@outerlayer/cli 0.10.1 → 0.10.2

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @outerlayer/cli
 
+## 0.10.2
+
+### Patch Changes
+
+- 4e309ad: `outerlayer init` now also adds the OuterLayer docs MCP server, `outerlayer-docs` at `https://docs.outerlayer.ai/mcp`, beside the `outerlayer` one, so your coding agent can look up how OuterLayer works. It goes into the same file, `.mcp.json` or `.outerlayer/mcp.json`, and an entry of that name already there is left as it is. `outerlayer mcp install` is unchanged.
+- a1b7ec0: `outerlayer work list --startable` help now says what makes an item startable: a build request, no open pull request, and no live lease. An item with an open pull request is no longer offered to the implement queue. `outerlayer work build --item <n>` on such an item reruns the amend when a review waits on an agent, and is otherwise refused with `nothing_to_rerun`.
+- 854a747: A runner now updates itself to a release that has no npm provenance attestation. The tarball must still match the registry's digest and pass `npm audit signatures`. An attestation that is present must still name this repository's release workflow and cover the same tarball, and one that cannot be read refuses the release.
+
 ## 0.10.1
 
 ### Patch Changes

package/dist/{agent-setup-ODTDC3US.js → agent-setup-YEFN74Y4.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { addStdioMcpEntryIfAbsent } from './chunk-47RS42OZ.js';
+import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME } from './chunk-A56PYPDF.js';
 import { installStarterPack } from './chunk-SUMWRA7K.js';
 import { runEmit } from './chunk-YU5GL7QS.js';
 import { C } from './chunk-YRYMNBGQ.js';
@@ -119,6 +119,9 @@ function runAgentSetup(opts) {
     const mcp = addStdioMcpEntryIfAbsent(repoRoot);
     if (mcp.added) written.add(mcp.path);
     else kept.push(`${mcp.path} (already has an outerlayer server)`);
+    const docs = addDocsMcpEntryIfAbsent(repoRoot);
+    if (docs.added) written.add(docs.path);
+    else kept.push(`${docs.path} (already has an ${DOCS_MCP_SERVER_NAME} server)`);
   } catch (err) {
     problems.push(errorMessage(err));
   }
@@ -186,9 +189,9 @@ function renderPaths(paths, kept) {
 `;
 }
 function renderDone(paths, kept, mcpKept) {
-  const mcpNote = mcpKept ? `  ${C.yellow}!${C.reset} The outerlayer entry was not added to .mcp.json, so its MCP server is not set up. Add it to .mcp.json by hand, or move the servers you wrote into .outerlayer/mcp.json and run \`outerlayer context emit\`.
+  const mcpNote = mcpKept ? `  ${C.yellow}!${C.reset} The outerlayer and ${DOCS_MCP_SERVER_NAME} entries were not added to .mcp.json, so their MCP servers are not set up. Add them to .mcp.json by hand, or move the servers you wrote into .outerlayer/mcp.json and run \`outerlayer context emit\`.
 ` : "";
-  const what = mcpKept ? "the OuterLayer skills" : "the OuterLayer skills and MCP server";
+  const what = mcpKept ? "the OuterLayer skills" : "the OuterLayer skills and MCP servers";
   if (paths.length === 0) {
     return `${C.green}\u2713${C.reset} Agent setup: already in place, nothing changed
 ${renderPaths(paths, kept)}${mcpNote}`;

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-07T13:16:15.617Z+e27c8d7","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-07T19:14:32.738Z+adc613b","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{check-RBRRI77E.js → check-NQYQHITZ.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-4AVAETSU.js';
+import { probeCredentials } from './chunk-ERHJETKP.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-I2UOAV7X.js';
-import './chunk-ABIWDUMS.js';
+import './chunk-YETTWTAY.js';
 import './chunk-KZ5M4QOB.js';
 import './chunk-T6OIJQRT.js';
 import './chunk-PDTSUOVT.js';

package/dist/{chunk-47RS42OZ.js → chunk-A56PYPDF.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { C } from './chunk-YRYMNBGQ.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
-import { mkdirSync, writeFileSync, existsSync, readFileSync } from 'fs';
+import { existsSync, writeFileSync, mkdirSync, readFileSync } from 'fs';
 import { join, dirname } from 'path';
 
