2.command("sync").description("Send local coding-agent sessions to OuterLayer cloud").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").option("--tier <tier>", "capture tier: metrics | redacted | full (default: full)").option("--dry-run", "print what would leave this machine, send nothing").option("--all", "ignore the sync checkpoint and re-send everything").option("--limit <n>", "only the N most recent sessions", (v) => parseInt(v, 10)).option("--json", "machine-readable JSON output").option("--quiet", "no output; exit code only").option("--root <dir>", "Claude Code transcript root (default ~/.claude/projects)").option("--codex-root <dir>", "Codex sessions root (default ~/.codex/sessions)").option("--cursor-root <dir>", "Cursor chats root (default ~/.cursor/chats)").addHelpText(
     "after",
     "\nIncremental: only sessions newer than the last checkpoint ship. The tier\nis applied on this machine before anything leaves it; `--dry-run` prints\nexactly what would. The hook-triggered background sync runs `--quiet`.\nExit 2 means the server rejected at least one session.\n"
   ).action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runSync, SyncConfigError, SyncTransportError } = await import('./sync-cmd-S7Q6DWU3.js');
+    const { runSync, SyncConfigError, SyncTransportError } = await import('./sync-cmd-VPPYCNNM.js');
     try {
       const result = await runSync({
         url: opts.url,
@@ -4539,7 +3947,7 @@ ${fails === 0 ? `${C.green}\u2713${C.reset}` : `${C.red}\u2717${C.reset}`} ${pas
     if (invokedCommandToken(argv) === "watch") {
       warnDeprecated("`outerlayer watch` is now `outerlayer daemon`; the old name will be removed in a future release.");
     }
-    const { runWatch } = await import('./watch-NRLXJUST.js');
+    const { runWatch } = await import('./watch-5C4ZBBGO.js');
     await runWatch({ once: opts.once });
   });
   program2.command("hook <event>", { hidden: true }).description("capture-hook fast path, installed by `init`").action(() => {
@@ -4548,6 +3956,59 @@ ${fails === 0 ? `${C.green}\u2713${C.reset}` : `${C.red}\u2717${C.reset}`} ${pas
   });
   program2.command("hook-wrap", { hidden: true }).description("runs a hook wrapped by `hooks wrap`, recording exec evidence").option("--id <base64>", "the original hook command, base64-encoded").option("--capture-output", "tee stdout/stderr into a bounded tail").action(() => {
   });
+  program2.command("broker-relay", { hidden: true }).description("relay a build's loopback connections to the runner's tunnel and destinations").requiredOption("--port <port>", "the loopback port to listen on").requiredOption("--socket <path>", "the runner's tunnel socket").option("--forward <port=socket>", "also relay a loopback port to a destination's socket; repeatable", (value, previous) => [...previous, value], []).action(async (opts) => {
+    const { startRelay } = await import('./relay-L76HDX72.js');
+    const port = Number(opts.port);
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+      fail(`--port must be a port number, not ${opts.port}`);
+      return;
+    }
+    const forwards = [];
+    for (const spec of opts.forward) {
+      const eq = spec.indexOf("=");
+      const forwardPort = Number(spec.slice(0, eq));
+      if (eq === -1 || !Number.isInteger(forwardPort) || forwardPort < 1 || forwardPort > 65535 || eq === spec.length - 1) {
+        fail(`--forward must be <port>=<socket path>, not ${spec}`);
+        return;
+      }
+      forwards.push({ port: forwardPort, socketPath: spec.slice(eq + 1) });
+    }
+    await startRelay({ port, socketPath: opts.socket, forwards });
+  });
+  program2.command("vm-exec", { hidden: true }).description("run a command in a microVM build's guest through its exec agent").requiredOption("--socket <path>", "the Unix socket Firecracker serves the build's vsock device on").option("--user <user>", "the user to run as", "").option("--cwd <dir>", "the working directory", "/").option("--env <NAME=value>", "an environment value the command line carries; repeatable", (value, previous) => [...previous, value], []).option("--pass <NAME>", "an environment variable whose value is read from this process; repeatable", (value, previous) => [...previous, value], []).argument("<argv...>", "the command and its arguments").action(async (argv2, opts) => {
+    const { runVmExec } = await import('./exec-client-4XGXV3XN.js');
+    const env = {};
+    for (const entry of opts.env) {
+      const eq = entry.indexOf("=");
+      if (eq < 1) {
+        fail(`--env must be NAME=value, not ${entry}`);
+        return;
+      }
+      env[entry.slice(0, eq)] = entry.slice(eq + 1);
+    }
+    const abort = new AbortController();
+    for (const signal of ["SIGTERM", "SIGINT", "SIGHUP"]) process.on(signal, () => abort.abort());
+    try {
+      const status = await runVmExec(
+        { socket: opts.socket, user: opts.user, cwd: opts.cwd, env, pass: opts.pass, argv: argv2 },
+        { stdin: process.stdin, stdout: (chunk) => void process.stdout.write(chunk), stderr: (chunk) => void process.stderr.write(chunk), env: process.env, signal: abort.signal }
+      );
+      process.exit(status < 0 ? 255 : status);
+    } catch (err) {
+      process.stderr.write(`vm-exec: ${err instanceof Error ? err.message : String(err)}
+`);
+      process.exit(255);
+    }
+  });
+  program2.command("vm-init", { hidden: true }).description("lay out a microVM build's guest; the guest helper runs it").action(async () => {
+    const { realGuestHost, runGuestInit } = await import('./guest-init-GENRHNP7.js');
+    const { readFileSync: readFileSync3 } = await import('fs');
+    try {
+      runGuestInit(realGuestHost(), readFileSync3("/proc/cmdline", "utf8"));
+    } catch (err) {
+      fail(`vm-init failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  });
   registerEmitCommands(program2);
   registerImportCommands(program2);
   registerHooksCommands(program2);
@@ -4557,13 +4018,17 @@ ${fails === 0 ? `${C.green}\u2713${C.reset}` : `${C.red}\u2717${C.reset}`} ${pas
   registerRunnerCommands(program2);
   return program2;
 }
+function withoutItemKey(job) {
+  const { itemKey: _itemKey, ...rest } = job;
+  return rest;
+}
 async function runCli(processArgv) {
   const { argv, noColor } = stripNoColor(processArgv);
   if (noColor) process.env.NO_COLOR = "1";
   await buildProgram(argv).parseAsync(argv);
 }
 async function compileContext(opts) {
-  const { runEmit, EmitError } = await import('./emit-cmd-TWSYYEZI.js');
+  const { runEmit, EmitError } = await import('./emit-cmd-DCERAU27.js');
   try {
     const result = runEmit({ cwd: opts.dir, check: opts.check, json: opts.json });
     if (result.exitCode !== 0) process.exitCode = result.exitCode;
@@ -4576,9 +4041,9 @@ async function compileContext(opts) {
   }
 }
 function registerEmitCommands(program2) {
-  const emitCmd = program2.command("emit").enablePositionalOptions().description("Record evidence for a work item: a named check result").argument("[name]", "the check name a validator declares (e.g. smoke.pass)").option("--link <url>", "proof link, usually the CI run URL").option("--body <text>", "one sentence recording your judgment").option("--body-file <path>", "read the sentence from a file; - reads standard input").option("--result <pass|fail>", "check outcome (default: pass)").option("--item <number>", "work item to record on directly, by its number in this factory").option("--artifact <id>", "artifact this verdict is on \u2014 only with the artifact-review check name").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "app id the key is bound to (or OUTERLAYER_APP_ID / config)").addOption(new Option("--check", "deprecated: use `context emit --check`").hideHelp()).addOption(new Option("--dir <path>", "deprecated: use `context emit --dir`").hideHelp()).addHelpText(
+  const emitCmd = program2.command("emit").enablePositionalOptions().description("Record evidence for a work item: a named check result").argument("[name]", "the check name a validator declares (e.g. smoke.pass)").option("--link <url>", "proof link, usually the CI run URL").option("--body <text>", "one sentence recording your judgment").option("--body-file <path>", "read the sentence from a file; - reads standard input").option("--result <pass|fail>", "check outcome (default: pass)").option("--item <number>", "work item to record on directly, by its number in this factory").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").addOption(new Option("--check", "deprecated: use `context emit --check`").hideHelp()).addOption(new Option("--dir <path>", "deprecated: use `context emit --dir`").hideHelp()).addHelpText(
     "after",
-    '\n  outerlayer emit smoke.pass --item 412 --link https://ci.example.com/run/42\n  outerlayer emit code-review --result fail --item 412 --body "The button should be red."\n  outerlayer emit artifact-review --result fail --artifact a1b2c3d4 --body "Wrong state."\n\nRecords that a named check passed or failed, anchored to a work item.\n--item is always required, in or out of a recorded session \u2014 there is no\nsession fallback. A check that ran carries the run URL as proof (--link);\na judgment you are making yourself carries one sentence (--body, or\n--body-file to read it from a file or standard input). A fail needs at\nleast one of the two. Run from inside a session, --item can only name a\nwork item that session was NOT launched for \u2014 a session cannot record a\ncheck on its own item. With nothing to attach it to, the command refuses.\n\nWho recorded a check is decided by your API key, never by what you send:\na key bound to your membership records it as yours, and nothing automated\ncan then clear it.\n\nThe check name `artifact-review` is a different act: a person\'s own pass\nor fail on one artifact, named with --artifact instead of --item, refused\nfrom inside a recorded session \u2014 an artifact verdict is a person\'s act.\n--link is refused in this mode; a fail needs --body / --body-file.\n\nSubcommands: `emit artifact <file>` for screenshots, recordings, reports and\nlogs; `emit commit-credit` to attest a commit belongs to a pull request;\n`emit finding` / `emit findings <file>` to record what was found wrong about\nthe change or about a rule.\nCompiling .outerlayer/ moved to `outerlayer context emit`.\n'
