@outerlayer/cli 0.12.0 → 0.13.0

package/dist/{chunk-G5XY6CVG.js → chunk-HDTVTA6I.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { maintainedFilesForExistingSkills, loadMaintainedFiles, writeMaintainedFiles } from './chunk-FO7KKPYG.js';
-import { emitTree, parseOuterlayerConfig, classifyTree, generatedHeaderSource, CONTEXT_PIN_FILENAME, normalizePath } from './chunk-AHZQBGD2.js';
+import { maintainedFilesForExistingSkills, loadMaintainedFiles, writeMaintainedFiles } from './chunk-TCIW27FM.js';
+import { emitTree, parseOuterlayerConfig, classifyTree, generatedHeaderSource, CONTEXT_PIN_FILENAME, normalizePath } from './chunk-2M63GG56.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, copyFileSync, readdirSync } from 'fs';
 import { join, dirname, relative, sep } from 'path';
 

package/dist/{chunk-325272HM.js → chunk-J5M7BSJQ.js}

@@ -22273,9 +22273,14 @@ var ArtifactTombstoneRecordSchema = external_exports.looseObject({
 });
 external_exports.union([ArtifactSpoolRecordSchema, ArtifactTombstoneRecordSchema]);
 var EMITTED_RESULTS = ["pass", "fail"];
-var RESERVED_EMIT_NAMES = ["criteria"];
-var EmittedNameSchema = external_exports.string().regex(/^[a-z][a-z0-9._-]{0,63}$/).refine((name) => !RESERVED_EMIT_NAMES.includes(name), {
-  message: "is reserved: `outerlayer emit criteria` records a work item's acceptance criteria"
+var RESERVED_EMIT_NAMES = ["artifact", "criteria", "finding", "findings"];
+var EmittedNameSchema = external_exports.string().regex(/^[a-z][a-z0-9._-]{0,63}$/).superRefine((name, ctx) => {
+  if (RESERVED_EMIT_NAMES.includes(name)) {
+    ctx.addIssue({
+      code: "custom",
+      message: `is reserved: \`outerlayer emit ${name}\` is a subcommand, so a check cannot be recorded under that name`
+    });
+  }
 });
 var EMITTED_RESULT_MAX_LINK_LENGTH = 500;
 var EMITTED_RESULT_MAX_BODY_LENGTH = 2e3;
@@ -22292,6 +22297,7 @@ var CriterionSchema = external_exports.object({
   proof: external_exports.enum(ARTIFACT_KINDS).nullable()
 }).strict();
 var CriteriaArraySchema = external_exports.array(CriterionSchema).min(1).max(CRITERIA_MAX);
+var DraftedSchema = external_exports.boolean().optional();
 function refuseDuplicateIds(criteria, ctx) {
   const seen = /* @__PURE__ */ new Set();
   criteria.forEach((criterion, index) => {
@@ -22305,9 +22311,10 @@ function refuseDuplicateIds(criteria, ctx) {
     seen.add(criterion.id);
   });
 }
-var CriteriaListSchema = external_exports.object({ criteria: CriteriaArraySchema }).strict().superRefine((list, ctx) => refuseDuplicateIds(list.criteria, ctx));
+var CriteriaListSchema = external_exports.object({ criteria: CriteriaArraySchema, drafted: DraftedSchema }).strict().superRefine((list, ctx) => refuseDuplicateIds(list.criteria, ctx));
 external_exports.object({
   criteria: CriteriaArraySchema,
+  drafted: DraftedSchema,
   item: external_exports.object({ number: external_exports.number().int().positive() }).optional(),
   sessionId: external_exports.string().optional()
 }).superRefine((request, ctx) => refuseDuplicateIds(request.criteria, ctx));

package/dist/{chunk-3ZPYPFNM.js → chunk-JXYVA45C.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { EVENT_TYPES, isHumanUserTurn, parseAgentSession, SCHEMA_VERSION, SPEED_MAX_LENGTH, inputBandOf, BUCKET_MODEL_MAX_LENGTH } from './chunk-325272HM.js';
+import { EVENT_TYPES, isHumanUserTurn, parseAgentSession, SCHEMA_VERSION, SPEED_MAX_LENGTH, inputBandOf, BUCKET_MODEL_MAX_LENGTH } from './chunk-J5M7BSJQ.js';
 import { createHash } from 'crypto';
 import { readFileSync, readdirSync, statSync, mkdirSync, copyFileSync, renameSync, unlinkSync, writeFileSync, stat as stat$1, unwatchFile, watchFile, watch as watch$1 } from 'fs';
 import { type, homedir } from 'os';