 createRequire(import.meta.url);
@@ -47,7 +47,7 @@ function readMcpDoc(absPath, relPath) {
 function mcpTargetPath(repoRoot) {
   return existsSync(join(repoRoot, ".outerlayer", "mcp.json")) ? ".outerlayer/mcp.json" : ".mcp.json";
 }
-function addStdioMcpEntryIfAbsent(repoRoot, name = "outerlayer") {
+function addMcpEntryIfAbsent(repoRoot, name, entry) {
   const relPath = mcpTargetPath(repoRoot);
   const absPath = join(repoRoot, relPath);
   const doc = readMcpDoc(absPath, relPath);
@@ -57,12 +57,19 @@ function addStdioMcpEntryIfAbsent(repoRoot, name = "outerlayer") {
   }
   const existing = servers ?? {};
   if (name in existing) return { path: relPath, added: false };
-  const entry = buildStdioServerEntry(DEFAULT_MCP_COMMAND, void 0, void 0);
   mkdirSync(dirname(absPath), { recursive: true });
   writeFileSync(absPath, `${JSON.stringify({ ...doc, mcpServers: { ...existing, [name]: entry } }, null, 2)}
 `);
   return { path: relPath, added: true };
 }
+function addStdioMcpEntryIfAbsent(repoRoot, name = "outerlayer") {
+  return addMcpEntryIfAbsent(repoRoot, name, buildStdioServerEntry(DEFAULT_MCP_COMMAND, void 0, void 0));
+}
+var DOCS_MCP_SERVER_NAME = "outerlayer-docs";
+var DOCS_MCP_URL = "https://docs.outerlayer.ai/mcp";
+function addDocsMcpEntryIfAbsent(repoRoot) {
+  return addMcpEntryIfAbsent(repoRoot, DOCS_MCP_SERVER_NAME, { type: "http", url: DOCS_MCP_URL });
+}
 function runMcpInstall(opts = {}) {
   const cwd = opts.cwd ?? process.cwd();
   if (!existsSync(cwd)) throw new McpInstallError(`no such directory: ${cwd}`);
@@ -92,4 +99,4 @@ function handleMcpInstallError(err) {
   process.exitCode = 1;
 }
 
-export { DEFAULT_MCP_COMMAND, McpInstallError, addStdioMcpEntryIfAbsent, buildServerEntry, buildStdioServerEntry, defaultMcpUrl, handleMcpInstallError, runMcpInstall };
+export { DEFAULT_MCP_COMMAND, DOCS_MCP_SERVER_NAME, McpInstallError, addDocsMcpEntryIfAbsent, addStdioMcpEntryIfAbsent, buildServerEntry, buildStdioServerEntry, defaultMcpUrl, handleMcpInstallError, runMcpInstall };

package/dist/{chunk-4AVAETSU.js → chunk-ERHJETKP.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { compareVersions, satisfiesRange } from './chunk-I2UOAV7X.js';
-import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-ABIWDUMS.js';
+import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-YETTWTAY.js';
 import { LEASE_SECONDS, releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, ALREADY_RELEASED } from './chunk-KZ5M4QOB.js';
 import { writeJobFile, readJobFile, readJobFileChecked } from './chunk-T6OIJQRT.js';
 import { RUNNER_PROTOCOL } from './chunk-PDTSUOVT.js';
@@ -225,15 +225,17 @@ async function verifyInto(staging, version, deps) {
   const digest = await fetchTarballDigest(meta.tarball, deps.fetchImpl);
   if (digest !== expected) return failed(`the tarball for ${version} does not match the registry's integrity digest`);
   const provenance = await fetchProvenance(version, deps.fetchImpl);
-  if (provenance === void 0) return failed(`${version} has no provenance attestation`);
-  if (provenance.repository !== RELEASE_REPOSITORY) {
-    return failed(`the provenance of ${version} names the repository ${provenance.repository}, not ${RELEASE_REPOSITORY}`);
-  }
-  if (provenance.workflowPath !== RELEASE_WORKFLOW_PATH) {
-    return failed(`the provenance of ${version} names the workflow ${provenance.workflowPath}, not ${RELEASE_WORKFLOW_PATH}`);
-  }
-  if (Buffer.from(provenance.subjectSha512, "hex").toString("base64") !== digest) {
-    return failed(`the provenance of ${version} covers a different package than the tarball`);
+  if (provenance.kind === "unreadable") return failed(`the provenance of ${version} could not be read`);
+  if (provenance.kind === "found") {
+    if (provenance.repository !== RELEASE_REPOSITORY) {
+      return failed(`the provenance of ${version} names the repository ${provenance.repository}, not ${RELEASE_REPOSITORY}`);
+    }
+    if (provenance.workflowPath !== RELEASE_WORKFLOW_PATH) {
+      return failed(`the provenance of ${version} names the workflow ${provenance.workflowPath}, not ${RELEASE_WORKFLOW_PATH}`);
+    }
+    if (Buffer.from(provenance.subjectSha512, "hex").toString("base64") !== digest) {
+      return failed(`the provenance of ${version} covers a different package than the tarball`);
+    }
   }
   mkdirSync(staging, { recursive: true, mode: RUNNER_DIR_MODE });
   const npm = await npmVersion(deps.runNpm, staging);
@@ -1972,7 +1974,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     const outcome = await onStartUnderMarker({
       configPath,
       own: ownVersionOf(deps),
-      check: update.check ? () => update.check(configPath) : async () => (await import('./check-RBRRI77E.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
+      check: update.check ? () => update.check(configPath) : async () => (await import('./check-NQYQHITZ.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
     });