+    "\n  outerlayer emit smoke.pass --item 412 --link https://ci.example.com/run/42\n  outerlayer emit code-review --result fail --item 412 --body \"The button should be red.\"\n\nRecords that a named check passed or failed, anchored to a work item.\n--item is always required, in or out of a recorded session \u2014 there is no\nsession fallback. A check that ran carries the run URL as proof (--link);\na judgment you are making yourself carries one sentence (--body, or\n--body-file to read it from a file or standard input). A fail needs at\nleast one of the two. Run from inside a session, the check is stored as\nthe session's; a session cannot record over a person's fail. With\nnothing to attach it to, the command refuses.\n\nWho recorded a check is decided by your API key, never by what you send:\na key bound to your membership records it as yours, and nothing automated\ncan then clear it.\n\nA person's pass or fail on one criterion's proof is recorded on that\ncriterion's thread instead \u2014 see `outerlayer work comment`.\n\nSubcommands: `emit artifact <file>` for screenshots, recordings, reports and\nlogs; `emit finding` / `emit findings <file>` to record a problem in the factory;\n`emit criteria <file>` to record a work item's acceptance criteria.\nCompiling .outerlayer/ moved to `outerlayer context emit`.\n"
   ).action(async (name, opts) => {
     if (name === void 0) {
       warnDeprecated("`outerlayer emit` with no name now lives at `outerlayer context emit`; the bare form will be removed in a future release.");
@@ -4586,7 +4051,7 @@ function registerEmitCommands(program2) {
       return;
     }
     warnIfApiKeyFlag(opts);
-    const { runEmitResult, EmitResultError } = await import('./emit-result-cmd-YOA5BJKL.js');
+    const { runEmitResult, EmitResultError } = await import('./emit-result-cmd-FDTUKGKE.js');
     try {
       const result = await runEmitResult({
         name,
@@ -4595,7 +4060,6 @@ function registerEmitCommands(program2) {
         bodyFile: opts.bodyFile,
         result: opts.result,
         item: opts.item,
-        artifact: opts.artifact,
         json: opts.json,
         url: opts.url,
         apiKey: opts.apiKey,
@@ -4610,12 +4074,12 @@ function registerEmitCommands(program2) {
       throw err;
     }
   });
-  emitCmd.command("artifact <file>").description("Emit a proof artifact: screenshot, recording, report, or log").requiredOption("--caption <text>", "what this artifact shows or proves").option("--for <criterion-id>", "id of the criterion this artifact proves (e.g. LOGIN-01)").option("--replaces <ids>", "artifact id(s) this one corrects; comma-separate 2-20 to retire them all").option("--pr <number>", "pull request number to anchor to").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "app id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
+  emitCmd.command("artifact <file>").description("Emit a proof artifact: screenshot, recording, report, or log").requiredOption("--caption <text>", "what this artifact shows or proves").option("--for <criterion-id>", "id of the criterion this artifact proves (e.g. LOGIN-01)").option("--replaces <ids>", "artifact id(s) this one corrects; comma-separate 2-20 to retire them all").option("--pr <number>", "pull request number to anchor to").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
     "after",
     '\n  outerlayer emit artifact shot.png --caption "the dot row, current dot marked" --for LOGIN-01\n\nInside a recorded Claude Code session the artifact spools locally and ships,\nbound to that session, on the next `outerlayer sync` \u2014 but only if that\nsession was launched with OUTERLAYER_WORK; without it nothing the session\nproduces may leave the machine, and the command refuses rather than queue an\nartifact that can never ship. Otherwise it uploads immediately, anchored to a\npull request (--pr, or CI\'s PR context) or to the current git checkout. With\nnothing to attach it to, the command refuses.\n\n--replaces: an already-uploaded target is marked superseded and hidden\neverywhere, bytes and deep link untouched; a still-queued one is cancelled\nlocally so it never uploads. One correction can retire several duplicates.\n'
   ).action(async (file, opts) => {
     warnIfApiKeyFlag(opts);
-    const { runEmitArtifact, EmitArtifactError } = await import('./emit-artifact-cmd-KPPD3YLO.js');
+    const { runEmitArtifact, EmitArtifactError } = await import('./emit-artifact-cmd-KTYW2TN2.js');
     let pr;
     if (opts.pr !== void 0) {
       pr = parseTrackerNumber(opts.pr);
@@ -4644,28 +4108,24 @@ function registerEmitCommands(program2) {
       throw err;
     }
   });
-  emitCmd.command("finding").description("Record one finding: what was found wrong about the change or about a rule").requiredOption("--id <id>", "client id \u2014 re-emitting the same id replaces it").requiredOption("--subject <change|context>", "what the finding is about").requiredOption("--title <text>", "one sentence").requiredOption("--file <path>", "the file in the diff, or the rule's own path").option("--line <number>", "line number in --file").option("--severity <blocker|major|minor|nit>", "how serious \u2014 omit for a context finding").requiredOption("--kind <behavior|hygiene|proof>", "what kind of thing this is about").requiredOption("--verdict <confirmed|refuted|unverified>", "what you concluded").option("--fixed", "a confirmed finding whose fix passed this round's check").option("--rule-path <path>", "the rule's own path \u2014 required with --rule-quote & --rule-relation").option("--rule-line <number>", "line number in --rule-path").option("--rule-quote <text>", "the rule's quoted sentence \u2014 required with --rule-path & --rule-relation").option("--rule-relation <broken|wrong|none>", "how this relates to the rule \u2014 required with --rule-path & --rule-quote").requiredOption("--source <implementer|reviewer|refuter|gate>", "which act recorded this").requiredOption("--where <label>", 'where this was recorded, e.g. "review pass 1"').option("--trace-id <id>", "the session's trace id, when there is one").option("--turn <number>", "turn index within the session").option("--round <number>", "review round number").option("--head-sha <sha>", "the commit this batch was recorded against").option("--context-source-sha <sha>", "the context-source commit this batch was recorded against").option("--item <number>", "work item to record on directly, by its number in this factory").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "app id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
+  emitCmd.command("finding").description("Record one finding: a problem you hit in the factory").requiredOption("--id <id>", "client id \u2014 re-emitting the same id replaces it").option("--category <context|flaky-test|tooling|environment|defect|other>", "what kind of problem this is").requiredOption("--title <text>", "one sentence").requiredOption("--file <path>", "the file the problem is in, or the instruction's own path").option("--line <number>", "line number in --file").option("--rule-path <path>", "the instruction's own path \u2014 required for a context finding").option("--rule-line <number>", "line number in --rule-path").option("--rule-quote <text>", "the instruction's quoted sentence \u2014 required unless --rule-relation is missing").option("--rule-relation <wrong|broken|missing>", "how the instruction fails \u2014 required for a context finding").requiredOption("--where <label>", 'where this was recorded, e.g. "build session"').option("--trace-id <id>", "the session's trace id, when there is one").option("--turn <number>", "turn index within the session").option("--round <number>", "round number, when there is one").addOption(new Option("--subject <value>").hideHelp()).addOption(new Option("--kind <value>").hideHelp()).addOption(new Option("--severity <value>").hideHelp()).addOption(new Option("--verdict <value>").hideHelp()).addOption(new Option("--fixed").hideHelp()).addOption(new Option("--source <value>").hideHelp()).option("--head-sha <sha>", "the commit this batch was recorded against").option("--context-source-sha <sha>", "the context-source commit this batch was recorded against").option("--item <number>", "work item to record on directly, by its number in this factory").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
     "after",
-    '\n  outerlayer emit finding --id r1-f1 --subject change --title "Off-by-one" \\\n    --file src/loop.ts --line 42 --severity major --kind behavior \\\n    --verdict confirmed --source reviewer --where "review pass 1"\n\nRecords one finding \u2014 what an agent noticed was wrong about the change, or\nabout a rule it ran on. Validated against the same contract the gateway\nchecks before anything is sent; a subject of context needs --rule-path,\n--rule-quote and --rule-relation together \u2014 all three are required, not\njust --rule-path.\n--item names the work item; without it, inside a recorded session, the\nitem that session was launched for is used automatically \u2014 a session may\nrecord findings on its own item, unlike `outerlayer emit <name>`.\n'
