@outerlayer/cli 0.12.0 → 0.13.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @outerlayer/cli
 
+## 0.13.0
+
+### Minor Changes
+
+- 76222d4: The starter `/build` skill no longer parses fixed shapes out of an issue. The agent reads the issue's acceptance criteria in any form and keeps their text as written. `record-criteria.mjs` now takes the agent's file with `--criteria-file`. It keeps the issue's ids when every criterion has one that fits the id grammar, and otherwise numbers them `AC-<item>-NN`. A partly numbered list is now numbered and recorded, not skipped. When an issue has no criteria, the build drafts them from the description and runs the script with `--drafted`, which records the list with `drafted: true`. `outerlayer emit criteria` reads an optional top-level `"drafted": true` from its file and sends it with the list.
+- 07677fd: `outerlayer runner init` creates the runner's API key from your login when the config file has none. It uses the Runner preset, names the key after the machine (`--key-name` to override), creates it on the factory `--app-id` names, and checks it before any VM or service step. On a Mac with `--vm`, the key goes straight into the VM and is never written on the Mac. A login that cannot create keys gets a refusal naming the pasted-key path, which still works as before.
+
+### Patch Changes
+
+- b831165: Fix rough edges a first-time user meets. `init` writes an MCP server entry that runs through npx, so it starts without a global install, and `doctor` warns when the entry's command is not on PATH. `init` marks a connection whose repository still needs linking with `!` and names the factory by its slug. `login` suggests `init` in a repository that is not set up. `doctor` warns when a factory has no connected repository, stops listing one Claude Code install twice, and says the first hook run creates the spool. `work build` names the item and the issue separately, prints the item's page, and honours NO_COLOR and non-terminal output. A runner keeps the build's item key in its own owner-only file instead of `job.json`. The starter build skill uses the branch a host allows, and the code review check says the report's link can take a minute to appear. `runner init`, `runner check` and `runner start` refuse an empty or blank runner key or factory id, or one still holding a `<...>` placeholder, naming the field and the config file.
+- 836d0e0: A validator file can no longer declare `artifact`, `finding` or `findings` as its emit name, the same as `criteria`. Each is an `outerlayer emit` subcommand, so `outerlayer emit <name>` ran the subcommand and the check could never be recorded. A file that declares one now fails to load with a policy error naming the subcommand.
+
 ## 0.12.0
 
