@outerlayer/cli 0.11.0 → 0.13.0

package/dist/{chunk-EOWWTFUU.js → chunk-DPKX26LT.js}

@@ -1,22 +1,22 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readStatuslineState, STATE_FRESH_MS } from './chunk-F47JBIAW.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-DTDZXDQ3.js';
-import { isLinkedRepository } from './chunk-UES67HLJ.js';
-import { sanitizeTerminal } from './chunk-VDI5POCC.js';
-import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-IU4NZROR.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-P4MM66C6.js';
+import { isLinkedRepository } from './chunk-4QVZCVWT.js';
+import { sanitizeTerminal } from './chunk-CNFVHDHG.js';
+import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-JXYVA45C.js';
 import { C } from './chunk-YRYMNBGQ.js';
 import { readSettings, settingsPath, isOurStatuslineSlot, statuslineWrappedOriginal, REGISTERED_EVENTS, isOurHookCommand, ourCommandBins, cliBinResolvable, ourDirectScriptBins, wrappedOriginalCommand } from './chunk-5QRP3MVS.js';
-import { readPin, readContextManifest, readDegraded, readSourceCache } from './chunk-BMX3L7CR.js';
+import { readPin, readContextManifest, readDegraded, readSourceCache } from './chunk-LCEXHCHD.js';
 import { defaultFetch } from './chunk-YO4PSLVB.js';
 import { resolveGatewayCredentials } from './chunk-PLMTLGYH.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
-import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-4HMXH2OA.js';
+import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-SFFHGX3G.js';
 import { deadHooksState, preparePackageManagerCommand, contextExcludesPresent } from './chunk-XCCLFVXM.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { readFileSync, mkdirSync, writeFileSync, renameSync, existsSync, accessSync, constants, statSync, readdirSync } from 'fs';
-import { join, dirname } from 'path';
+import { readFileSync, mkdirSync, writeFileSync, renameSync, existsSync, accessSync, constants, statSync, readdirSync, realpathSync } from 'fs';
+import { join, dirname, resolve, delimiter } from 'path';
 import { execFileSync } from 'child_process';
 