+    '\n  outerlayer emit finding --id gate-skip --category tooling \\\n    --title "The pre-push gate prints green when a step was skipped" \\\n    --file scripts/git/pre-push-checks.mjs --where "build session"\n\nRecords one problem you hit in the factory: an instruction that is wrong or\nmissing (context), a flaky test, a misbehaving script (tooling), a local\nsetup trap (environment), a bug outside your own change (defect), or\nanything else. A problem in your own change is fixed, not recorded.\nA context finding needs --rule-path and --rule-relation, and --rule-quote\nunless the relation is missing.\n--item names the work item; without it, inside a recorded session, the\nitem that session was launched for is used automatically.\n'
   ).action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runEmitFinding, EmitFindingError } = await import('./emit-finding-cmd-VR5VEGXJ.js');
+    const { runEmitFinding, refuseRemovedFindingFlags, EmitFindingError } = await import('./emit-finding-cmd-UR4ID45Z.js');
     try {
+      refuseRemovedFindingFlags(opts);
       const result = await runEmitFinding({
         id: opts.id,
-        subject: opts.subject,
+        category: opts.category,
         title: opts.title,
         file: opts.file,
         line: opts.line,
-        severity: opts.severity,
-        kind: opts.kind,
-        verdict: opts.verdict,
-        fixed: opts.fixed,
         rulePath: opts.rulePath,
         ruleLine: opts.ruleLine,
         ruleQuote: opts.ruleQuote,
         ruleRelation: opts.ruleRelation,
-        source: opts.source,
         where: opts.where,
         traceId: opts.traceId,
         turn: opts.turn,
@@ -4687,12 +4147,12 @@ function registerEmitCommands(program2) {
       throw err;
     }
   });
-  emitCmd.command("findings <file>").description("Record a batch of findings from a FindingBatch JSON file (- for standard input)").option("--item <number>", "work item to record on directly, by its number in this factory").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "app id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
+  emitCmd.command("findings <file>").description("Record a batch of findings from a FindingBatch JSON file (- for standard input)").option("--item <number>", "work item to record on directly, by its number in this factory").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
     "after",
     "\n  outerlayer emit findings review.json --item 412\n\nRecords a whole batch at once \u2014 a FindingBatch JSON file (schemaVersion,\noptional headSha / contextSourceSha, and 1-500 findings), validated against\nthe same contract `emit finding` uses before anything is sent. Re-emitting\nan id already on the item replaces that row rather than adding a second one.\n--item names the work item; without it, inside a recorded session, the item\nthat session was launched for is used automatically.\n"
   ).action(async (file, opts) => {
     warnIfApiKeyFlag(opts);
-    const { runEmitFindings, EmitFindingError } = await import('./emit-finding-cmd-VR5VEGXJ.js');
+    const { runEmitFindings, EmitFindingError } = await import('./emit-finding-cmd-UR4ID45Z.js');
     try {
       const result = await runEmitFindings({
         file,
@@ -4711,23 +4171,24 @@ function registerEmitCommands(program2) {
       throw err;
     }
   });
-  emitCmd.command("commit-credit").description("Attest that a commit belongs to a pull request").requiredOption("--sha <sha>", "full 40-character hex commit SHA").requiredOption("--pr <number>", "pull request number to anchor to").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "app id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
+  emitCmd.command("criteria <file>").description("Record a work item's acceptance criteria from a JSON file (- for stdin)").option("--item <number>", "work item to record on directly, by its number in this factory").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
     "after",
-    '\nThe escape hatch for a checkout, and reflog, that no longer exists. Records\none explicit human attestation, uploaded immediately \u2014 no session detection,\nno spool. The attesting identity is the dashboard member the control plane\nresolves from the API key; it renders as "attested by <name>" in the PR\nevidence comment, distinct from recorded or recovered credit. Refused, with\nnothing stored, for a malformed SHA, an unknown PR, or a machine key with no\nmember to attest as.\n'
-  ).action(async (opts) => {
+    '\n  outerlayer emit criteria criteria.json --item 412\n\nRecords the item\'s acceptance criteria as one list. The file is JSON:\n  { "criteria": [ { "id": "AC-1", "text": "Given ...", "proof": null },\n                  { "id": "login.redirect", "text": "...", "proof": "screenshot" } ] }\nAn id is 1-64 characters of A-Z a-z 0-9 . _ : - and is the id evidence is bound to with\n`emit artifact --for`. proof is video, screenshot, report, log, file or null (any bound\nartifact proves it). The list holds 1 to 200 criteria, each text at most 2,000\ncharacters, and no id twice. The list is validated before anything is sent.\nOnce an item has a list, only a person can replace it: run the command outside an\nagent session, with your own login. A key bound to no member cannot replace it either.\n--item names the work item; without it, inside a recorded session, the item that\nsession was launched for is used automatically.\n'
+  ).action(async (file, opts) => {
     warnIfApiKeyFlag(opts);
-    const { runEmitCommitCredit, EmitCommitCreditError } = await import('./emit-commit-credit-cmd-656BRAQ4.js');
+    const { runEmitCriteria, EmitCriteriaError } = await import('./emit-criteria-cmd-VAUUSAYD.js');
     try {
-      await runEmitCommitCredit({
-        sha: opts.sha,
-        pr: opts.pr,
+      const result = await runEmitCriteria({
+        file,
+        item: opts.item,
         json: opts.json,
         url: opts.url,
         apiKey: opts.apiKey,
         appId: opts.appId
       });
+      if (result.exitCode !== 0) process.exitCode = result.exitCode;
     } catch (err) {
-      if (err instanceof EmitCommitCreditError) {
+      if (err instanceof EmitCriteriaError) {
         fail(err.message);
         return;
       }
@@ -4736,15 +4197,15 @@ function registerEmitCommands(program2) {
   });
 }
 function registerWorkCommands(program2) {
-  const workCmd = program2.command("work").description("Add, remove, or read what the factory is working on (the Floor)");
-  workCmd.command("add").description("Record that a source is working on an issue or pull request").requiredOption("--issue <number>", "issue number").option("--repo <owner/name>", "repository (default: the current checkout's remote)").option("--note <text>", "a short note stored with the addition").option("--session-id <id>", "session id to record as-is, skipping detection (used by the SessionStart hook)").option("--retry <count>", "resend after a failure that may pass, with backoff").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "app id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
+  const workCmd = program2.command("work").description("Start, remove, or read what the factory is working on (the Work page)");
+  workCmd.command("build").description("Start work on an item: a host builds it, or with --local you do").option("--issue <number>", "issue number, or a Linear/Jira key like ENG-123 (adds it to Work first)").option("--tracker <linear|jira>", "tracker for a keyed --issue \u2014 required if more than one is connected").option("--item <number>", "the item's own number inside this factory \u2014 must already exist").option("--local", "you build it in a session you start; no host takes it").option("--repo <owner/name>", "repository \u2014 the checkout's remote for a number, never guessed for a key").option("--note <text>", "a short note stored with the request").option("--session-id <id>", "session id to record as-is, skipping detection").option("--retry <count>", "retries after a gateway answer worth trying again").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
     "after",
-    "\n  outerlayer work add --issue 42\n\nRecords that a named source \u2014 a recorded session, a CI run, or the API\nkey's bound member \u2014 is working on an issue or pull request. This is\nthe only way an item becomes visible on the Floor. A second add of the\nsame subject by the same source is a no-op.\n"
+    "\n  outerlayer work build --issue 42                       # a host builds it\n  outerlayer work build --item 7                         # retry an item already on Work\n  outerlayer work build --issue 42 --local               # you build it\n  outerlayer work build --issue ENG-123 --tracker linear # a Linear issue\n\nWithout --local, records a build request: a host takes the item when it\nhas a free slot. It never links the calling session and never takes a\nlease, even run from inside one.\n\nWith --local, puts the item on Work with no build request, so no host\ntakes it, and prints the line that starts your session on it. That\nsession links itself and holds the item's lease while it works.\n"
   ).action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkAdd, WorkCommandError } = await import('./work-cmd-ABP6XDBP.js');
+    const { runWorkBuild, WorkCommandError } = await import('./work-cmd-UOQO2AD4.js');
     try {
-      await runWorkAdd(opts);
+      await runWorkBuild(opts);
     } catch (err) {
       if (err instanceof WorkCommandError) {