package/dist/{chunk-ABIWDUMS.js → chunk-YETTWTAY.js}

@@ -34,17 +34,17 @@ async function fetchTarballDigest(url, fetchImpl) {
 }
 async function fetchProvenance(version, fetchImpl) {
   const response = await get(`${REGISTRY_URL}/-/npm/v1/attestations/${PACKAGE_PATH}@${encodeURIComponent(version)}`, fetchImpl);
-  if (response.status === 404) return void 0;
+  if (response.status === 404) return { kind: "absent" };
   if (!response.ok) throw new Error(`the registry answered HTTP ${response.status} for the attestations of ${PACKAGE_NAME}@${version}`);
   const body = await response.json();
   const slsa = (body.attestations ?? []).find((a) => a.predicateType === SLSA_PREDICATE);
   const payload = slsa?.bundle?.dsseEnvelope?.payload;
-  if (typeof payload !== "string") return void 0;
+  if (typeof payload !== "string") return { kind: "unreadable" };
   const statement = JSON.parse(Buffer.from(payload, "base64").toString("utf8"));
   const workflow = statement.predicate?.buildDefinition?.externalParameters?.workflow;
   const subjectSha512 = statement.subject?.[0]?.digest?.sha512;
-  if (typeof workflow?.repository !== "string" || typeof workflow.path !== "string" || typeof subjectSha512 !== "string") return void 0;
-  return { repository: workflow.repository, workflowPath: workflow.path, subjectSha512 };
+  if (typeof workflow?.repository !== "string" || typeof workflow.path !== "string" || typeof subjectSha512 !== "string") return { kind: "unreadable" };
+  return { kind: "found", repository: workflow.repository, workflowPath: workflow.path, subjectSha512 };
 }
 