 createRequire(import.meta.url);
@@ -113,6 +113,57 @@ function recordStatusline(home, settingsPath2, outcome, original, now = Date.now
     };
   });
 }
+var NAME = "MCP server";
+var SERVER = "outerlayer";
+var NPX_FIX = 'Change the "outerlayer" entry in .mcp.json to run `npx -y @outerlayer/cli mcp serve`, or install the CLI with `npm install -g @outerlayer/cli`.';
+function expand(value, env) {
+  return value.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (_m, name) => env[name] ?? "");
+}
+function isExecutableFile(path, platform) {
+  try {
+    if (!statSync(path).isFile()) return false;
+    if (platform !== "win32") accessSync(path, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function resolveCommand(command, root, env, platform) {
+  if (/[\\/]/.test(command)) {
+    const path = resolve(root, command);
+    return isExecutableFile(path, platform) ? path : void 0;
+  }
+  const exts = platform === "win32" ? ["", ...(env.PATHEXT ?? ".EXE;.CMD;.BAT").split(";")] : [""];
+  for (const dir of (env.PATH ?? "").split(delimiter)) {
+    for (const ext of exts) {
+      const candidate = join(dir, command + ext);
+      if (isExecutableFile(candidate, platform)) return candidate;
+    }
+  }
+  return void 0;
+}
+function checkMcpCommand(cwd, env = process.env, platform = process.platform) {
+  const root = findGitDirs(cwd ?? process.cwd())?.repoRoot;
+  if (root === void 0) return [];
+  const path = join(root, ".mcp.json");
+  if (!existsSync(path)) return [];
+  let entry;
+  try {
+    entry = JSON.parse(readFileSync(path, "utf8")).mcpServers?.[SERVER];
+  } catch {
+    return [{ name: NAME, status: "warn", detail: ".mcp.json is not valid JSON, so the agent starts none of its servers", fix: "Fix the JSON syntax in .mcp.json." }];
+  }
+  const command = entry?.command;
+  if (typeof command !== "string") return [];
+  const shown = sanitizeTerminal(command);
+  const resolved = resolveCommand(expand(command, env), root, env, platform);
+  if (resolved === void 0) {
+    return [{ name: NAME, status: "warn", detail: `the "outerlayer" server runs \`${shown}\`, which is not on PATH here, so the agent has no OuterLayer tools`, fix: NPX_FIX }];
+  }
+  return [{ name: NAME, status: "pass", detail: `the "outerlayer" server runs ${sanitizeTerminal(resolved)}` }];
+}
+
+// src/doctor.ts
 var LAPTOP_CHECKS_NOT_APPLICABLE = {
   name: "Laptop checks",
   status: "skipped",
@@ -135,6 +186,7 @@ function runDoctor(env = {}) {
     checkSettingsValid(home, env.cwd),
     ...laptop ? checkStatusline(home, now, env.cwd) : [],
     ...checkInstalls(env),
+    ...laptop ? checkMcpCommand(env.cwd, env.processEnv) : [],
     ...checkContextSource(home, env.cwd),
     ...checkInstalledCli(home, env.cwd ?? process.cwd())
   ];
@@ -462,7 +514,9 @@ function checkDeadHooksState(cwd) {
 function checkSpoolWritable(home) {
   const dir = spoolDir(home);
   try {
-    if (!existsSync(dir)) return { name: "Spool writable", status: "warn", detail: "spool not created yet", fix: "Run `outerlayer init` (creates the spool on first hook)." };
+    if (!existsSync(dir)) {
+      return { name: "Spool writable", status: "warn", detail: "spool not created yet", fix: "The first hook run creates it: start a Claude Code session in the repository." };
+    }
     accessSync(dir, constants.W_OK);
     return { name: "Spool writable", status: "pass", detail: dir };
   } catch {
@@ -561,10 +615,25 @@ function checkSettingsValid(home, cwd) {
   }
   return { name: "Settings JSON valid", status: "pass", detail: "all settings files parse" };
 }
+function distinctInstalls(paths) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const path of paths) {
+    let real = path;
+    try {
+      real = realpathSync(path);
+    } catch {
+    }
+    if (seen.has(real)) continue;
+    seen.add(real);
+    out.push(path);
+  }
+  return out;
+}
 function checkInstalls(env) {
   let installs;
   try {
-    installs = (env.claudeInstalls ?? defaultClaudeInstalls)();
+    installs = distinctInstalls((env.claudeInstalls ?? defaultClaudeInstalls)());
   } catch {
     return [];
   }
@@ -708,7 +777,14 @@ async function githubAppChecks(options = {}) {
     return [{ name: "GitHub App", status: "warn", detail: "the gateway's answer listed no repositories", fix: "Update the outerlayer CLI and the gateway to the same release." }];
   }
   if (data.length === 0) {
-    return [{ name: "GitHub App", status: "pass", detail: "the factory has no connected repositories" }];
+    return [
+      {
+        name: "GitHub App",
+        status: "warn",
+        detail: "the factory has no connected repositories, so it cannot build or check any work",
+        fix: `On the factory's Work page, choose Connect GitHub repository, then Link repository: ${CONNECT_REPOSITORY_DOCS}`
+      }
+    ];
   }
   return data.map(repositoryAccessCheck);
 }
@@ -1004,7 +1080,7 @@ function doctorExitCode(checks) {
 
 // src/doctor-report.ts
 async function gatherDoctorChecks() {
-  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-MKBX2ZQD.js');
+  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-N3C6DFQA.js');
   const configPath = defaultRunnerConfigPath();
   const checks = runDoctor({ runnerHost: hasRunnerBlock(configPath) });
   const credential = await credentialChecks();
@@ -1016,7 +1092,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-ZF4PYWVN.js');
+    const { runnerHostChecks } = await import('./doctor-3H25Q7WT.js');
     const hooks = (() => {
       try {
         return loadRunnerConfig(configPath).hooks;
@@ -1048,10 +1124,10 @@ async function gatherDoctorChecks() {
       }
     })();
     const service = await (async () => {
-      const { existsSync: existsSync2 } = await import('fs');
-      if (process.platform !== "linux" || !existsSync2("/run/systemd/system")) return void 0;
+      const { existsSync: existsSync3 } = await import('fs');
+      if (process.platform !== "linux" || !existsSync3("/run/systemd/system")) return void 0;
       const { inspectService, realInspectProbes } = await import('./inspect-6UYAAXH7.js');
-      const { DEFAULT_UNIT_NAME } = await import('./install-HKOVISUP.js');
+      const { DEFAULT_UNIT_NAME } = await import('./install-HDBIPHTX.js');
       const { dirname: dirname2 } = await import('path');
       return inspectService(DEFAULT_UNIT_NAME, dirname2(configPath), realInspectProbes());
     })();