 ### Minor Changes

package/README.md

@@ -142,9 +142,14 @@ content:
   request it makes with the host key, the way the runner does. The signature
   covers the request's method, path, query and body, and adds nothing else
   to it.
-- **`outerlayer runner init`** makes no network call, except `runner init --vm`
-  on a Mac. That runs `limactl`, and Lima downloads a Linux VM image. Inside
-  the VM, `apt` downloads Node and `npm` downloads this CLI. Your runner key goes to the VM on the standard
+- **`outerlayer runner init`** makes no network call when the config file
+  already holds a runner key. With no key there and a saved login, it
+  creates one: `POST /v1/api-keys` with your login's token, sending the key's
+  name (this machine's name, or `--key-name`), the Runner preset's
+  permissions and the factory id. It then checks the new key, unsigned, with
+  `GET /v1/runner/host-key`. `runner init --vm` on a Mac also runs `limactl`,
+  and Lima downloads a Linux VM image. Inside the VM, `apt` downloads Node and
+  `npm` downloads this CLI. Your runner key goes to the VM on the standard
   input of a `limactl shell` command and is never a file or an argument on the
   Mac.
 - **`outerlayer login`**, with no key on stdin, signs in to your account by
@@ -386,7 +391,7 @@ before it gives up.
 | `outerlayer work claim --item <n>\|--issue <n> --kind implement\|amend [--repo] [--host] [--seconds]` | Records a lease for this host (default: its own hostname), so two hosts never build the same item at once. The lease belongs to the runner key that claimed it: a live lease held by a different key is refused, even under the same host name, and claiming again with the same key extends it. The first claim creates the host key (`host-key.pem` beside the config file) and binds the runner key to it; from then on every request made with that key is signed. Lease length defaults to 900 seconds, the server's own cap. |
 | `outerlayer work renew --item <n>\|--issue <n> [--repo] [--host] [--seconds]` | Extends this host's own live lease. Refused if the lease has expired, or if a different runner key holds it (403 `claim_not_held`). |
 | `outerlayer work release --item <n>\|--issue <n> [--repo] [--host] [--session-id] [--outcome]` | Marks the lease this API key holds released, optionally recording how the attempt ended. Releasing an already-released lease is a no-op that returns the recorded release time and outcome. Run inside a session with no `--host`, it releases that session's own lease instead (`--session-id` names the session when it cannot be detected), so the item's review opens without ending the session. |
-| `outerlayer runner init [--vm\|--no-vm] [--config <path>]` | Writes a `runner` block with defaults, keeping every key the config already had. It names `builtin:vm` on a Linux machine where the user can use `/dev/kvm` and Docker Engine can build images once the guest kernel and helper are published (not yet), `builtin:container` on that machine until then, `builtin:container` on any other machine with Docker Engine, and `builtin:process` on one without, and writes no hook script. Refuses rather than overwriting an existing block. On macOS it asks whether to create a Linux VM with Lima, installs Docker Engine and the runner in it, and starts both at login; `--vm` answers yes and `--no-vm` answers no, and a run with no terminal answers no. The runner key and the host key then live only in the VM: the Mac's config loses `apiKey` and `runner` and gains a `runnerVm` note, which `outerlayer doctor` reads. |
+| `outerlayer runner init [--vm\|--no-vm] [--app-id <id>] [--key-name <name>] [--config <path>]` | Writes a `runner` block with defaults, keeping every key the config already had. With no `apiKey` in the config and a saved login, it first creates a runner key from the login with the Runner preset, named after the machine or `--key-name`, on the factory `--app-id` names, and checks it before anything else changes. It names `builtin:vm` on a Linux machine where the user can use `/dev/kvm` and Docker Engine can build images once the guest kernel and helper are published (not yet), `builtin:container` on that machine until then, `builtin:container` on any other machine with Docker Engine, and `builtin:process` on one without, and writes no hook script. Refuses rather than overwriting an existing block. On macOS it asks whether to create a Linux VM with Lima, installs Docker Engine and the runner in it, and starts both at login; `--vm` answers yes and `--no-vm` answers no, and a run with no terminal answers no. The runner key and the host key then live only in the VM: the Mac's config loses `apiKey` and `runner` and gains a `runnerVm` note, which `outerlayer doctor` reads. |
 | `outerlayer runner check [--config <path>]` | Validates the config, the hooks and the key, prints the settings the runner would use, and exits non-zero on a problem. Takes no work and writes no pid file. |
 | `outerlayer runner start [--config <path>]` | Runs the loop: claim work, run it, sync, clean up, report, release with an outcome. Repeat. Reads the `runner` block from the config file (default `~/.outerlayer/config.json`). Refuses to start on a bad config, an unrunnable hook, or a refused key. |
 | `outerlayer runner image --repository <owner/name> [--remote <url>] [--config <path>] [--json]` | Builds the image a repository's builds run in. Fetches the head of the default branch into the runner's cache, builds its `.devcontainer/devcontainer.json` with the devcontainer CLI, ignores every setting that reaches the host or widens the container's privileges, and adds this CLI and a pinned Claude Code. Reuses the image until the recipe or the tools change, keeps the newest three, and writes `recipe.json` beside the image record. Refuses a Compose recipe (`recipe_needs_docker`) and a repository with only named configurations (`recipe_ambiguous`). |

package/dist/{agent-setup-52LRZ6AY.js → agent-setup-QE6PSCEZ.js}

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runEmit } from './chunk-G5XY6CVG.js';
-import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME } from './chunk-A56PYPDF.js';
-import { installStarterPack } from './chunk-ZQUCTFXC.js';
+import { runEmit } from './chunk-HDTVTA6I.js';
+import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME } from './chunk-R7OQTKWT.js';
+import { installStarterPack } from './chunk-DXQ5MHCO.js';
 import { C } from './chunk-YRYMNBGQ.js';
-import { resolveGitCommonDir, defaultGitRunner } from './chunk-SZOVKFWB.js';
+import { resolveGitCommonDir, defaultGitRunner } from './chunk-GI4XXD4I.js';
 import './chunk-ZJSNLVCE.js';
-import { loadTemplateFiles, loadMaintainedFiles, skillDir } from './chunk-FO7KKPYG.js';
-import { pinExists, readContextManifest } from './chunk-G5IEVZGI.js';
-import { generatedHeaderSource } from './chunk-AHZQBGD2.js';
+import { loadTemplateFiles, loadMaintainedFiles, skillDir } from './chunk-TCIW27FM.js';
+import { pinExists, readContextManifest } from './chunk-LCEXHCHD.js';
+import { generatedHeaderSource } from './chunk-2M63GG56.js';
 import './chunk-YO4PSLVB.js';
 import './chunk-PLMTLGYH.js';
-import './chunk-325272HM.js';
+import './chunk-J5M7BSJQ.js';
 import './chunk-EABW6AJQ.js';
 import './chunk-BYT5O5RV.js';
 import './chunk-RA3O54FC.js';