 // src/runner/update/npm.ts

package/dist/{cli-G6TH4YMK.js → cli-ZCWMJCEK.js}

@@ -3820,7 +3820,7 @@ function buildProgram(argv = process.argv) {
   program2.name("outerlayer").description("OuterLayer \u2014 see what your coding agents actually do").enablePositionalOptions().version(resolveVersion()).option(NO_COLOR_FLAG, "disable color (NO_COLOR=1 does the same)").addHelpText("after", SUPPORT_TEXT);
   program2.command("init").description("Connect this repository, install hooks and agent skills, run doctor").option("--user", "install into user settings [default]").option("--project", "install into project settings (./.claude/settings.json)").option("--org", "print a managed-settings.json snippet for MDM/GPO rollout").option("--remove", "uninstall OuterLayer hooks").option("--local", "install the hooks only: no connect step and no network call").option("--factory <org/factory>", "the factory to connect this repository to (see `outerlayer connect`)").option("--gitignore", "also add .outerlayer/ to .gitignore (project scope)").option("--template <name>", "install the starter skills and a policy file (only: default)").option("--no-wrap-hooks", "leave PreToolUse/PostToolUse hooks unwrapped").option("--statusline", "install the status-line segment [default]").option("--no-statusline", "leave the statusLine slot untouched").option("--json", "machine-readable JSON output").addHelpText(
     "after",
-    "\nIn a repository, init runs four steps: connect the repository to a\nfactory (`outerlayer connect`), install the hooks, set up the coding agent,\nand run `outerlayer doctor`. It never signs in and asks nothing. With no\nlogin it skips the connect step and says to run `outerlayer login`. With\n--json it prints one document naming the outcome of each step: done,\nskipped or failed. The exit code is 1 when a step failed.\n\nThe agent setup step installs the starter skills and the `outerlayer` skill\ninto .outerlayer/skills/, writes .outerlayer/config.json for Claude Code when\nthere is none, runs `outerlayer context emit` so the skills appear in\n.claude/skills/, and adds the OuterLayer MCP server to .mcp.json. Nothing you\nwrote is changed: an existing config, policy, edited skill, MCP entry or root\nCLAUDE.md and AGENTS.md is left as it is, and a hand-written file the emit\nwould replace is kept and listed. The files are left uncommitted.\nThe step is skipped outside a git repository and in a repository whose\ncontext comes from a control plane, where it arrives at session start.\n\n--local installs only the hooks: no connect step, no agent setup and no\nnetwork call. Add `--template default` to also write the starter skills and\na policy file into .outerlayer/ without compiling them; `outerlayer context\nemit` does that.\n\nIdempotent: settings are backed up before any write, and a second run\nchanges nothing. Wrapping adds one spawn per hook firing; undo it with\n`outerlayer hooks unwrap`. An occupied status-line slot is wrapped, never\nreplaced.\n\nThree of the starter skills are copied once and are yours to edit. The\nothers are rewritten from this CLI on every `context emit`.\n"
+    "\nIn a repository, init runs four steps: connect the repository to a\nfactory (`outerlayer connect`), install the hooks, set up the coding agent,\nand run `outerlayer doctor`. It never signs in and asks nothing. With no\nlogin it skips the connect step and says to run `outerlayer login`. With\n--json it prints one document naming the outcome of each step: done,\nskipped or failed. The exit code is 1 when a step failed.\n\nThe agent setup step installs the starter skills and the `outerlayer` skill\ninto .outerlayer/skills/, writes .outerlayer/config.json for Claude Code when\nthere is none, runs `outerlayer context emit` so the skills appear in\n.claude/skills/, and adds the outerlayer and outerlayer-docs MCP servers to\n.mcp.json. Nothing you wrote is changed: an existing config, policy, edited\nskill, MCP entry or root CLAUDE.md and AGENTS.md is left as it is, and a\nhand-written file the emit would replace is kept and listed. The files are\nleft uncommitted.\nThe step is skipped outside a git repository and in a repository whose\ncontext comes from a control plane, where it arrives at session start.\n\n--local installs only the hooks: no connect step, no agent setup and no\nnetwork call. Add `--template default` to also write the starter skills and\na policy file into .outerlayer/ without compiling them; `outerlayer context\nemit` does that.\n\nIdempotent: settings are backed up before any write, and a second run\nchanges nothing. Wrapping adds one spawn per hook firing; undo it with\n`outerlayer hooks unwrap`. An occupied status-line slot is wrapped, never\nreplaced.\n\nThree of the starter skills are copied once and are yours to edit. The\nothers are rewritten from this CLI on every `context emit`.\n"
   ).action(async (opts) => {
     let starterTemplate;
     if (opts.template !== void 0) {
@@ -3867,7 +3867,7 @@ function buildProgram(argv = process.argv) {
           return { ok, text, detail };
         },
         runAgentSetup: async () => {
-          const { runAgentSetup } = await import('./agent-setup-ODTDC3US.js');
+          const { runAgentSetup } = await import('./agent-setup-YEFN74Y4.js');
           return runAgentSetup({ cwd: process.cwd() });
         },
         runDoctorChecks: gatherDoctorChecks
@@ -4349,7 +4349,7 @@ live addition remains on it.
       throw err;
     }
   });
-  workCmd.command("list").description("List live work items for this factory").option("--stage <spec|build|review>", "filter by stage").option("--section <attention|waiting|flowing>", "filter by Queue section").option("--repo <owner/name>", "repository (default: the current checkout's remote)").option("--unclaimed", "only items with no live lease").option("--claimed", "only items with a live lease, held by a host or a local session").option("--startable", "only items with an unused build request and no live lease").option("--needs <amend>", "only items with a thread waiting on an agent").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").action(async (opts) => {