package/dist/{chunk-SUMWRA7K.js → chunk-DXQ5MHCO.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { C } from './chunk-YRYMNBGQ.js';
-import { resolvePackRoot, loadTemplateFiles, loadMaintainedFiles, TEMPLATE_SKILLS, skillDir, writeMaintainedFiles, MAINTAINED_SKILLS } from './chunk-BGWTYRSS.js';
+import { resolvePackRoot, loadTemplateFiles, loadMaintainedFiles, TEMPLATE_SKILLS, skillDir, writeMaintainedFiles, MAINTAINED_SKILLS } from './chunk-TCIW27FM.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
 import { readFileSync, existsSync, mkdirSync, writeFileSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-ZQ5JGHUO.js → chunk-EFZLAYPE.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-UES67HLJ.js';
-import { resolveRepoIdentity } from './chunk-IU4NZROR.js';
+import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-4QVZCVWT.js';
+import { resolveRepoIdentity } from './chunk-JXYVA45C.js';
 import { resolveGatewayCredentials } from './chunk-PLMTLGYH.js';
 import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-RWQWPZB4.js → chunk-GI4XXD4I.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
-import { readPin, pinExists, readBuildHold, readContextManifest, manifestFilesPresent, writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, SOURCE_CACHE_TTL_SUCCESS_MS, isLastCheckFresh, readDegraded, touchLastCheck, clearDegraded, writeContextManifest, writePinIfChanged, readSourceCache, isSourceCacheFresh } from './chunk-BMX3L7CR.js';
-import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-BGWTYRSS.js';
-import { normalizeRepoName, parseGoverns, CONTEXT_SOURCE_CONFIG_PATH, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-TB7EP24C.js';
+import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-TCIW27FM.js';
+import { readPin, pinExists, readBuildHold, readContextManifest, manifestFilesPresent, writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, SOURCE_CACHE_TTL_SUCCESS_MS, isLastCheckFresh, readDegraded, touchLastCheck, clearDegraded, writeContextManifest, writePinIfChanged, readSourceCache, isSourceCacheFresh } from './chunk-LCEXHCHD.js';
+import { normalizeRepoName, parseGoverns, CONTEXT_SOURCE_CONFIG_PATH, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-2M63GG56.js';
 import { defaultFetch } from './chunk-YO4PSLVB.js';
 import { resolveGatewayCredentials } from './chunk-PLMTLGYH.js';
 import { withTokenHeader } from './chunk-BYT5O5RV.js';

package/dist/{chunk-YU5GL7QS.js → chunk-HDTVTA6I.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { maintainedFilesForExistingSkills, loadMaintainedFiles, writeMaintainedFiles } from './chunk-BGWTYRSS.js';
-import { emitTree, parseOuterlayerConfig, classifyTree, generatedHeaderSource, CONTEXT_PIN_FILENAME, normalizePath } from './chunk-TB7EP24C.js';
+import { maintainedFilesForExistingSkills, loadMaintainedFiles, writeMaintainedFiles } from './chunk-TCIW27FM.js';
+import { emitTree, parseOuterlayerConfig, classifyTree, generatedHeaderSource, CONTEXT_PIN_FILENAME, normalizePath } from './chunk-2M63GG56.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, copyFileSync, readdirSync } from 'fs';
 import { join, dirname, relative, sep } from 'path';
 

package/dist/{chunk-BFESLKPP.js → chunk-IP7BIBXJ.js}

@@ -57,5 +57,23 @@ function detectActiveSession(opts) {
   }
   return newest;
 }
+function transcriptPathForSession(sessionId, home, readTailImpl = readTail) {
+  const tail = readTailImpl(join(home, ".outerlayer", "spool", "events.jsonl"), SESSION_DETECT_TAIL_BYTES);
+  if (!tail) return void 0;
+  let lines = tail.data.toString("utf8").split("\n");
+  if (tail.truncated) lines = lines.slice(1);
+  let found;
+  for (const line of lines) {
+    try {
+      const record = JSON.parse(line);
+      if (record.sessionId === sessionId && typeof record.transcriptPath === "string" && record.transcriptPath !== "") {
+        found = record.transcriptPath;
+      }
+    } catch {
+      continue;
+    }
+  }
+  return found;
+}
 