         fail(err.message);
@@ -4753,14 +4214,14 @@ function registerWorkCommands(program2) {
       throw err;
     }
   });
-  workCmd.command("link-session").description("Link the calling session to a work item that already exists").argument("<number>", "the item's number inside this factory").option("--session-id <id>", "session id to record as-is, skipping detection (used by the SessionStart hook)").option("--retry <count>", "resend after a failure that may pass, with backoff").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "app id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
+  workCmd.command("link-session").description("Link the calling session to a work item that already exists").argument("<number>", "the item's number inside this factory").option("--session-id <id>", "session id to record as-is, skipping detection (used by the SessionStart hook)").option("--retry <count>", "resend after a failure that may pass, with backoff").option("--no-lease", "link only \u2014 ask for no session lease (used by a host's own job)").option("--ended", "release this session's lease instead of taking or renewing one").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
     "after",
-    "\n  outerlayer work link-session 42\n\nNames an item that already exists on the calling session \u2014 it never\ncreates one. Create an item first with `outerlayer work add`. Linking\nthe same session to the same item twice is a no-op.\n"
+    "\n  outerlayer work link-session 42\n\nNames an item that already exists on the calling session \u2014 it never\ncreates one. Create one with `outerlayer work build --local`. Linking\nthe same session to the same item twice is a no-op. Also takes or\nrenews that session's own 20-minute lease, unless --no-lease or\n--ended is given, or another worker already holds a live one.\n"
   ).action(async (number, opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkLinkSession, WorkCommandError } = await import('./work-cmd-ABP6XDBP.js');
+    const { runWorkLinkSession, WorkCommandError } = await import('./work-cmd-UOQO2AD4.js');
     try {
-      await runWorkLinkSession({ ...opts, number });
+      await runWorkLinkSession({ ...opts, number, noLease: opts.lease === false });
     } catch (err) {
       if (err instanceof WorkCommandError) {
         fail(err.message);
@@ -4769,18 +4230,61 @@ function registerWorkCommands(program2) {
       throw err;
     }
   });
-  workCmd.command("remove").description("Withdraw a source's addition \u2014 never deletes the item").option("--item <number>", "the item's number inside this factory").option("--issue <number>", "issue number (default: named by --item instead)").option("--repo <owner/name>", "repository (default: the current checkout's remote)").requiredOption("--reason <text>", "why this source is no longer working on it").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "app id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
+  workCmd.command("comment").description("Post a comment on a work item's general thread or one of its criterion threads").requiredOption("--item <number>", "the item's number inside this factory").option("--criterion <id>", "the criterion thread to post on (default: the general thread)").option("--body <text>", "the comment's text").option("--artifact <id>", "artifact id \u2014 required with --attach, naming the criterion's new proof").option("--pass", "record a pass (a person's verdict; refused from an agent session or a key)").option("--fail", "record a fail (a person's verdict; refused from an agent session or a key)").option("--attach", "make --artifact the named criterion's proof").option("--ready", "hand the thread back to a person (refused from a person)").option("--session-id <id>", "session id to record as-is, skipping detection (used by the SessionStart hook)").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
+    "after",
+    `
+  outerlayer work comment --item 7 --criterion AC-9-01 --body "fixed" --artifact 3f2a1c9d --attach
+
+Posts one comment. Omitting --criterion posts on the general thread;
+naming one posts on that criterion's own thread. --pass/--fail are a
+person's verdict on the whole item, so only on the general thread: the
+gateway refuses them with --criterion. --attach makes --artifact the
+criterion's new proof; --ready hands the thread back to a person. At
+most one action flag may be given.
+`
+  ).action(async (opts) => {
+    warnIfApiKeyFlag(opts);
+    const { runWorkComment, WorkCommentCommandError } = await import('./work-comment-cmd-WF3EOLAE.js');
+    const { WorkCommandError } = await import('./work-cmd-UOQO2AD4.js');
+    try {
+      await runWorkComment(opts);
+    } catch (err) {
+      if (err instanceof WorkCommentCommandError || err instanceof WorkCommandError) {
+        fail(err.message);
+        return;
+      }
+      throw err;
+    }
+  });
+  workCmd.command("threads").description("Read a work item's general thread and its criterion threads").requiredOption("--item <number>", "the item's number inside this factory").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
+    "after",
+    "\n  outerlayer work threads --item 7\n\nPrints the item's general thread, then one thread per acceptance\ncriterion that carries proof or a comment, each with who is waiting\non whom next.\n"
+  ).action(async (opts) => {
+    warnIfApiKeyFlag(opts);
+    const { runWorkThreads, WorkCommentCommandError } = await import('./work-comment-cmd-WF3EOLAE.js');
+    const { WorkCommandError } = await import('./work-cmd-UOQO2AD4.js');
+    try {
+      await runWorkThreads(opts);
+    } catch (err) {
+      if (err instanceof WorkCommentCommandError || err instanceof WorkCommandError) {
+        fail(err.message);
+        return;
+      }
+      throw err;
+    }
+  });
+  workCmd.command("remove").description("Withdraw a source's addition \u2014 never deletes the item").option("--item <number>", "the item's number inside this factory").option("--issue <number>", "issue number (default: named by --item instead)").option("--repo <owner/name>", "repository (default: the current checkout's remote)").requiredOption("--reason <text>", "why this source is no longer working on it").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
     "after",
     `
   outerlayer work remove --item 42 --reason "done"
 
 Withdraws the caller's own addition, recording the reason. Never
-deletes anything \u2014 the item is removed from the Floor only once no
+deletes anything \u2014 the item is removed from Work only once no
 live addition remains on it.
 `
   ).action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkRemove, WorkCommandError } = await import('./work-cmd-ABP6XDBP.js');
+    const { runWorkRemove, WorkCommandError } = await import('./work-cmd-UOQO2AD4.js');
     try {
       await runWorkRemove(opts);
     } catch (err) {
@@ -4791,9 +4295,9 @@ live addition remains on it.
       throw err;
     }
   });
-  workCmd.command("status").description("Show one item's stage, gate ledger, and additions").option("--item <number>", "the item's number inside this factory").option("--issue <number>", "issue number").option("--repo <owner/name>", "repository (default: the current checkout's remote)").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "app id the key is bound to (or OUTERLAYER_APP_ID / config)").action(async (opts) => {
+  workCmd.command("status").description("Show one item's stage, gate ledger, and additions").option("--item <number>", "the item's number inside this factory").option("--issue <number>", "issue number").option("--repo <owner/name>", "repository (default: the current checkout's remote)").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkStatus, WorkCommandError } = await import('./work-cmd-ABP6XDBP.js');
+    const { runWorkStatus, WorkCommandError } = await import('./work-cmd-UOQO2AD4.js');
     try {
       await runWorkStatus(opts);
     } catch (err) {
@@ -4804,9 +4308,9 @@ live addition remains on it.
       throw err;
     }
   });
-  workCmd.command("list").description("List live work items for this factory").option("--stage <spec|build|review>", "filter by stage").option("--section <attention|waiting|flowing>", "filter by Queue section").option("--repo <owner/name>", "repository (default: the current checkout's remote)").option("--unclaimed", "only items with no live claim").option("--startable", "only items with no live claim, linked session, or linked pull request").option("--needs <amend>", "only items an open artifact fail is waiting on").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "app id the key is bound to (or OUTERLAYER_APP_ID / config)").action(async (opts) => {
+  workCmd.command("list").description("List live work items for this factory").option("--stage <spec|build|review>", "filter by stage").option("--section <attention|waiting|flowing>", "filter by Queue section").option("--repo <owner/name>", "repository (default: the current checkout's remote)").option("--unclaimed", "only items with no live lease").option("--claimed", "only items with a live lease, held by a host or a local session").option("--startable", "only items with an unused build request and no live lease").option("--needs <amend>", "only items with a thread waiting on an agent").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkList, WorkCommandError } = await import('./work-cmd-ABP6XDBP.js');
+    const { runWorkList, WorkCommandError } = await import('./work-cmd-UOQO2AD4.js');
     try {
       await runWorkList(opts);
     } catch (err) {
@@ -4817,12 +4321,12 @@ live addition remains on it.