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-08T01:27:55.356Z+5a1c8e3","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-08T17:26:49.421Z+36ec792","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{builder-OF67QKDS.js → builder-UUS4ORDH.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-QEESCZ26.js';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-NX57IBNK.js';
 import './chunk-CX22S5BA.js';
-import './chunk-3ZPYPFNM.js';
+import './chunk-JXYVA45C.js';
 import './chunk-7RQ73DLO.js';
 import './chunk-4Q7OMKAT.js';
-import './chunk-325272HM.js';
+import './chunk-J5M7BSJQ.js';
 import './chunk-BYT5O5RV.js';
 import './chunk-ZM2IMMYN.js';
 import './chunk-Z5GEFMRW.js';

package/dist/{check-RJOJU2WA.js → check-63IDCEEV.js}

@@ -1,69 +1,69 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-G4RXNF2L.js';
-import './chunk-DVT73QJO.js';
+import { probeCredentials } from './chunk-SVEP7PVH.js';
+import './chunk-C6IV5BV7.js';
 import './chunk-O765JR4W.js';
 import './chunk-UGP76IZ5.js';
 import './chunk-3JVYMD4G.js';
-import './chunk-T6OIJQRT.js';
-import './chunk-I2UOAV7X.js';
 import './chunk-YETTWTAY.js';
+import './chunk-RMWLBUCJ.js';
+import './chunk-I2UOAV7X.js';
 import './chunk-FI5UYJMQ.js';
-import './chunk-5TGQHOUX.js';
-import './chunk-27Y7AX2O.js';
+import './chunk-XJKL4BNU.js';
+import './chunk-3D4OYFCD.js';
 import './chunk-HHJDN6AU.js';
 import './chunk-HYZRY4KZ.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem } from './chunk-PDRYXERC.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem } from './chunk-TOPDNXHZ.js';
 import './chunk-YYYRBYWG.js';
 import './chunk-TI7B7UEO.js';
 import './chunk-TBT347UY.js';
-import './chunk-GEBQXUFY.js';
-import './chunk-IBB4D4KE.js';
-import './chunk-SKHN72JO.js';
-import './chunk-VK25O2ZM.js';
-import './chunk-2KLBKHT4.js';
+import './chunk-MJXXRX4M.js';
+import './chunk-P6FX4D43.js';
+import './chunk-MZN7AQOB.js';
+import './chunk-T5VPP6H7.js';
+import './chunk-RLYZLUQ7.js';
 import { parseRunnerEnv } from './chunk-6MZSX4M7.js';
 import './chunk-3FMPZPJQ.js';
 import './chunk-N5FOE5PS.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-GGMRZPEA.js';
+import './chunk-3KTA5UU2.js';
 import './chunk-QOZKPLVJ.js';
-import './chunk-QEESCZ26.js';
+import './chunk-NX57IBNK.js';
 import './chunk-CX22S5BA.js';
 import './chunk-QKFB4K7X.js';
 import './chunk-RSNSZ2LJ.js';
 import './chunk-F7CU5ABH.js';
 import './chunk-BKO6JEZI.js';
-import './chunk-6FH2AHJY.js';
-import './chunk-GATMPAMK.js';
+import './chunk-P4MM66C6.js';
+import './chunk-EFZLAYPE.js';
 import './chunk-IP7BIBXJ.js';
-import './chunk-C7N4TDHW.js';
-import './chunk-JOXYKGUV.js';
-import './chunk-3ZPYPFNM.js';
-import './chunk-USO2DKBD.js';
+import './chunk-4QVZCVWT.js';
+import './chunk-CNFVHDHG.js';
+import './chunk-JXYVA45C.js';
+import './chunk-4KSQKQXE.js';
 import './chunk-N6LURUEF.js';
 import './chunk-YRYMNBGQ.js';
-import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-XR3BJN33.js';
+import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-22RMZBGW.js';
 import './chunk-UXYLWVTQ.js';
 import './chunk-7RQ73DLO.js';
 import './chunk-4Q7OMKAT.js';
 import './chunk-GQD22KKN.js';
 import './chunk-WZBHBH3J.js';
 import './chunk-5QRP3MVS.js';
-import './chunk-SZOVKFWB.js';
+import './chunk-GI4XXD4I.js';
 import './chunk-ZJSNLVCE.js';
-import './chunk-FO7KKPYG.js';
-import './chunk-G5IEVZGI.js';
-import './chunk-AHZQBGD2.js';
+import './chunk-TCIW27FM.js';
+import './chunk-LCEXHCHD.js';
+import './chunk-2M63GG56.js';
 import './chunk-YO4PSLVB.js';
 import './chunk-PLMTLGYH.js';
-import './chunk-325272HM.js';
+import './chunk-J5M7BSJQ.js';
 import './chunk-EABW6AJQ.js';
 import './chunk-BYT5O5RV.js';
 import './chunk-RA3O54FC.js';
 import './chunk-V7NIVOFD.js';
 import './chunk-ZM2IMMYN.js';
-import './chunk-YEQL54G5.js';
+import './chunk-SFFHGX3G.js';
 import './chunk-XCCLFVXM.js';
 import './chunk-BJ3KTMDH.js';
 import './chunk-VNVZDWO3.js';