-export { detectActiveSession };
+export { detectActiveSession, transcriptPathForSession };

package/dist/{chunk-YT35WGIP.js → chunk-J5M7BSJQ.js}

@@ -22273,9 +22273,14 @@ var ArtifactTombstoneRecordSchema = external_exports.looseObject({
 });
 external_exports.union([ArtifactSpoolRecordSchema, ArtifactTombstoneRecordSchema]);
 var EMITTED_RESULTS = ["pass", "fail"];
-var RESERVED_EMIT_NAMES = ["criteria"];
-var EmittedNameSchema = external_exports.string().regex(/^[a-z][a-z0-9._-]{0,63}$/).refine((name) => !RESERVED_EMIT_NAMES.includes(name), {
-  message: "is reserved: `outerlayer emit criteria` records a work item's acceptance criteria"
+var RESERVED_EMIT_NAMES = ["artifact", "criteria", "finding", "findings"];
+var EmittedNameSchema = external_exports.string().regex(/^[a-z][a-z0-9._-]{0,63}$/).superRefine((name, ctx) => {
+  if (RESERVED_EMIT_NAMES.includes(name)) {
+    ctx.addIssue({
+      code: "custom",
+      message: `is reserved: \`outerlayer emit ${name}\` is a subcommand, so a check cannot be recorded under that name`
+    });
+  }
 });
 var EMITTED_RESULT_MAX_LINK_LENGTH = 500;
 var EMITTED_RESULT_MAX_BODY_LENGTH = 2e3;
@@ -22292,6 +22297,7 @@ var CriterionSchema = external_exports.object({
   proof: external_exports.enum(ARTIFACT_KINDS).nullable()
 }).strict();
 var CriteriaArraySchema = external_exports.array(CriterionSchema).min(1).max(CRITERIA_MAX);
+var DraftedSchema = external_exports.boolean().optional();
 function refuseDuplicateIds(criteria, ctx) {
   const seen = /* @__PURE__ */ new Set();
   criteria.forEach((criterion, index) => {
@@ -22305,9 +22311,10 @@ function refuseDuplicateIds(criteria, ctx) {
     seen.add(criterion.id);
   });
 }
-var CriteriaListSchema = external_exports.object({ criteria: CriteriaArraySchema }).strict().superRefine((list, ctx) => refuseDuplicateIds(list.criteria, ctx));
+var CriteriaListSchema = external_exports.object({ criteria: CriteriaArraySchema, drafted: DraftedSchema }).strict().superRefine((list, ctx) => refuseDuplicateIds(list.criteria, ctx));
 external_exports.object({
   criteria: CriteriaArraySchema,
+  drafted: DraftedSchema,
   item: external_exports.object({ number: external_exports.number().int().positive() }).optional(),
   sessionId: external_exports.string().optional()
 }).superRefine((request, ctx) => refuseDuplicateIds(request.criteria, ctx));
@@ -22323,6 +22330,20 @@ var FINDING_WHERE_LABEL_MAX_LENGTH = 200;
 var FINDING_TRACE_ID_MAX_LENGTH = 128;
 var FINDING_BATCH_MAX = 500;
 var FINDING_LINE_MAX = 2147483647;
+var FINDING_DETAIL_MAX_LENGTH = 4e3;
+var FINDING_CAUSE_MAX_LENGTH = 1e3;
+var FINDING_SUGGESTION_MAX_LENGTH = 1e3;
+var FINDING_COMMAND_MAX_LENGTH = 500;
+var FINDING_ERROR_MAX_LENGTH = 1e3;
+var FINDING_TEST_MAX_LENGTH = 500;
+var FINDING_SYMBOL_MAX_LENGTH = 300;
+var FINDING_EVENT_ID_MAX_LENGTH = 64;
+var FINDING_PROBLEMS_MAX = 5;
+var FINDING_LINK_REASON_MAX_LENGTH = 1e3;
+var FindingEventSchema = external_exports.strictObject({
+  id: external_exports.string().min(1).max(FINDING_EVENT_ID_MAX_LENGTH),
+  at: external_exports.iso.datetime({ offset: true })
+});
 var FindingRuleSchema = external_exports.strictObject({
   path: external_exports.string().min(1).max(FINDING_RULE_PATH_MAX_LENGTH),
   line: external_exports.number().int().min(1).max(FINDING_LINE_MAX).nullish(),
@@ -22342,8 +22363,49 @@ var FindingRecordSchema = external_exports.strictObject({
   file: external_exports.string().min(1).max(FINDING_FILE_MAX_LENGTH),
   line: external_exports.number().int().min(1).max(FINDING_LINE_MAX).nullish(),
   rule: FindingRuleSchema.nullish(),
-  where: FindingWhereSchema
+  where: FindingWhereSchema,
+  detail: external_exports.string().min(1).max(FINDING_DETAIL_MAX_LENGTH).optional(),
+  cause: external_exports.string().min(1).max(FINDING_CAUSE_MAX_LENGTH).optional(),
+  suggestion: external_exports.string().min(1).max(FINDING_SUGGESTION_MAX_LENGTH).optional(),
+  command: external_exports.string().min(1).max(FINDING_COMMAND_MAX_LENGTH).optional(),
+  error: external_exports.string().min(1).max(FINDING_ERROR_MAX_LENGTH).optional(),
+  test: external_exports.string().min(1).max(FINDING_TEST_MAX_LENGTH).optional(),
+  symbol: external_exports.string().min(1).max(FINDING_SYMBOL_MAX_LENGTH).optional(),