       throw err;
     }
   });
-  workCmd.command("claim").description("Claim a work item under this host's lease before working on it").option("--item <number>", "the item's number inside this factory").option("--issue <number>", "issue number (default: named by --item instead)").option("--repo <owner/name>", "repository (default: the current checkout's remote)").requiredOption("--kind <implement|amend>", "what this host is doing with the item").option("--host <name>", "the claiming host (default: this machine's hostname)").option("--seconds <n>", "lease length in seconds, clamped to 900 (default: 900)").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "app id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
+  workCmd.command("claim").description("Claim a work item under this host's lease before working on it").option("--item <number>", "the item's number inside this factory").option("--issue <number>", "issue number (default: named by --item instead)").option("--repo <owner/name>", "repository (default: the current checkout's remote)").requiredOption("--kind <implement|amend>", "what this host is doing with the item").option("--host <name>", "the claiming host (default: this machine's hostname)").option("--seconds <n>", "lease length in seconds, clamped to 900 (default: 900)").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
     "after",
     "\n  outerlayer work claim --item 42 --kind implement\n\nRecords a lease for this host. A live lease already held by a\ndifferent host is refused; claiming again under the same host extends\nit.\n"
   ).action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkClaim, WorkCommandError } = await import('./work-claim-cmd-HXB7K27H.js');
+    const { runWorkClaim, WorkCommandError } = await import('./work-claim-cmd-LSO2B2EX.js');
     try {
       await runWorkClaim(opts);
     } catch (err) {
@@ -4833,12 +4337,12 @@ live addition remains on it.
       throw err;
     }
   });
-  workCmd.command("renew").description("Extend this host's lease on a work item").option("--item <number>", "the item's number inside this factory").option("--issue <number>", "issue number (default: named by --item instead)").option("--repo <owner/name>", "repository (default: the current checkout's remote)").option("--host <name>", "the claiming host (default: this machine's hostname)").option("--seconds <n>", "lease length in seconds, clamped to 900 (default: 900)").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "app id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
+  workCmd.command("renew").description("Extend this host's lease on a work item").option("--item <number>", "the item's number inside this factory").option("--issue <number>", "issue number (default: named by --item instead)").option("--repo <owner/name>", "repository (default: the current checkout's remote)").option("--host <name>", "the claiming host (default: this machine's hostname)").option("--seconds <n>", "lease length in seconds, clamped to 900 (default: 900)").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
     "after",
     "\n  outerlayer work renew --item 42\n\nExtends this host's own live lease. Refused with a 410 if the lease\nhas expired, or a 403 if a different host holds it.\n"
   ).action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkRenew, WorkCommandError } = await import('./work-claim-cmd-HXB7K27H.js');
+    const { runWorkRenew, WorkCommandError } = await import('./work-claim-cmd-LSO2B2EX.js');
     try {
       await runWorkRenew(opts);
     } catch (err) {
@@ -4852,12 +4356,12 @@ live addition remains on it.
   workCmd.command("release").description("Release this host's lease on a work item").option("--item <number>", "the item's number inside this factory").option("--issue <number>", "issue number (default: named by --item instead)").option("--repo <owner/name>", "repository (default: the current checkout's remote)").option("--host <name>", "the claiming host (default: this machine's hostname)").option(
     "--outcome <ok|failed|timed_out|idle|lease_lost|interrupted|stopped>",
     "how the attempt ended (default: none)"
-  ).option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "app id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
+  ).option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
     "after",
     "\n  outerlayer work release --item 42 --outcome ok\n\nMarks this host's lease released, optionally with an outcome.\nReleasing an already-released lease is a no-op that returns the\nrecorded release time and outcome.\n"
   ).action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkRelease, WorkCommandError } = await import('./work-claim-cmd-HXB7K27H.js');
+    const { runWorkRelease, WorkCommandError } = await import('./work-claim-cmd-LSO2B2EX.js');
     try {
       await runWorkRelease(opts);
     } catch (err) {
@@ -4868,12 +4372,12 @@ live addition remains on it.
       throw err;
     }
   });
-  workCmd.command("pr <number>").description("Declare that a pull request belongs to the work item this session is on").option("--repo <owner/name>", "repository (default: the current checkout's remote)").option("--session-id <id>", "session id to record as-is, skipping detection").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "app id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
+  workCmd.command("pr <number>").description("Declare that a pull request belongs to the work item this session is on").option("--repo <owner/name>", "repository (default: the current checkout's remote)").option("--session-id <id>", "session id to record as-is, skipping detection").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
     "after",
     "\n  outerlayer work pr 481\n\nRun inside a session already on a work item. Records that pull\nrequest 481 in the checkout's repository belongs to that item \u2014 the\nsame fact a `pr-link` in the session's own transcript records on\nsync. Idempotent: declaring the same pull request twice is a no-op.\n"
   ).action(async (number, opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkPr, WorkPrCommandError } = await import('./work-pr-cmd-GOYSPEN2.js');
+    const { runWorkPr, WorkPrCommandError } = await import('./work-pr-cmd-6AN6RRQJ.js');
     try {
       await runWorkPr({ ...opts, number });
     } catch (err) {
@@ -4884,17 +4388,35 @@ live addition remains on it.
       throw err;
     }
   });
+  workCmd.command("open-pr").description("Open, or edit, the pull request for the work item this session is on").requiredOption("--title <title>", "the pull request's title").requiredOption("--body-file <path>", "a file holding the pull request's description").option("--repo <owner/name>", "repository, on the gh path (default: the current checkout's remote)").option("--session-id <id>", "session id to record as-is, on the gh path, skipping detection").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
+    "after",
+    '\n  outerlayer work open-pr --title "Add the thing" --body-file pr.md\n\nIn a host build, which holds an item key, the gateway opens the pull\nrequest as the factory\'s GitHub App, from the branch the claim named,\nor edits the one already open on that branch. No gh command runs.\nIn your own session it runs `gh pr create` (or `gh pr edit`) under your\nlogin, then declares the pull request on the item, as `work pr` does.\nRun it again after a change to the title or description.\n'
+  ).action(async (opts) => {
+    warnIfApiKeyFlag(opts);
+    const { runWorkOpenPr, WorkOpenPrCommandError } = await import('./work-open-pr-cmd-4SSQZMYG.js');
+    const { WorkCommandError } = await import('./work-cmd-UOQO2AD4.js');
+    try {
+      await runWorkOpenPr(opts);
+    } catch (err) {
+      if (err instanceof WorkOpenPrCommandError || err instanceof WorkCommandError) {
+        fail(err.message);
+        return;
+      }
+      throw err;
+    }
+  });
 }
 function registerRunnerCommands(program2) {
   const runnerCmd = program2.command("runner").description("Take work from the implement and amend queues on this machine");
   const configOption = "the cloud config file to run against (default: ~/.outerlayer/config.json)";
   runnerCmd.command("start").description("Run the loop: claim work, run it, report, clean up, repeat").option("--config <path>", configOption).action(async (opts) => {
-    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-POF7DEQW.js');
-    const { start, RunnerStartError } = await import('./loop-BWE2BS6J.js');
-    const { RunnerAlreadyRunningError } = await import('./pidfile-PTW76F56.js');
+    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-XVJYZ4IQ.js');
+    const { start, RunnerStartError } = await import('./loop-VZOLL4WQ.js');
+    const { RunnerAlreadyRunningError } = await import('./pidfile-UZRH774M.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     try {
-      await start(configPath, { fetchImpl: fetch });
+      const { realUpdateDeps } = await import('./real-deps-SU24ZA2K.js');
+      await start(configPath, { update: realUpdateDeps(), fetchImpl: fetch });
     } catch (err) {
       if (err instanceof RunnerConfigError || err instanceof RunnerAlreadyRunningError || err instanceof RunnerStartError) {
         fail(err.message);