package/dist/{chunk-XR3BJN33.js → chunk-22RMZBGW.js}

@@ -47,6 +47,23 @@ function defaultRunnerConfigPath(home = homeFromEnv()) {
 function fail(configPath, key, reason) {
   throw new RunnerConfigError(`${configPath}: ${key} ${reason}`);
 }
+var PLACEHOLDER = /[<>]/;
+function runnerCredentialProblem(config) {
+  for (const field of ["url", "apiKey", "appId"]) {
+    const value = config[field];
+    if (value === void 0) return { field, reason: "is missing" };
+    if (typeof value !== "string") return { field, reason: "is not text" };
+    if (value.trim() === "") return { field, reason: "is empty" };
+  }
+  if (PLACEHOLDER.test(config.apiKey)) {
+    return { field: "apiKey", reason: "is still a <...> placeholder. Put the factory's runner key there: an API key made with the Runner preset" };
+  }
+  const appId = config.appId;
+  if (PLACEHOLDER.test(appId)) {
+    return { field: "appId", reason: `is still the placeholder ${JSON.stringify(appId)}. Put the Factory Id from the factory's Settings \u2192 General there` };
+  }
+  return void 0;
+}
 function readConfigFile(configPath) {
   if (!existsSync(configPath)) return {};
   const text = readFileSync(configPath, "utf8");
@@ -171,6 +188,8 @@ function loadRunnerConfig(configPath) {
   if (!config.url || !config.apiKey || !config.appId) {
     fail(configPath, "url/apiKey/appId", "missing \u2014 pipe a factory key into `outerlayer login` for this config file first; a runner uses a factory key, never a person's login");
   }
+  const credentialProblem = runnerCredentialProblem(config);
+  if (credentialProblem !== void 0) fail(configPath, credentialProblem.field, credentialProblem.reason);
   const runner = config.runner;
   if (!runner) {
     fail(configPath, "runner", "block is missing");
@@ -379,4 +398,4 @@ function resolveBuild(configPath, block) {
   };
 }
 
-export { DEFAULT_CHECK_TIME_LIMIT_MINUTES, DEFAULT_UPDATE_MAX_WAIT_HOURS, RunnerConfigError, builtinKind, checkHooks, defaultRunnerConfigPath, hasRunnerBlock, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, loadRunnerConfig, resolveBuild, resolveHousekeeping, runnerVmOf };
+export { DEFAULT_CHECK_TIME_LIMIT_MINUTES, DEFAULT_UPDATE_MAX_WAIT_HOURS, RunnerConfigError, builtinKind, checkHooks, defaultRunnerConfigPath, hasRunnerBlock, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, loadRunnerConfig, resolveBuild, resolveHousekeeping, runnerCredentialProblem, runnerVmOf };

package/dist/{chunk-AHZQBGD2.js → chunk-2M63GG56.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RESERVED_EMIT_NAMES, ARTIFACT_KINDS, ArtifactCriterionIdSchema } from './chunk-325272HM.js';
+import { RESERVED_EMIT_NAMES, ARTIFACT_KINDS, ArtifactCriterionIdSchema } from './chunk-J5M7BSJQ.js';
 import { __commonJS, __require, __toESM } from './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);

package/dist/{chunk-27Y7AX2O.js → chunk-3D4OYFCD.js}

@@ -4,17 +4,17 @@ import { LaunchFilter } from './chunk-HHJDN6AU.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
 import { hookExecSpoolPath } from './chunk-F7CU5ABH.js';
 import { applyReportedCost } from './chunk-BKO6JEZI.js';
-import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-JOXYKGUV.js';
-import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-3ZPYPFNM.js';
+import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-CNFVHDHG.js';
+import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-JXYVA45C.js';
 import { C } from './chunk-YRYMNBGQ.js';
 import { readLaunchSpoolState, launchStatusIsDecisive, launchedItemsBySession, launchesPath } from './chunk-GQD22KKN.js';
 import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
 import { defaultFetch } from './chunk-YO4PSLVB.js';
 import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-PLMTLGYH.js';
-import { CAPTURE_TIERS, inferArtifactKind, bannedPathsForTier, downconvertSession, isHumanUserTurn, turnCountBound, EVENT_TYPES } from './chunk-325272HM.js';
+import { CAPTURE_TIERS, inferArtifactKind, bannedPathsForTier, downconvertSession, isHumanUserTurn, turnCountBound, EVENT_TYPES } from './chunk-J5M7BSJQ.js';
 import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-EABW6AJQ.js';
 import { signerFor, signRunnerRequest } from './chunk-V7NIVOFD.js';
-import { writeSyncStatus, spoolDir } from './chunk-YEQL54G5.js';
+import { writeSyncStatus, spoolDir } from './chunk-SFFHGX3G.js';
 import { removeJournalHooks } from './chunk-XCCLFVXM.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-GGMRZPEA.js → chunk-3KTA5UU2.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { RecipeError } from './chunk-QOZKPLVJ.js';
-import { trackImageBuild, isOutOfMemory, ensureBuilder } from './chunk-QEESCZ26.js';
+import { trackImageBuild, isOutOfMemory, ensureBuilder } from './chunk-NX57IBNK.js';
 import { spawn } from 'child_process';
 import { existsSync, mkdirSync, createWriteStream, rmSync, readFileSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-USO2DKBD.js → chunk-4KSQKQXE.js}