+  /** Where the problem began and where the agent got past it: two events of
+   * the recording session. Both or neither. */
+  startedAt: FindingEventSchema.optional(),
+  endedAt: FindingEventSchema.optional(),
+  /** Problems this finding reports, chosen by the agent. Needs `linkReason`. */
+  problems: external_exports.array(external_exports.uuid()).min(1).max(FINDING_PROBLEMS_MAX).optional(),
+  linkReason: external_exports.string().min(1).max(FINDING_LINK_REASON_MAX_LENGTH).optional(),
+  /** Record a new problem instead of searching for an existing one. */
+  new: external_exports.literal(true).optional()
 }).superRefine((value, ctx) => {
+  if (value.problems !== void 0 && value.linkReason === void 0) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["linkReason"],
+      message: "linkReason is required with problems \u2014 say why the finding reports each problem"
+    });
+  }
+  if (value.problems !== void 0 && value.new === true) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["new"],
+      message: "new cannot be combined with problems \u2014 a finding either links problems or records a new one"
+    });
+  }
+  if (value.startedAt === void 0 !== (value.endedAt === void 0)) {
+    ctx.addIssue({
+      code: "custom",
+      path: [value.startedAt === void 0 ? "startedAt" : "endedAt"],
+      message: "startedAt and endedAt come together \u2014 name both events or neither"
+    });
+  } else if (value.startedAt !== void 0 && value.endedAt !== void 0) {
+    if (Date.parse(value.endedAt.at) < Date.parse(value.startedAt.at)) {
+      ctx.addIssue({ code: "custom", path: ["endedAt"], message: "endedAt must not be earlier than startedAt" });
+    }
+  }
   if (value.category !== "context") return;
   if (value.rule === null || value.rule === void 0) {
     ctx.addIssue({
@@ -22362,7 +22424,7 @@ var FindingRecordSchema = external_exports.strictObject({
   }
 });
 var FindingBatchSchema = external_exports.object({
-  schemaVersion: external_exports.literal(2),
+  schemaVersion: external_exports.literal(3),
   headSha: external_exports.string().min(1).optional(),
   contextSourceSha: external_exports.string().min(1).optional(),
   findings: external_exports.array(FindingRecordSchema).min(1).max(FINDING_BATCH_MAX)
@@ -22381,6 +22443,36 @@ var FindingBatchSchema = external_exports.object({
     }
   });
 });
+var FindingProblemRefSchema = external_exports.object({ id: external_exports.string(), title: external_exports.string() });
+var FindingCandidateSchema = external_exports.object({
+  id: external_exports.string(),
+  title: external_exports.string(),
+  reportCount: external_exports.number().int(),
+  reports: external_exports.array(
+    external_exports.object({ title: external_exports.string(), cause: external_exports.string().nullish(), file: external_exports.string().nullish() })
+  )
+});
+var FINDING_JOIN_METHODS = ["strict_key", "agent_link", "new", "no_candidates", "kept"];
+var FindingResultSchema = external_exports.object({
+  id: external_exports.string(),
+  outcome: external_exports.enum(["stored", "needs_choice"]),
+  method: external_exports.enum(FINDING_JOIN_METHODS).optional(),
+  problems: external_exports.array(FindingProblemRefSchema).optional(),
+  /** Problems the agent named that a strict key replaced. */
+  overridden: external_exports.array(FindingProblemRefSchema).optional(),
+  candidates: external_exports.array(FindingCandidateSchema).optional()
+});
+var FindingsResponseSchema = external_exports.object({
+  workItemId: external_exports.string(),
+  /** Findings stored by this request. */
+  count: external_exports.number().int(),
+  results: external_exports.array(FindingResultSchema)
+});
+var SAME_PROBLEM_RULES = [
+  "1. Same problem means one fix resolves both. The same error or symptom is not enough.",
+  "2. A gap in the instructions is its own problem, separate from the thing it fails to mention. They are fixed in different places.",
+  "3. A finding can report more than one problem. Link each one, or record one finding per problem."
+].join("\n");
 var WORK_ITEM_COMMENT_ACTIONS = ["pass", "fail", "attach", "ready", "request"];
 var WORK_ITEM_COMMENT_MAX_BODY_LENGTH = 2e3;
 var REVIEW_SEND_ID_PATTERN = /^[A-Za-z0-9_.-]{1,100}$/;
@@ -22433,4 +22525,4 @@ xmlchars/xmlns/1.0/ed3.js:
    *)
 */
 