@@ -4904,89 +4426,214 @@ function registerRunnerCommands(program2) {
     }
   });
   runnerCmd.command("check").description("Validate the config, the hooks and the key, and print the effective settings").option("--config <path>", configOption).action(async (opts) => {
-    const { defaultRunnerConfigPath, loadRunnerConfig, checkHooks: checkHooks2, RunnerConfigError } = await import('./config-POF7DEQW.js');
-    const { probeCredentials } = await import('./loop-BWE2BS6J.js');
+    const { defaultRunnerConfigPath } = await import('./config-XVJYZ4IQ.js');
+    const { runRunnerCheck } = await import('./check-WQP2CZDW.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
-    let config;
-    try {
-      config = loadRunnerConfig(configPath);
-    } catch (err) {
-      fail(err instanceof RunnerConfigError ? err.message : String(err));
-      return;
-    }
-    const hookProblem = checkHooks2(config);
-    if (hookProblem) {
-      fail(`${configPath}: ${hookProblem}`);
-      return;
-    }
-    const probe = await probeCredentials(config);
-    if (!probe.ok && probe.fatal) {
-      fail(probe.reason);
+    const result = await runRunnerCheck(configPath);
+    if (!result.ok) {
+      fail(result.message);
       return;
     }
     process.stdout.write(
-      probe.ok ? `${C.green}\u2713${C.reset} credentials ok \xB7 ${config.url} \xB7 app ${config.appId}
-` : `${C.yellow}!${C.reset} credentials unverified \xB7 ${config.url} \xB7 app ${config.appId} \xB7 ${probe.reason}
+      result.unverifiedReason === void 0 ? `${C.green}\u2713${C.reset} credentials ok \xB7 ${result.summary}
+` : `${C.yellow}!${C.reset} credentials unverified \xB7 ${result.summary} \xB7 ${result.unverifiedReason}
 `
     );
-    const lines = [
-      `config              ${configPath}`,
-      `host                ${config.host}`,
-      `queues              ${config.queues.join(", ")}`,
-      `concurrency         ${config.concurrency}`,
-      `poll                ${config.pollSeconds}s`,
-      `time limit          ${config.timeLimitMinutes}m`,
-      `idle limit          ${config.idleLimitMinutes}m`,
-      ...config.queues.map((queue) => `command ${queue.padEnd(11)} ${config.commands[queue] ?? "(none)"}`),
-      `hook provision      ${config.hooks.provision}`,
-      `hook cleanup        ${config.hooks.cleanup}`,
-      `hook report         ${config.hooks.report ?? "(none)"}`,
-      `repos include       ${config.repos?.include?.join(", ") ?? "(all)"}`,
-      `repos exclude       ${config.repos?.exclude?.join(", ") ?? "(none)"}`
-    ];
-    process.stdout.write(`${lines.join("\n")}
+    process.stdout.write(`${result.lines.join("\n")}
 `);
   });
-  runnerCmd.command("init").description("Write a runner block and example hooks into the config file").option("--config <path>", configOption).action(async (opts) => {
-    const { defaultRunnerConfigPath } = await import('./config-POF7DEQW.js');
-    const { runRunnerInit, RunnerInitError } = await import('./init-PTBITAUO.js');
+  runnerCmd.command("install").description("Put this CLI into the runner's install layout, so the runner can update itself").option("--config <path>", configOption).action(async (opts) => {
+    const { defaultRunnerConfigPath } = await import('./config-XVJYZ4IQ.js');
+    const { runRunnerInstall, RunnerInstallError } = await import('./install-cmd-7WXOIFDO.js');
+    const configPath = opts.config ?? defaultRunnerConfigPath();
+    try {
+      const result = runRunnerInstall({ configPath, entryPath: process.argv[1] ?? "", nodePath: process.execPath });
+      process.stdout.write(`${C.green}\u2713${C.reset} installed ${result.version} for the runner; \`current\` names it
+`);
+      process.stdout.write(
+        `
+Start the runner from the install layout by putting this line in the service unit, then restart the service:
+  ${C.yellow}${result.execStart}${C.reset}
+`
+      );
+    } catch (err) {
+      if (err instanceof RunnerInstallError) {
+        fail(err.message);
+        return;
+      }
+      throw err;
+    }
+  });
+  runnerCmd.command("init").description("Write a runner block that fits this machine; on macOS, offers a Linux VM").option("--config <path>", configOption).option("--vm", "on macOS, run the runner in a Linux VM (Lima), with container builds").option("--no-vm", "on macOS, skip the VM and run builds as unisolated processes").option("--allow-process-builds", "where builds cannot be isolated, run them as processes anyway").addOption(new Option("--config-stdin", "the VM-side hand-off: read the whole config as JSON on stdin").hideHelp()).addOption(new Option("--vm-cli-package <path>", "install this packed CLI tarball in the VM instead of the published version").hideHelp()).action(async (opts) => {
+    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-XVJYZ4IQ.js');
+    const { runRunnerInit, RunnerInitError } = await import('./init-DXBCOAJK.js');
+    const { detectMachine } = await import('./machine-WSG52J75.js');
+    const { chooseVm, runVmInit, VmInitError } = await import('./init-YEXK35CF.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     try {
-      const result = runRunnerInit(configPath);
+      const machine = detectMachine();
+      if (opts.configStdin === true) {
+        const chunks = [];
+        for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
+        const result2 = runRunnerInit(configPath, { machine, configFromStdin: Buffer.concat(chunks).toString("utf8"), requireContainer: true });
+        const { ensureHostKey: ensureHostKey2 } = await import('./host-key-KDYZ5ECC.js');
+        const hostKey2 = await ensureHostKey2(configPath);
+        process.stdout.write(`host key ${hostKey2.fingerprint}
+hooks: ${result2.hooks}
+`);
+        return;
+      }
+      let declinedVm = opts.vm === false;
+      const useVm = await chooseVm({
+        platform: machine.platform,
+        flag: opts.vm,
+        isTTY: process.stdin.isTTY === true,
+        ask: async () => {
+          const rl = createInterface({ input: process.stdin, output: process.stdout });
+          const answer = await rl.question(
+            "Run the runner in a Linux VM, so builds are isolated in containers? It needs Lima (brew install lima). Answer no to run builds as processes under your user, without isolation. [Y/n] "
+          );
+          rl.close();
+          const yes = answer.trim() === "" || /^y(es)?$/i.test(answer.trim());
+          declinedVm = !yes;
+          return yes;
+        }
+      });
+      if (useVm) {
+        const { realLima } = await import('./lima-XN65D7GN.js');
+        const { cpus, totalmem } = await import('os');
+        const { resolvePackageVersion } = await import('./version-BWM6VLDI.js');
+        const result2 = await runVmInit(configPath, {
+          lima: realLima(),
+          home: homeFromEnv(),
+          hostCpus: cpus().length,
+          hostMemoryBytes: totalmem(),
+          version: resolvePackageVersion(),
+          cliPackage: opts.vmCliPackage,
+          progress: (line) => process.stdout.write(`${line}
+`)
+        });
+        for (const line of result2.lines) process.stdout.write(`${C.green}\u2713${C.reset} ${line}
+`);
+        return;
+      }
+      const allowProcess = opts.allowProcessBuilds === true || machine.platform === "darwin" && declinedVm;
+      const result = runRunnerInit(configPath, { machine, allowProcess });
+      const { ensureHostKey } = await import('./host-key-KDYZ5ECC.js');
+      const hostKey = await ensureHostKey(configPath);
       process.stdout.write(`${C.green}\u2713${C.reset} wrote a runner block into ${result.configPath}
 `);
-      for (const hook of result.hooks) {
-        process.stdout.write(`${C.green}\u2713${C.reset} wrote ${hook}
+      process.stdout.write(
+        `${C.green}\u2713${C.reset} host key ${hostKey.fingerprint}: the runner key binds to it on its first claim
+`
+      );
+      process.stdout.write(`${C.green}\u2713${C.reset} hooks: ${result.hooks}${result.hooks === "builtin:vm" ? " (builds run in microVMs)" : result.hooks === "builtin:container" ? " (builds run in containers)" : " (builds run as processes)"}
+`);
+      if (result.note !== void 0) process.stdout.write(`
+${C.yellow}${result.note}${C.reset}
+`);
+      if (machine.platform === "darwin" && opts.vm === void 0) {
+        process.stdout.write(`
+To isolate builds in containers instead, run ${C.yellow}outerlayer runner init --vm${C.reset}.
+`);
+      }
+      const { runRunnerInstall, RunnerInstallError } = await import('./install-cmd-7WXOIFDO.js');
+      let execStart;
+      try {
+        const installed = runRunnerInstall({ configPath, entryPath: process.argv[1] ?? "", nodePath: process.execPath });
+        execStart = installed.execStart;
+        process.stdout.write(`${C.green}\u2713${C.reset} installed ${installed.version} for the runner, so it can update itself
+`);
+      } catch (installErr) {
+        if (!(installErr instanceof RunnerInstallError)) throw installErr;
+        process.stdout.write(`
+${C.yellow}The runner will not update itself: ${installErr.message}${C.reset}
 `);
       }
       process.stdout.write(
         `
 Next:
   1. Edit the command lines in ${result.configPath} to start your agent.
-  2. Edit the hooks in ${result.hooksDir} to make and remove a workspace.