@@ -3,6 +3,7 @@ import { createRequire } from 'node:module';
 import { revokeTokenOnDashboard } from './chunk-N6LURUEF.js';
 import { C } from './chunk-YRYMNBGQ.js';
 import { readCloudConfig, writeCloudConfig, cloudConfigPath } from './chunk-EABW6AJQ.js';
+import { findGitDirs } from './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { generateKeyPairSync, privateDecrypt, constants, createPrivateKey } from 'crypto';
 import { spawn } from 'child_process';
@@ -269,14 +270,19 @@ async function finishApproved(flags, deps, home, dashboard, approved, privateKey
   }
   deps.stdout.write(
     `${C.green}\u2713${C.reset} Logged in as ${approved.email}. Saved the login to ${path}
-Next: run \`outerlayer connect\` to choose a factory.
-`
+` + nextAfterLogin(deps.cwd ?? process.cwd())
   );
   if (before.apiKey) {
     deps.stdout.write("A factory key is also saved on this machine, so commands here keep using the key, not this login.\n");
   }
   return 0;
 }
+function nextAfterLogin(cwd) {
+  const dirs = findGitDirs(cwd);
+  if (dirs === void 0) return "Next: in your repository, run `outerlayer init --factory <org>/<factory>`.\n";
+  if (existsSync(join(dirs.repoRoot, ".outerlayer"))) return "Next: run `outerlayer connect` to choose a factory.\n";
+  return "Next: run `outerlayer init --factory <org>/<factory>` to set up this repository.\n";
+}
 function fail(deps, message) {
   deps.stderr.write(`${C.red}\u2717${C.reset} ${message}
 `);

package/dist/{chunk-C7N4TDHW.js → chunk-4QVZCVWT.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { sanitizeTerminal } from './chunk-JOXYKGUV.js';
-import { remoteLookupFailed } from './chunk-3ZPYPFNM.js';
-import { DEFAULT_DASHBOARD } from './chunk-USO2DKBD.js';
+import { sanitizeTerminal } from './chunk-CNFVHDHG.js';
+import { remoteLookupFailed } from './chunk-JXYVA45C.js';
+import { DEFAULT_DASHBOARD } from './chunk-4KSQKQXE.js';
 import { resolveGatewayCredentials } from './chunk-PLMTLGYH.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
 import { writeRepoConnection, findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
@@ -181,7 +181,7 @@ function saveFactoryConnection(gitCommonDir, saved, factory, now) {
   });
 }
 function connectedLine(repository, factory, reason) {
-  return `Connected ${repository} to factory "${factory.displayName}" in ${factory.organization.displayName} (${REASON_TEXT[reason]}).`;
+  return `Connected ${repository} to factory "${factory.displayName}" (${slug(factory)}) in ${factory.organization.displayName} (${REASON_TEXT[reason]}).`;
 }
 function autoConnectedLine(repository, factory, reason) {
   return `Using factory "${factory.displayName}" in ${factory.organization.displayName} for ${repository} (${REASON_TEXT[reason]}); saved for this checkout.`;
@@ -310,4 +310,4 @@ ${COMMIT_LINE}
   return r.code;
 }
 
-export { COMMIT_LINE, autoConnectedLine, fetchFactories, isLinkedRepository, promptOnTerminal, realConnectDeps, runConnect, runConnectCommand, saveFactoryConnection, selectFactory };
+export { COMMIT_LINE, autoConnectedLine, fetchFactories, isLinkedRepository, promptOnTerminal, realConnectDeps, runConnect, runConnectCommand, saveFactoryConnection, selectFactory, workPageUrl };

package/dist/{chunk-NPXQXYVA.js → chunk-6S3H3J6H.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { autoConnect } from './chunk-GATMPAMK.js';
+import { autoConnect } from './chunk-EFZLAYPE.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { resolveRepoIdentity } from './chunk-3ZPYPFNM.js';
+import { resolveRepoIdentity } from './chunk-JXYVA45C.js';
 import { parseWorkItemEnv } from './chunk-GQD22KKN.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { defaultFetch } from './chunk-YO4PSLVB.js';