-export { ARTIFACT_KINDS, ARTIFACT_MAX_CAPTION_LENGTH, ARTIFACT_MAX_FILENAME_LENGTH, ARTIFACT_MAX_REPLACES_TARGETS, ArtifactCriterionIdSchema, ArtifactSpoolRecordSchema, ArtifactTombstoneRecordSchema, BUCKET_MODEL_MAX_LENGTH, CAPTURE_TIERS, CriteriaListSchema, EMITTED_RESULTS, EMITTED_RESULT_MAX_BODY_LENGTH, EMITTED_RESULT_MAX_LINK_LENGTH, EVENT_TYPES, EmittedNameSchema, FindingBatchSchema, RESERVED_EMIT_NAMES, SCHEMA_VERSION, SPEED_MAX_LENGTH, bannedPathsForTier, bindTests, downconvertSession, inferArtifactKind, inputBandOf, isHumanUserTurn, mediaTypeForArtifactPath, parseAgentSession, parseJunit, parseTestSelector, turnCountBound };
+export { ARTIFACT_KINDS, ARTIFACT_MAX_CAPTION_LENGTH, ARTIFACT_MAX_FILENAME_LENGTH, ARTIFACT_MAX_REPLACES_TARGETS, ArtifactCriterionIdSchema, ArtifactSpoolRecordSchema, ArtifactTombstoneRecordSchema, BUCKET_MODEL_MAX_LENGTH, CAPTURE_TIERS, CriteriaListSchema, EMITTED_RESULTS, EMITTED_RESULT_MAX_BODY_LENGTH, EMITTED_RESULT_MAX_LINK_LENGTH, EVENT_TYPES, EmittedNameSchema, FindingBatchSchema, FindingsResponseSchema, RESERVED_EMIT_NAMES, SAME_PROBLEM_RULES, SCHEMA_VERSION, SPEED_MAX_LENGTH, bannedPathsForTier, bindTests, downconvertSession, inferArtifactKind, inputBandOf, isHumanUserTurn, mediaTypeForArtifactPath, parseAgentSession, parseJunit, parseTestSelector, turnCountBound };

package/dist/{chunk-IU4NZROR.js → chunk-JXYVA45C.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EVENT_TYPES, isHumanUserTurn, parseAgentSession, SCHEMA_VERSION, SPEED_MAX_LENGTH, inputBandOf, BUCKET_MODEL_MAX_LENGTH } from './chunk-YT35WGIP.js';
+import { EVENT_TYPES, isHumanUserTurn, parseAgentSession, SCHEMA_VERSION, SPEED_MAX_LENGTH, inputBandOf, BUCKET_MODEL_MAX_LENGTH } from './chunk-J5M7BSJQ.js';
 import { createHash } from 'crypto';
 import { readFileSync, readdirSync, statSync, mkdirSync, copyFileSync, renameSync, unlinkSync, writeFileSync, stat as stat$1, unwatchFile, watchFile, watch as watch$1 } from 'fs';
 import { type, homedir } from 'os';

package/dist/{chunk-BMX3L7CR.js → chunk-LCEXHCHD.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { CONTEXT_PIN_SCHEMA_VERSION, CONTEXT_PIN_FILENAME } from './chunk-TB7EP24C.js';
+import { CONTEXT_PIN_SCHEMA_VERSION, CONTEXT_PIN_FILENAME } from './chunk-2M63GG56.js';
 import { readFileSync, existsSync, writeFileSync, mkdirSync, utimesSync, statSync, unlinkSync } from 'fs';
 import { join, dirname } from 'path';
 

package/dist/{chunk-7C4T5BGN.js → chunk-MJXXRX4M.js}

@@ -1,8 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-BEZSECPA.js';
-import { MIN_ENGINE_MAJOR } from './chunk-E5DC4VZL.js';
-import { RUNNER_DIR_MODE, runnerDir, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-P6FX4D43.js';
+import { MIN_ENGINE_MAJOR } from './chunk-MZN7AQOB.js';
+import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-T5VPP6H7.js';
+import { runnerCredentialProblem } from './chunk-22RMZBGW.js';
+import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import { dirname } from 'path';
 