-  3. ${C.yellow}outerlayer runner check${C.reset}
-  4. ${C.yellow}outerlayer runner start${C.reset}
-`
+  2. ${C.yellow}outerlayer runner check${C.reset}
+  3. ${C.yellow}outerlayer runner start${C.reset}
+` + (execStart === void 0 ? "" : `  To run it as a service that updates itself, start it with this line in the unit:
+     ${C.yellow}${execStart}${C.reset}
+`)
       );
     } catch (err) {
-      if (err instanceof RunnerInitError) {
+      if (err instanceof RunnerInitError || err instanceof VmInitError || err instanceof RunnerConfigError) {
         fail(err.message);
         return;
       }
       throw err;
     }
   });
+  runnerCmd.command("image").description("Build a repository's image from its default branch's devcontainer file").requiredOption("--repository <owner/name>", "the repository to build the image for").option("--remote <url>", "where to fetch from (default: the repository's GitHub URL)").option("--config <path>", configOption).option("--json", "machine-readable JSON output").addHelpText(
+    "after",
+    "\nFetches the head of the default branch into the runner's cache, reads its\n.devcontainer/devcontainer.json, and builds the image with the devcontainer CLI. Settings\nthat reach the host or widen the container's privileges are ignored and listed. The\nimage holds this CLI and a pinned Claude Code. Nothing runs inside the image.\n"
+  ).action(async (opts) => {
+    const { defaultRunnerConfigPath } = await import('./config-XVJYZ4IQ.js');
+    const { buildRepositoryImage, RecipeError } = await import('./build-TZUUTRGH.js');
+    const { currentCliBuild } = await import('./cli-build-K56DK4DS.js');
+    const { createDockerHost } = await import('./docker-NEGDLU6D.js');
+    try {
+      const result = await buildRepositoryImage(
+        {
+          repository: opts.repository,
+          remote: opts.remote,
+          configPath: opts.config ?? defaultRunnerConfigPath(),
+          cli: currentCliBuild()
+        },
+        { host: createDockerHost() }
+      );
+      if (opts.json) {
+        writeJson(result);
+        return;
+      }
+      const { report } = result;
+      const what = result.reused ? "reused" : result.toolsBuilt && !result.recipeBuilt ? "rebuilt the tools layer of" : "built";
+      process.stdout.write(`${C.green}\u2713${C.reset} ${what} ${report.tag}
+`);
+      process.stdout.write(`  recipe:  ${report.recipe} at ${report.sourceCommit.slice(0, 12)} on ${report.defaultBranch}
+`);
+      if (result.checkedCommit !== report.sourceCommit) {
+        process.stdout.write(`  checked: ${result.checkedCommit.slice(0, 12)}, the recipe has not changed since
+`);
+      }
+      process.stdout.write(`  record:  ${result.recordDir}
+`);
+      if (report.ignored.length > 0) {
+        process.stdout.write(`  ignored:
+`);
+        for (const { property, source } of report.ignored) process.stdout.write(`    ${property} (from ${source})
+`);
+      }
+      if (result.removed.length > 0) process.stdout.write(`  pruned ${result.removed.length} older image(s)
+`);
+    } catch (err) {
+      if (err instanceof RecipeError) {
+        if (opts.json) {
+          writeJson({ error: { code: err.code, message: err.message, ...err.logPath ? { logPath: err.logPath } : {} } });
+          process.exitCode = 1;
+          return;
+        }
+        fail(`${err.code}: ${err.message}`);
+        return;
+      }
+      throw err;
+    }
+  });
   runnerCmd.command("stop").description("Take no more work; wait for running jobs to finish, then exit").option("--config <path>", "the cloud config file naming the runner to stop").option("--now", "end running jobs immediately, with outcome stopped").action(async (opts) => {
-    const { defaultRunnerConfigPath } = await import('./config-POF7DEQW.js');
-    const { requestStop } = await import('./loop-BWE2BS6J.js');
+    const { defaultRunnerConfigPath } = await import('./config-XVJYZ4IQ.js');
+    const { requestStop } = await import('./loop-VZOLL4WQ.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     await requestStop(configPath, Boolean(opts.now));
   });
   runnerCmd.command("status").description("List running jobs; with --recent, finished ones too").option("--config <path>", "the cloud config file naming the runner to inspect").option("--recent", "also list finished jobs, newest first, capped at 20").option("--json", "machine-readable JSON output").action(async (opts) => {
-    const { defaultRunnerConfigPath, loadRunnerConfig } = await import('./config-POF7DEQW.js');
-    const { jobsDir } = await import('./paths-D2VGWWFI.js');
-    const { listJobFiles, runnerProcessState } = await import('./loop-BWE2BS6J.js');
-    const { renderStatus } = await import('./status-JHVSZYC5.js');
+    const { defaultRunnerConfigPath, loadRunnerConfig } = await import('./config-XVJYZ4IQ.js');
+    const { jobsDir } = await import('./paths-OYKMVYJP.js');
+    const { listJobFiles, runnerProcessState } = await import('./loop-VZOLL4WQ.js');
+    const { renderStatus } = await import('./status-2UZKKNB7.js');
     const path2 = await import('path');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const all = listJobFiles(configPath);
@@ -5005,7 +4652,7 @@ Next:
         configPath,
         process: processState,
         concurrency,
-        jobs: all.map(({ dirName, job }) => ({ ...job, jobDir: path2.join(jobsDir(configPath), dirName) }))
+        jobs: all.map(({ dirName, job }) => ({ ...withoutItemKey(job), jobDir: path2.join(jobsDir(configPath), dirName) }))
       });
       return;
     }
@@ -5023,9 +4670,9 @@ Next:
     );
   });
   runnerCmd.command("logs").argument("<item>", "the work item's number in the factory").description("Print the newest attempt's log for one item").option("--config <path>", "the cloud config file naming the runner to inspect").option("-f, --follow", "keep printing as the log grows").action(async (itemArg, opts) => {
-    const { defaultRunnerConfigPath } = await import('./config-POF7DEQW.js');
-    const { listJobFiles } = await import('./loop-BWE2BS6J.js');
-    const { newestAttempt, logPathFor, tail, RunnerLogsError } = await import('./logs-TRNPQM42.js');
+    const { defaultRunnerConfigPath } = await import('./config-XVJYZ4IQ.js');
+    const { listJobFiles } = await import('./loop-VZOLL4WQ.js');
+    const { newestAttempt, logPathFor, tail, RunnerLogsError } = await import('./logs-7RYUH5A6.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const item = parseTrackerNumber(itemArg);
     if (item === void 0) {
@@ -5059,9 +4706,9 @@ function registerHooksCommands(program2) {
     "after",
     "\n`init` auto-wraps PreToolUse/PostToolUse hooks; these subcommands cover the\nrest: manual re-scans, other events, and undo.\n"
   );
-  hooksCmd.command("install-git").description("Install the rewrite-journal and commit-guard git hooks in this repo").option("--print", "print the hook scripts instead of installing").addHelpText(
+  hooksCmd.command("install-git").description("Install the commit-guard git hook in this repo").option("--print", "print the hook scripts instead of installing").addHelpText(
     "after",
-    "\nThe same install `init` performs. `--print` writes the scripts to stdout for\nrepositories that manage hooks in-tree (husky and friends).\n"
+    "\nThe same install `init` performs. `--print` writes the script to stdout for\nrepositories that manage hooks in-tree (husky and friends).\n"
   ).action((opts) => {
     if (opts.print) {
       for (const [name, script] of managedHookScripts()) {
@@ -5071,38 +4718,17 @@ ${script}
       }
       return;
     }
-    const { status, path: path2 } = installPostRewriteHook(process.cwd(), {
-      stampTrailers: readCloudConfig().gitHooks?.stampTrailers !== false
-    });
-    switch (status) {
-      case "installed":
-      case "updated":
-      case "unchanged":
-        process.stdout.write(`${C.green}\u2713${C.reset} post-rewrite journal hook ${status} \u2192 ${path2}
+    const removal = removeJournalHooks(process.cwd());
+    if (removal.removed) {
+      process.stdout.write(`${C.green}\u2713${C.reset} removed the commit journal hooks an earlier version installed \u2192 ${removal.path}
 `);
-        break;
-      case "skipped-foreign":
-        process.stdout.write(
-          `${C.yellow}!${C.reset} a post-rewrite hook we did not write already exists (${path2}) \u2014 left untouched.
-  Append the journal script yourself: ${C.yellow}outerlayer hooks install-git --print${C.reset}
-`
-        );
-        process.exitCode = 1;
-        break;
-      case "skipped-custom-hooks-path":
-        process.stdout.write(
-          `${C.yellow}!${C.reset} this repo manages hooks in its working tree (core.hooksPath) \u2014 nothing written.