package/dist/{chunk-DVT73QJO.js → chunk-C6IV5BV7.js}

@@ -1,23 +1,23 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { writeJobFile, readJobFile } from './chunk-T6OIJQRT.js';
-import { senderPidfile } from './chunk-5TGQHOUX.js';
-import { installScrubContext } from './chunk-27Y7AX2O.js';
+import { writeJobFile, readJobFile } from './chunk-RMWLBUCJ.js';
+import { senderPidfile } from './chunk-XJKL4BNU.js';
+import { installScrubContext } from './chunk-3D4OYFCD.js';
 import { DOCKERD_LOG } from './chunk-HYZRY4KZ.js';
-import { AssetError, describeCallFailure, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, refusalCode, resolveAgentUser, AgentUserError, runBuildSteps, removeStagedContext, stageGovernedContext, shellQuote, createRunnerLog, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, formatDuration, retrySend, formatClock, containerSenderCommand, syncInContainer, copyTranscriptsFromContainer, GH_CONFIG_YML, ghHostsYml, ADDED_USER, isLiteralAddress, signalInContainer, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript } from './chunk-SKHN72JO.js';
+import { AssetError, describeCallFailure, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, refusalCode, resolveAgentUser, AgentUserError, runBuildSteps, removeStagedContext, stageGovernedContext, shellQuote, createRunnerLog, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, formatDuration, retrySend, formatClock, containerSenderCommand, syncInContainer, copyTranscriptsFromContainer, GH_CONFIG_YML, ghHostsYml, ADDED_USER, isLiteralAddress, signalInContainer, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript } from './chunk-MZN7AQOB.js';
 import { readBranchHead, diffBetween, fetchCommit } from './chunk-3FMPZPJQ.js';
 import { isSameProcess, startTimeOf } from './chunk-N5FOE5PS.js';
-import { childEnvironment } from './chunk-GGMRZPEA.js';
+import { childEnvironment } from './chunk-3KTA5UU2.js';
 import { CLAUDE_CODE_VERSION } from './chunk-CX22S5BA.js';
 import { waitForAgent, vmExecArgs } from './chunk-QKFB4K7X.js';
 import { socketPathProblem, vsockLinks, linkVsockSockets } from './chunk-RSNSZ2LJ.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-6FH2AHJY.js';
-import { planArtifactUpload } from './chunk-JOXYKGUV.js';
-import { scrubText } from './chunk-3ZPYPFNM.js';
-import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-XR3BJN33.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-P4MM66C6.js';
+import { planArtifactUpload } from './chunk-CNFVHDHG.js';
+import { scrubText } from './chunk-JXYVA45C.js';
+import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-22RMZBGW.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
 import { claudeCredential, repositoriesOf, primaryOf, buildEnvironment, JOB_MOUNT, CHECKOUT_DIR, parseIsolation, proxyEnvironment, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, withTunnelRecord, RELAY_PORT, checkEnvironment, EVAL_INPUT_DIR } from './chunk-4Q7OMKAT.js';
-import { parsePolicy } from './chunk-AHZQBGD2.js';
+import { parsePolicy } from './chunk-2M63GG56.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
 import { withHooksPath, authorEnvironment, commitIdentityRecord } from './chunk-BYT5O5RV.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';

package/dist/{chunk-JOXYKGUV.js → chunk-CNFVHDHG.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { ArtifactTombstoneRecordSchema, ArtifactSpoolRecordSchema } from './chunk-325272HM.js';
+import { ArtifactTombstoneRecordSchema, ArtifactSpoolRecordSchema } from './chunk-J5M7BSJQ.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, appendFileSync, writeFileSync, renameSync, unlinkSync, existsSync, readdirSync, readFileSync, statSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-ANW7VHMH.js → chunk-DPKX26LT.js}

@@ -1,22 +1,22 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readStatuslineState, STATE_FRESH_MS } from './chunk-F47JBIAW.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-6FH2AHJY.js';
-import { isLinkedRepository } from './chunk-C7N4TDHW.js';
-import { sanitizeTerminal } from './chunk-JOXYKGUV.js';
-import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-3ZPYPFNM.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-P4MM66C6.js';
+import { isLinkedRepository } from './chunk-4QVZCVWT.js';
+import { sanitizeTerminal } from './chunk-CNFVHDHG.js';
+import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-JXYVA45C.js';
 import { C } from './chunk-YRYMNBGQ.js';
 import { readSettings, settingsPath, isOurStatuslineSlot, statuslineWrappedOriginal, REGISTERED_EVENTS, isOurHookCommand, ourCommandBins, cliBinResolvable, ourDirectScriptBins, wrappedOriginalCommand } from './chunk-5QRP3MVS.js';
-import { readPin, readContextManifest, readDegraded, readSourceCache } from './chunk-G5IEVZGI.js';
+import { readPin, readContextManifest, readDegraded, readSourceCache } from './chunk-LCEXHCHD.js';
 import { defaultFetch } from './chunk-YO4PSLVB.js';
 import { resolveGatewayCredentials } from './chunk-PLMTLGYH.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
-import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-YEQL54G5.js';
+import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-SFFHGX3G.js';
 import { deadHooksState, preparePackageManagerCommand, contextExcludesPresent } from './chunk-XCCLFVXM.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { readFileSync, mkdirSync, writeFileSync, renameSync, existsSync, accessSync, constants, statSync, readdirSync } from 'fs';
-import { join, dirname } from 'path';
+import { readFileSync, mkdirSync, writeFileSync, renameSync, existsSync, accessSync, constants, statSync, readdirSync, realpathSync } from 'fs';
+import { join, dirname, resolve, delimiter } from 'path';
 import { execFileSync } from 'child_process';
 