+  workCmd.command("list").description("List live work items for this factory").option("--stage <spec|build|review>", "filter by stage").option("--section <attention|waiting|flowing>", "filter by Queue section").option("--repo <owner/name>", "repository (default: the current checkout's remote)").option("--unclaimed", "only items with no live lease").option("--claimed", "only items with a live lease, held by a host or a local session").option("--startable", "only items a host can start: a build request, no open PR, no live lease").option("--needs <amend>", "only items with a thread waiting on an agent").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").action(async (opts) => {
     warnIfApiKeyFlag(opts);
     const { runWorkList, WorkCommandError } = await import('./work-cmd-ZJY3NA2G.js');
     try {
@@ -4452,11 +4452,11 @@ function registerRunnerCommands(program2) {
   const configOption = "the cloud config file to run against (default: ~/.outerlayer/config.json)";
   runnerCmd.command("start").description("Run the loop: claim work, run it, report, clean up, repeat").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-X45X7AS4.js');
-    const { start, RunnerStartError } = await import('./loop-ZNUQT736.js');
+    const { start, RunnerStartError } = await import('./loop-DBF3UJAD.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-UZRH774M.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     try {
-      const { realUpdateDeps } = await import('./real-deps-LS64D3M6.js');
+      const { realUpdateDeps } = await import('./real-deps-KNNBQC75.js');
       await start(configPath, { update: realUpdateDeps(), fetchImpl: fetch });
     } catch (err) {
       if (err instanceof RunnerConfigError || err instanceof RunnerAlreadyRunningError || err instanceof RunnerStartError) {
@@ -4468,7 +4468,7 @@ function registerRunnerCommands(program2) {
   });
   runnerCmd.command("check").description("Validate the config, the hooks and the key, and print the effective settings").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-X45X7AS4.js');
-    const { runRunnerCheck } = await import('./check-RBRRI77E.js');
+    const { runRunnerCheck } = await import('./check-NQYQHITZ.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const result = await runRunnerCheck(configPath);
     if (!result.ok) {
@@ -4563,7 +4563,7 @@ To keep it running, run ${C.yellow}outerlayer runner install --service${C.reset}
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-X45X7AS4.js');
     const { runRunnerInit, RunnerInitError } = await import('./init-OKCDXEOG.js');
     const { detectMachine } = await import('./machine-TBJKZ6TN.js');
-    const { chooseVm, runVmInit, VmInitError } = await import('./init-ORDCPTFD.js');
+    const { chooseVm, runVmInit, VmInitError } = await import('./init-MJ2PO2VQ.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     try {
       const machine = detectMachine();
@@ -4768,14 +4768,14 @@ Next:
   });
   runnerCmd.command("stop").description("Take no more work; wait for running jobs to finish, then exit").option("--config <path>", "the cloud config file naming the runner to stop").option("--now", "end running jobs immediately, with outcome stopped").action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-X45X7AS4.js');
-    const { requestStop } = await import('./loop-ZNUQT736.js');
+    const { requestStop } = await import('./loop-DBF3UJAD.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     await requestStop(configPath, Boolean(opts.now));
   });
   runnerCmd.command("status").description("List running jobs; with --recent, finished ones too").option("--config <path>", "the cloud config file naming the runner to inspect").option("--recent", "also list finished jobs, newest first, capped at 20").option("--json", "machine-readable JSON output").action(async (opts) => {
     const { defaultRunnerConfigPath, loadRunnerConfig } = await import('./config-X45X7AS4.js');
     const { jobsDir, runnerDir } = await import('./paths-OYKMVYJP.js');
-    const { listJobFiles, runnerProcessState } = await import('./loop-ZNUQT736.js');
+    const { listJobFiles, runnerProcessState } = await import('./loop-DBF3UJAD.js');
     const { renderStatus } = await import('./status-KPDVZMJ6.js');
     const { readHousekeepingRecord } = await import('./record-C43U4PKS.js');
     const path2 = await import('path');
@@ -4828,7 +4828,7 @@ Next:
   });
   runnerCmd.command("logs").argument("<item>", "the work item's number in the factory").description("Print the newest attempt's log for one item").option("--config <path>", "the cloud config file naming the runner to inspect").option("-f, --follow", "keep printing as the log grows").action(async (itemArg, opts) => {
     const { defaultRunnerConfigPath } = await import('./config-X45X7AS4.js');
-    const { listJobFiles } = await import('./loop-ZNUQT736.js');
+    const { listJobFiles } = await import('./loop-DBF3UJAD.js');
     const { newestAttempt, logPathFor, tail, RunnerLogsError } = await import('./logs-H55NWW4H.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const item = parseTrackerNumber(itemArg);
@@ -5052,7 +5052,7 @@ function registerMcpCommands(program2) {
     "after",
     "\nThe API key is never a flag and never written to .mcp.json as a literal value.\n  stdio (default): the client spawns `outerlayer mcp serve`, which reads the key\n  from ~/.outerlayer/config.json (or OUTERLAYER_API_KEY) on every connect, so a\n  rotated key is picked up without rewriting the entry.\n  http: the entry carries the ${OUTERLAYER_API_KEY} placeholder, which the client\n  resolves from the environment it was launched with.\n\n--command: use an absolute or ${HOME}-relative path when the CLI is not on PATH.\n--url: with stdio the endpoint resolves from OUTERLAYER_URL / the config file at\nconnect time; for self-host pass your gateway-node origin + /v1/mcp.\nSelf-host deployments also need --app-id: without a key service to resolve the\ncaller from the bearer token, the gateway answers 401 without that header.\n"
   ).action(async (opts) => {
-    const { runMcpInstall, handleMcpInstallError, McpInstallError } = await import('./mcp-install-cmd-4AQMSIGY.js');
+    const { runMcpInstall, handleMcpInstallError, McpInstallError } = await import('./mcp-install-cmd-XZARXNYT.js');
     try {
       if (opts.transport !== void 0 && opts.transport !== "stdio" && opts.transport !== "http") {
         throw new McpInstallError(`--transport must be "stdio" or "http", got "${opts.transport}"`);