-  Add the script to your hook manager instead: ${C.yellow}outerlayer hooks install-git --print${C.reset}
-`
-        );
-        process.exitCode = 1;
-        break;
-      case "not-a-repo":
-        fail("not inside a git repository.");
-        break;
     }
     const guard = installPreCommitGuardHook(process.cwd());
     const report = formatGuardInstallOutput(guard);
+    if (report.error !== void 0) {
+      fail(report.error);
+      return;
+    }
     for (const line of report.lines) process.stdout.write(`${line}
 `);
     if (report.exitCode !== void 0) process.exitCode = report.exitCode;
@@ -5265,11 +4891,11 @@ ${C.dim}${file.path}${C.reset}
 }
 function registerMcpCommands(program2) {
   const mcpCmd = program2.command("mcp").description("Configure MCP clients against the OuterLayer gateway");
-  mcpCmd.command("install").description("Write or update the OuterLayer entry in .mcp.json").option("--transport <stdio|http>", "how the client connects (default: stdio)").option("--command <exe>", "stdio only: executable the client spawns (default: outerlayer)").option("--url <url>", "gateway MCP endpoint (defaults to the gateway you logged in to)").option("--name <name>", 'mcpServers key to write under (default: "outerlayer")').option("--dir <path>", "repo root to write into (default: cwd)").option("--app-id <uuid>", "self-host only: app id sent as X-Outerlayer-App-Id").option("--json", "machine-readable JSON output").addHelpText(
+  mcpCmd.command("install").description("Write or update the OuterLayer entry in .mcp.json").option("--transport <stdio|http>", "how the client connects (default: stdio)").option("--command <exe>", "stdio only: executable the client spawns (default: outerlayer)").option("--url <url>", "gateway MCP endpoint (defaults to the gateway you logged in to)").option("--name <name>", 'mcpServers key to write under (default: "outerlayer")').option("--dir <path>", "repo root to write into (default: cwd)").option("--app-id <uuid>", "self-host only: factory id sent as X-Outerlayer-App-Id").option("--json", "machine-readable JSON output").addHelpText(
     "after",
     "\nThe API key is never a flag and never written to .mcp.json as a literal value.\n  stdio (default): the client spawns `outerlayer mcp serve`, which reads the key\n  from ~/.outerlayer/config.json (or OUTERLAYER_API_KEY) on every connect, so a\n  rotated key is picked up without rewriting the entry.\n  http: the entry carries the ${OUTERLAYER_API_KEY} placeholder, which the client\n  resolves from the environment it was launched with.\n\n--command: use an absolute or ${HOME}-relative path when the CLI is not on PATH.\n--url: with stdio the endpoint resolves from OUTERLAYER_URL / the config file at\nconnect time; for self-host pass your gateway-node origin + /v1/mcp.\nSelf-host deployments also need --app-id: without a key service to resolve the\ncaller from the bearer token, the gateway answers 401 without that header.\n"
   ).action(async (opts) => {
-    const { runMcpInstall, handleMcpInstallError, McpInstallError } = await import('./mcp-install-cmd-FDQH6SEN.js');
+    const { runMcpInstall, handleMcpInstallError, McpInstallError } = await import('./mcp-install-cmd-RLK4SO3N.js');
     try {
       if (opts.transport !== void 0 && opts.transport !== "stdio" && opts.transport !== "http") {
         throw new McpInstallError(`--transport must be "stdio" or "http", got "${opts.transport}"`);
@@ -5287,11 +4913,11 @@ function registerMcpCommands(program2) {
       handleMcpInstallError(err);
     }
   });
-  mcpCmd.command("serve").description("Run a stdio MCP server that bridges to the OuterLayer gateway").option("--url <url>", "gateway MCP endpoint (default: OUTERLAYER_URL or config + /v1/mcp)").option("--app-id <uuid>", "app id sent as X-Outerlayer-App-Id (default: config)").addHelpText(
+  mcpCmd.command("serve").description("Run a stdio MCP server that bridges to the OuterLayer gateway").option("--url <url>", "gateway MCP endpoint (default: OUTERLAYER_URL or config + /v1/mcp)").option("--app-id <uuid>", "factory id sent as X-Outerlayer-App-Id (default: config)").addHelpText(
     "after",
     "\nWhat the stdio .mcp.json entry spawns. Reads newline-delimited JSON-RPC 2.0 on\nstdin and writes responses on stdout. The API key comes from OUTERLAYER_API_KEY\nor ~/.outerlayer/config.json at start-up; with neither the command exits 1 and\nprints why, which the MCP client shows as the connect error.\n"
   ).action(async (opts) => {
-    const { runMcpServe, handleMcpServeError } = await import('./mcp-serve-cmd-57EZZOTL.js');
+    const { runMcpServe, handleMcpServeError } = await import('./mcp-serve-cmd-JPTP5FMS.js');
     try {
       await runMcpServe({ url: opts.url, appId: opts.appId });
     } catch (err) {
@@ -5302,7 +4928,7 @@ function registerMcpCommands(program2) {
 function registerImportCommands(program2) {
   const importCmd = program2.command("import").description("Import an existing config format into .outerlayer/");
   importCmd.command("ruler").description("Port a .ruler/ tree into the equivalent .outerlayer/ tree").option("--dir <path>", "repo root to read from (default: cwd)").option("--json", "machine-readable JSON output").addHelpText("after", "\nRuler: https://github.com/intellectronica/ruler. Mostly a rename.\n").action(async (opts) => {
-    const { runImportRuler, ImportRulerError } = await import('./import-ruler-cmd-7LH2QOMG.js');
+    const { runImportRuler, ImportRulerError } = await import('./import-ruler-cmd-GUHL6IY5.js');
     try {
       const result = runImportRuler({ cwd: opts.dir, json: opts.json });
       if (result.exitCode !== 0) process.exitCode = result.exitCode;
@@ -5314,11 +4940,11 @@ function registerImportCommands(program2) {
       throw err;
     }
   });
-  importCmd.command("capture").description("Install the evidence capture pack into .outerlayer/").option("--dir <path>", "repo root to write into (default: cwd)").option("--json", "machine-readable JSON output").addHelpText(
+  importCmd.command("capture").description("Install the maintained skills into .outerlayer/").option("--dir <path>", "repo root to write into (default: cwd)").option("--json", "machine-readable JSON output").addHelpText(
     "after",
-    "\nThe emitting-evidence skill plus an AGENTS.md snippet teaching agents to run\n`emit artifact`.\n"
+    "\nInstalls the three maintained skills (emitting-evidence, amend,\nreporting-findings) and an AGENTS.md snippet teaching agents to run\n`emit artifact`. A skill that differs from this CLI's bundle is rewritten to it, and the output says so.\n"
   ).action(async (opts) => {
-    const { runImportCapture, ImportCaptureError } = await import('./import-capture-cmd-EUMBGIV3.js');
+    const { runImportCapture, ImportCaptureError } = await import('./import-capture-cmd-AVZ4VIVJ.js');
     try {
       runImportCapture({ cwd: opts.dir, json: opts.json });
     } catch (err) {
@@ -5356,15 +4982,21 @@ function registerContextCommands(program2) {
   const contextCmd = program2.command("context").description("Compile and materialize agent context");
   contextCmd.command("emit").description("Compile .outerlayer/ into each configured target tool's native files").option("--check", "compare against disk, write nothing, exit 1 on drift (CI mode)").option("--dir <path>", "repo root to read from (default: cwd)").option("--json", "machine-readable JSON output").addHelpText(
     "after",
-    '\nTargets come from .outerlayer/config.json only; there is no --target flag.\nMissing or empty config: {"targets": [...]}, e.g. {"targets": ["claude-code"]}.\nKnown targets: claude-code, cursor, codex, copilot, factory.\n\nOrphan detection (--check) only covers header-carrying outputs: every markdown\ntarget file gets a generated-by comment, but .mcp.json and .cursor/mcp.json are\nJSON with no comment syntax, so they can never be flagged as orphaned; missing\nand content drift still apply to them.\n'
+    '\nTargets come from .outerlayer/config.json only; there is no --target flag.\nMissing or empty config: {"targets": [...]}, e.g. {"targets": ["claude-code"]}.\nKnown targets: claude-code, cursor, codex, copilot, factory.\n\nThe maintained skills (emitting-evidence, amend, reporting-findings)\nfollow this CLI: emit rewrites one that differs from its bundle, and --check reports it as\ndrift. Templates (spec, writing-specs, build) are never rewritten or reported.\n\nOrphan detection (--check) only covers header-carrying outputs: every markdown\ntarget file gets a generated-by comment, but .mcp.json and .cursor/mcp.json are\nJSON with no comment syntax, so they can never be flagged as orphaned; missing\nand content drift still apply to them.\n'
   ).action(async (opts) => {
     await compileContext({ dir: opts.dir, check: opts.check, json: opts.json });
   });
+  contextCmd.command("adopt <stagedDir>", { hidden: true }).description("Copy context the runner staged into this checkout (container builds)").option("--json", "machine-readable JSON output").action(async (stagedDir) => {
+    const { runContextAdopt } = await import('./context-adopt-UMA4O5NY.js');
+    const { exitCode, stdout } = runContextAdopt(stagedDir, process.cwd());
+    process.stdout.write(stdout);
+    process.exitCode = exitCode;
+  });
   contextCmd.command("materialize").description("Materialize this repository's governed context from its control plane").option("--json", "machine-readable JSON output").addHelpText(
     "after",
     "\nThe same flow SessionStart runs automatically, exposed for a manual retry or a\nfirst check outside a session. Writes AGENTS.md, .claude/**, and .outerlayer/**.\n"
   ).action(async (opts) => {
-    const { materializeContext } = await import('./context-materialize-J6CRQ7O7.js');
+    const { materializeContext } = await import('./context-materialize-G2FUFC72.js');
     const result = await materializeContext({ cwd: process.cwd(), sessionId: `manual-${Date.now()}` });
     const output = formatContextMaterializeOutput(result);
     if (output.exitCode !== void 0) process.exitCode = output.exitCode;