 createRequire(import.meta.url);
@@ -113,6 +113,57 @@ function recordStatusline(home, settingsPath2, outcome, original, now = Date.now
     };
   });
 }
+var NAME = "MCP server";
+var SERVER = "outerlayer";
+var NPX_FIX = 'Change the "outerlayer" entry in .mcp.json to run `npx -y @outerlayer/cli mcp serve`, or install the CLI with `npm install -g @outerlayer/cli`.';
+function expand(value, env) {
+  return value.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (_m, name) => env[name] ?? "");
+}
+function isExecutableFile(path, platform) {
+  try {
+    if (!statSync(path).isFile()) return false;
+    if (platform !== "win32") accessSync(path, constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function resolveCommand(command, root, env, platform) {
+  if (/[\\/]/.test(command)) {
+    const path = resolve(root, command);
+    return isExecutableFile(path, platform) ? path : void 0;
+  }
+  const exts = platform === "win32" ? ["", ...(env.PATHEXT ?? ".EXE;.CMD;.BAT").split(";")] : [""];
+  for (const dir of (env.PATH ?? "").split(delimiter)) {
+    for (const ext of exts) {
+      const candidate = join(dir, command + ext);
+      if (isExecutableFile(candidate, platform)) return candidate;
+    }
+  }
+  return void 0;
+}
+function checkMcpCommand(cwd, env = process.env, platform = process.platform) {
+  const root = findGitDirs(cwd ?? process.cwd())?.repoRoot;
+  if (root === void 0) return [];
+  const path = join(root, ".mcp.json");
+  if (!existsSync(path)) return [];
+  let entry;
+  try {
+    entry = JSON.parse(readFileSync(path, "utf8")).mcpServers?.[SERVER];
+  } catch {
+    return [{ name: NAME, status: "warn", detail: ".mcp.json is not valid JSON, so the agent starts none of its servers", fix: "Fix the JSON syntax in .mcp.json." }];
+  }
+  const command = entry?.command;
+  if (typeof command !== "string") return [];
+  const shown = sanitizeTerminal(command);
+  const resolved = resolveCommand(expand(command, env), root, env, platform);
+  if (resolved === void 0) {
+    return [{ name: NAME, status: "warn", detail: `the "outerlayer" server runs \`${shown}\`, which is not on PATH here, so the agent has no OuterLayer tools`, fix: NPX_FIX }];
+  }
+  return [{ name: NAME, status: "pass", detail: `the "outerlayer" server runs ${sanitizeTerminal(resolved)}` }];
+}
+
+// src/doctor.ts
 var LAPTOP_CHECKS_NOT_APPLICABLE = {
   name: "Laptop checks",
   status: "skipped",
@@ -135,6 +186,7 @@ function runDoctor(env = {}) {
     checkSettingsValid(home, env.cwd),
     ...laptop ? checkStatusline(home, now, env.cwd) : [],
     ...checkInstalls(env),
+    ...laptop ? checkMcpCommand(env.cwd, env.processEnv) : [],
     ...checkContextSource(home, env.cwd),
     ...checkInstalledCli(home, env.cwd ?? process.cwd())
   ];
@@ -462,7 +514,9 @@ function checkDeadHooksState(cwd) {
 function checkSpoolWritable(home) {
   const dir = spoolDir(home);
   try {
-    if (!existsSync(dir)) return { name: "Spool writable", status: "warn", detail: "spool not created yet", fix: "Run `outerlayer init` (creates the spool on first hook)." };
+    if (!existsSync(dir)) {
+      return { name: "Spool writable", status: "warn", detail: "spool not created yet", fix: "The first hook run creates it: start a Claude Code session in the repository." };
+    }
     accessSync(dir, constants.W_OK);
     return { name: "Spool writable", status: "pass", detail: dir };
   } catch {
@@ -561,10 +615,25 @@ function checkSettingsValid(home, cwd) {
   }
   return { name: "Settings JSON valid", status: "pass", detail: "all settings files parse" };
 }
+function distinctInstalls(paths) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const path of paths) {
+    let real = path;
+    try {
+      real = realpathSync(path);
+    } catch {
+    }
+    if (seen.has(real)) continue;
+    seen.add(real);
+    out.push(path);
+  }
+  return out;
+}
 function checkInstalls(env) {
   let installs;
   try {
-    installs = (env.claudeInstalls ?? defaultClaudeInstalls)();
+    installs = distinctInstalls((env.claudeInstalls ?? defaultClaudeInstalls)());
   } catch {
     return [];
   }
@@ -708,7 +777,14 @@ async function githubAppChecks(options = {}) {
     return [{ name: "GitHub App", status: "warn", detail: "the gateway's answer listed no repositories", fix: "Update the outerlayer CLI and the gateway to the same release." }];
   }
   if (data.length === 0) {
-    return [{ name: "GitHub App", status: "pass", detail: "the factory has no connected repositories" }];
+    return [
+      {
+        name: "GitHub App",
+        status: "warn",
+        detail: "the factory has no connected repositories, so it cannot build or check any work",
+        fix: `On the factory's Work page, choose Connect GitHub repository, then Link repository: ${CONNECT_REPOSITORY_DOCS}`
+      }
+    ];
   }
   return data.map(repositoryAccessCheck);
 }
@@ -1004,7 +1080,7 @@ function doctorExitCode(checks) {
 