@@ -38,6 +40,16 @@ function readConfigObject(configPath) {
     throw new RunnerInitError(`${configPath}: not valid JSON (${err instanceof Error ? err.message : String(err)})`);
   }
 }
+function handedCredential(value) {
+  if (value === void 0) return void 0;
+  if (typeof value !== "string") throw new RunnerInitError("the config on stdin carries a claudeCredential that is not text.");
+  return credentialFromStdin(value);
+}
+function handedAgent(value) {
+  if (value === void 0) return void 0;
+  if (!isAgentName(value)) throw new RunnerInitError("the config on stdin names an agent runner init does not know.");
+  return value;
+}
 function parseStdinConfig(configPath, text) {
   if (existsSync(configPath)) {
     throw new RunnerInitError(
@@ -50,23 +62,38 @@ function parseStdinConfig(configPath, text) {
   } catch (err) {
     throw new RunnerInitError(`the config on stdin is not valid JSON (${err instanceof Error ? err.message : String(err)})`);
   }
-  if (typeof config.url !== "string" || typeof config.apiKey !== "string" || typeof config.appId !== "string") {
-    throw new RunnerInitError("the config on stdin needs url, apiKey and appId.");
-  }
+  const problem = runnerCredentialProblem(config);
+  if (problem !== void 0) throw new RunnerInitError(`the config on stdin: ${problem.field} ${problem.reason}.`);
   const carried = config.runner;
+  const credential = handedCredential(config.claudeCredential);
+  const agent = handedAgent(config.agent);
   delete config.runner;
-  return { config, carried };
+  delete config.claudeCredential;
+  delete config.agent;
+  return { config, carried, credential, agent };
 }
 function runRunnerInit(configPath, opts = {}) {
+  return writeRunnerInit(prepareRunnerInit(configPath, opts));
+}
+function prepareRunnerInit(configPath, opts = {}) {
   let config;
   let carried;
+  let credential = opts.credential;
+  let agent = opts.agent;
+  let needsKey = false;
   if (opts.configFromStdin === void 0) {
-    config = readConfigObject(configPath);
+    config = opts.keyFromLogin === true && !existsSync(configPath) ? {} : readConfigObject(configPath);
     if (config.runner !== void 0) {
       throw new RunnerInitError(`${configPath}: a runner block is already here. Edit it, or remove it and run this again.`);
     }
+    needsKey = opts.keyFromLogin === true && config.apiKey === void 0;
+    const problem = needsKey ? void 0 : runnerCredentialProblem(config);
+    if (problem !== void 0) throw new RunnerInitError(`${configPath}: ${problem.field} ${problem.reason}.`);
   } else {
-    ({ config, carried } = parseStdinConfig(configPath, opts.configFromStdin));
+    const handed = parseStdinConfig(configPath, opts.configFromStdin);
+    ({ config, carried } = handed);
+    credential ??= handed.credential;
+    agent ??= handed.agent;
   }
   const machine = opts.machine ?? detectMachine();
   if (opts.requireContainer === true && !supportsContainerBuilds(machine)) {
@@ -75,7 +102,19 @@ function runRunnerInit(configPath, opts = {}) {
   }
   const hooks = opts.requireContainer !== true && supportsMicroVmBuilds(machine) ? "builtin:vm" : supportsContainerBuilds(machine) ? "builtin:container" : "builtin:process";
   if (hooks === "builtin:process" && opts.allowProcess !== true) throw new RunnerInitError(processRefusal(machine));
-  if (opts.configFromStdin !== void 0) mkdirSync(dirname(configPath), { recursive: true, mode: RUNNER_DIR_MODE });
+  if (agent === "claude" && credential === void 0 && !hasStoredCredential(configPath)) {
+    throw new RunnerInitError(
+      "--agent claude needs Claude's credential, and none was piped on stdin or is in the runner.env beside the config. Pipe a token from `claude setup-token`, or an Anthropic API key: printf '%s' \"$CLAUDE_CODE_OAUTH_TOKEN\" | outerlayer runner init --agent claude"
+    );
+  }
+  return { configPath, config, carried, credential, agent, machine, hooks, needsKey };
+}
+function writeRunnerInit(prepared, runnerKey) {
+  const { configPath, config, carried, credential, agent, machine, hooks } = prepared;
+  if (prepared.needsKey && runnerKey === void 0) {
+    throw new RunnerInitError(`${configPath}: apiKey is missing, and no runner key was created from the login.`);
+  }
+  if (runnerKey !== void 0) Object.assign(config, { url: runnerKey.url, apiKey: runnerKey.apiKey, appId: runnerKey.appId });
   mkdirSync(runnerDir(configPath), { recursive: true, mode: RUNNER_DIR_MODE });
   config.runner = {
     queues: ["implement", "amend"],
@@ -91,12 +130,15 @@ function runRunnerInit(configPath, opts = {}) {
       amend: PLACEHOLDER_COMMAND
     },
     ...carried,
+    // The agent was named on this command line, so its commands win over any the hand-off carried.
+    ...agent === void 0 ? {} : { commands: { ...AGENT_COMMANDS[agent] } },
     hooks: { provision: hooks, cleanup: hooks }
   };
   mkdirSync(dirname(configPath), { recursive: true });
+  const stored = credential === void 0 ? void 0 : { variable: credential.variable, path: storeClaudeCredential(configPath, credential) };
   writeFileSync(configPath, `${JSON.stringify(config, null, 2)}
 `, { mode: RUNNER_FILE_MODE });
-  return { configPath, hooks, ...hooks === "builtin:process" ? { note: isolationNote(machine) } : {} };
+  return { configPath, hooks, ...hooks === "builtin:process" ? { note: isolationNote(machine) } : {}, credential: stored };
 }
 