package/dist/index.js

@@ -22,5 +22,5 @@ if (argv[0] === "statusline") {
   process.exit(0);
 }
 (await import('./hook-fast-AQCAQIA6.js')).recordLinkExitFailure(argv);
-var { runCli } = await import('./cli-G6TH4YMK.js');
+var { runCli } = await import('./cli-ZCWMJCEK.js');
 await runCli(process.argv);

package/dist/{init-ORDCPTFD.js → init-MJ2PO2VQ.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { npmSupportsProvenance } from './chunk-ABIWDUMS.js';
+import { npmSupportsProvenance } from './chunk-YETTWTAY.js';
 import { readConfigObject, RunnerInitError } from './chunk-MC6J453K.js';
 import './chunk-472KC6JV.js';
 import './chunk-BREEX2Z7.js';

package/dist/{loop-ZNUQT736.js → loop-DBF3UJAD.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { RunnerStartError, listJobFiles, probeCredentials, requestStop, runnerProcessState, start, tick, watchTick } from './chunk-4AVAETSU.js';
+export { RunnerStartError, listJobFiles, probeCredentials, requestStop, runnerProcessState, start, tick, watchTick } from './chunk-ERHJETKP.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-I2UOAV7X.js';
-import './chunk-ABIWDUMS.js';
+import './chunk-YETTWTAY.js';
 import './chunk-KZ5M4QOB.js';
 import './chunk-T6OIJQRT.js';
 import './chunk-PDTSUOVT.js';

package/dist/mcp-install-cmd-XZARXNYT.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+export { DEFAULT_MCP_COMMAND, DOCS_MCP_SERVER_NAME, McpInstallError, addDocsMcpEntryIfAbsent, addStdioMcpEntryIfAbsent, buildServerEntry, buildStdioServerEntry, defaultMcpUrl, handleMcpInstallError, runMcpInstall } from './chunk-A56PYPDF.js';
+import './chunk-YRYMNBGQ.js';
+import './chunk-EABW6AJQ.js';
+import './chunk-VNVZDWO3.js';
+import './chunk-Z5GEFMRW.js';
+
+createRequire(import.meta.url);

package/dist/{real-deps-LS64D3M6.js → real-deps-KNNBQC75.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { startedByService } from './chunk-3JVYMD4G.js';
-import { realRunNode, realRunNpm } from './chunk-ABIWDUMS.js';
+import { realRunNode, realRunNpm } from './chunk-YETTWTAY.js';
 import './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@outerlayer/cli",
-  "version": "0.10.1",
+  "version": "0.10.2",
   "description": "OuterLayer CLI — commands: init, connect, doctor, login, logout, sync, daemon (alias: watch), emit, work, runner, hooks, mcp, import, context. Capture and sync coding-agent sessions, and record proof of factory work.",
   "license": "Apache-2.0",
   "author": "Magu Studios, Inc.",

package/dist/mcp-install-cmd-4AQMSIGY.js

@@ -1,9 +0,0 @@
-#!/usr/bin/env node
-import { createRequire } from 'node:module';
-export { DEFAULT_MCP_COMMAND, McpInstallError, addStdioMcpEntryIfAbsent, buildServerEntry, buildStdioServerEntry, defaultMcpUrl, handleMcpInstallError, runMcpInstall } from './chunk-47RS42OZ.js';
-import './chunk-YRYMNBGQ.js';
-import './chunk-EABW6AJQ.js';
-import './chunk-VNVZDWO3.js';
-import './chunk-Z5GEFMRW.js';
-
-createRequire(import.meta.url);