 // src/doctor-report.ts
 async function gatherDoctorChecks() {
-  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-MKBX2ZQD.js');
+  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-N3C6DFQA.js');
   const configPath = defaultRunnerConfigPath();
   const checks = runDoctor({ runnerHost: hasRunnerBlock(configPath) });
   const credential = await credentialChecks();
@@ -1016,7 +1092,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-4FFXTQJ2.js');
+    const { runnerHostChecks } = await import('./doctor-3H25Q7WT.js');
     const hooks = (() => {
       try {
         return loadRunnerConfig(configPath).hooks;
@@ -1048,10 +1124,10 @@ async function gatherDoctorChecks() {
       }
     })();
     const service = await (async () => {
-      const { existsSync: existsSync2 } = await import('fs');
-      if (process.platform !== "linux" || !existsSync2("/run/systemd/system")) return void 0;
+      const { existsSync: existsSync3 } = await import('fs');
+      if (process.platform !== "linux" || !existsSync3("/run/systemd/system")) return void 0;
       const { inspectService, realInspectProbes } = await import('./inspect-6UYAAXH7.js');
-      const { DEFAULT_UNIT_NAME } = await import('./install-VXXI7UR6.js');
+      const { DEFAULT_UNIT_NAME } = await import('./install-HDBIPHTX.js');
       const { dirname: dirname2 } = await import('path');
       return inspectService(DEFAULT_UNIT_NAME, dirname2(configPath), realInspectProbes());
     })();

package/dist/{chunk-ZQUCTFXC.js → chunk-DXQ5MHCO.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { C } from './chunk-YRYMNBGQ.js';
-import { resolvePackRoot, loadTemplateFiles, loadMaintainedFiles, TEMPLATE_SKILLS, skillDir, writeMaintainedFiles, MAINTAINED_SKILLS } from './chunk-FO7KKPYG.js';
+import { resolvePackRoot, loadTemplateFiles, loadMaintainedFiles, TEMPLATE_SKILLS, skillDir, writeMaintainedFiles, MAINTAINED_SKILLS } from './chunk-TCIW27FM.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
 import { readFileSync, existsSync, mkdirSync, writeFileSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-GATMPAMK.js → chunk-EFZLAYPE.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-C7N4TDHW.js';
-import { resolveRepoIdentity } from './chunk-3ZPYPFNM.js';
+import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-4QVZCVWT.js';
+import { resolveRepoIdentity } from './chunk-JXYVA45C.js';
 import { resolveGatewayCredentials } from './chunk-PLMTLGYH.js';
 import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-SZOVKFWB.js → chunk-GI4XXD4I.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
-import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-FO7KKPYG.js';
-import { readPin, pinExists, readBuildHold, readContextManifest, manifestFilesPresent, writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, SOURCE_CACHE_TTL_SUCCESS_MS, isLastCheckFresh, readDegraded, touchLastCheck, clearDegraded, writeContextManifest, writePinIfChanged, readSourceCache, isSourceCacheFresh } from './chunk-G5IEVZGI.js';
-import { normalizeRepoName, parseGoverns, CONTEXT_SOURCE_CONFIG_PATH, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-AHZQBGD2.js';
+import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-TCIW27FM.js';
+import { readPin, pinExists, readBuildHold, readContextManifest, manifestFilesPresent, writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, SOURCE_CACHE_TTL_SUCCESS_MS, isLastCheckFresh, readDegraded, touchLastCheck, clearDegraded, writeContextManifest, writePinIfChanged, readSourceCache, isSourceCacheFresh } from './chunk-LCEXHCHD.js';
+import { normalizeRepoName, parseGoverns, CONTEXT_SOURCE_CONFIG_PATH, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-2M63GG56.js';
 import { defaultFetch } from './chunk-YO4PSLVB.js';
 import { resolveGatewayCredentials } from './chunk-PLMTLGYH.js';
 import { withTokenHeader } from './chunk-BYT5O5RV.js';