-export { PLACEHOLDER_MARKER, RunnerInitError, isPlaceholderCommand, readConfigObject, runRunnerInit };
+export { PLACEHOLDER_MARKER, RunnerInitError, isPlaceholderCommand, prepareRunnerInit, readConfigObject, runRunnerInit, writeRunnerInit };

package/dist/{chunk-E5DC4VZL.js → chunk-MZN7AQOB.js}

@@ -3,22 +3,22 @@ import { createRequire } from 'node:module';
 import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-3FMPZPJQ.js';
 import { startTimeOf, isSameProcess } from './chunk-N5FOE5PS.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
-import { createDockerHost, childEnvironment, spawnRun } from './chunk-2GBCTEN4.js';
+import { createDockerHost, childEnvironment, spawnRun } from './chunk-3KTA5UU2.js';
 import { RecipeError } from './chunk-QOZKPLVJ.js';
-import { builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, containerExecArgs } from './chunk-CJGQQZWB.js';
+import { builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, containerExecArgs } from './chunk-NX57IBNK.js';
 import { CLAUDE_CODE_VERSION, firecrackerArch, MICROVM_ARCHES, DEFAULT_BASE_IMAGE, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GUEST_ASSETS_VERSION } from './chunk-CX22S5BA.js';
 import { execCapture } from './chunk-QKFB4K7X.js';
 import { GUEST_CID } from './chunk-RSNSZ2LJ.js';
-import { WorkCommandError, postJson } from './chunk-DTDZXDQ3.js';
-import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-IU4NZROR.js';
+import { WorkCommandError, postJson } from './chunk-P4MM66C6.js';
+import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-JXYVA45C.js';
 import { hostAllowed } from './chunk-UXYLWVTQ.js';
 import { parseDuKilobytes } from './chunk-7RQ73DLO.js';
 import { repositoriesOf, primaryOf, RELAY_PORT, CHECKOUT_DIR, JOB_MOUNT, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, checkoutPath } from './chunk-4Q7OMKAT.js';
-import { defaultGitRunner, materializeContext } from './chunk-RWQWPZB4.js';
-import { readContextManifest, readSourceCache } from './chunk-BMX3L7CR.js';
-import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-TB7EP24C.js';
+import { defaultGitRunner, materializeContext } from './chunk-GI4XXD4I.js';
+import { readContextManifest, readSourceCache } from './chunk-LCEXHCHD.js';
+import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-2M63GG56.js';
 import { signingFetchFor } from './chunk-YO4PSLVB.js';
-import { downconvertSession } from './chunk-YT35WGIP.js';
+import { downconvertSession } from './chunk-J5M7BSJQ.js';
 import { signerFor } from './chunk-V7NIVOFD.js';
 import { rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, stagedContextDir, contextHomeDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, RUNNER_DIR_MODE, vmAssetsDir } from './chunk-ZM2IMMYN.js';
 import { relative, join, dirname, basename } from 'path';

package/dist/{chunk-CJGQQZWB.js → chunk-NX57IBNK.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { BUILDKIT_IMAGE } from './chunk-CX22S5BA.js';
-import { compareVersions } from './chunk-IU4NZROR.js';
+import { compareVersions } from './chunk-JXYVA45C.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
 import { JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_PORT, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-4Q7OMKAT.js';
 import { runnerDir } from './chunk-ZM2IMMYN.js';