package/dist/{chunk-G5IEVZGI.js → chunk-LCEXHCHD.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { CONTEXT_PIN_SCHEMA_VERSION, CONTEXT_PIN_FILENAME } from './chunk-AHZQBGD2.js';
+import { CONTEXT_PIN_SCHEMA_VERSION, CONTEXT_PIN_FILENAME } from './chunk-2M63GG56.js';
 import { readFileSync, existsSync, writeFileSync, mkdirSync, utimesSync, statSync, unlinkSync } from 'fs';
 import { join, dirname } from 'path';
 

package/dist/{chunk-GEBQXUFY.js → chunk-MJXXRX4M.js}

@@ -1,9 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-IBB4D4KE.js';
-import { MIN_ENGINE_MAJOR } from './chunk-SKHN72JO.js';
-import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-VK25O2ZM.js';
-import { RUNNER_DIR_MODE, runnerDir, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-P6FX4D43.js';
+import { MIN_ENGINE_MAJOR } from './chunk-MZN7AQOB.js';
+import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-T5VPP6H7.js';
+import { runnerCredentialProblem } from './chunk-22RMZBGW.js';
+import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import { dirname } from 'path';
 
@@ -61,9 +62,8 @@ function parseStdinConfig(configPath, text) {
   } catch (err) {
     throw new RunnerInitError(`the config on stdin is not valid JSON (${err instanceof Error ? err.message : String(err)})`);
   }
-  if (typeof config.url !== "string" || typeof config.apiKey !== "string" || typeof config.appId !== "string") {
-    throw new RunnerInitError("the config on stdin needs url, apiKey and appId.");
-  }
+  const problem = runnerCredentialProblem(config);
+  if (problem !== void 0) throw new RunnerInitError(`the config on stdin: ${problem.field} ${problem.reason}.`);
   const carried = config.runner;
   const credential = handedCredential(config.claudeCredential);
   const agent = handedAgent(config.agent);
@@ -73,15 +73,22 @@ function parseStdinConfig(configPath, text) {
   return { config, carried, credential, agent };
 }
 function runRunnerInit(configPath, opts = {}) {
+  return writeRunnerInit(prepareRunnerInit(configPath, opts));
+}
+function prepareRunnerInit(configPath, opts = {}) {
   let config;
   let carried;
   let credential = opts.credential;
   let agent = opts.agent;
+  let needsKey = false;
   if (opts.configFromStdin === void 0) {
-    config = readConfigObject(configPath);
+    config = opts.keyFromLogin === true && !existsSync(configPath) ? {} : readConfigObject(configPath);
     if (config.runner !== void 0) {
       throw new RunnerInitError(`${configPath}: a runner block is already here. Edit it, or remove it and run this again.`);
     }
+    needsKey = opts.keyFromLogin === true && config.apiKey === void 0;
+    const problem = needsKey ? void 0 : runnerCredentialProblem(config);
+    if (problem !== void 0) throw new RunnerInitError(`${configPath}: ${problem.field} ${problem.reason}.`);
   } else {
     const handed = parseStdinConfig(configPath, opts.configFromStdin);
     ({ config, carried } = handed);
@@ -100,7 +107,14 @@ function runRunnerInit(configPath, opts = {}) {
       "--agent claude needs Claude's credential, and none was piped on stdin or is in the runner.env beside the config. Pipe a token from `claude setup-token`, or an Anthropic API key: printf '%s' \"$CLAUDE_CODE_OAUTH_TOKEN\" | outerlayer runner init --agent claude"
     );
   }
-  if (opts.configFromStdin !== void 0) mkdirSync(dirname(configPath), { recursive: true, mode: RUNNER_DIR_MODE });
+  return { configPath, config, carried, credential, agent, machine, hooks, needsKey };
+}
+function writeRunnerInit(prepared, runnerKey) {
+  const { configPath, config, carried, credential, agent, machine, hooks } = prepared;
+  if (prepared.needsKey && runnerKey === void 0) {
+    throw new RunnerInitError(`${configPath}: apiKey is missing, and no runner key was created from the login.`);
+  }
+  if (runnerKey !== void 0) Object.assign(config, { url: runnerKey.url, apiKey: runnerKey.apiKey, appId: runnerKey.appId });
   mkdirSync(runnerDir(configPath), { recursive: true, mode: RUNNER_DIR_MODE });
   config.runner = {
     queues: ["implement", "amend"],
@@ -127,4 +141,4 @@ function runRunnerInit(configPath, opts = {}) {
   return { configPath, hooks, ...hooks === "builtin:process" ? { note: isolationNote(machine) } : {}, credential: stored };
 }
 
-export { PLACEHOLDER_MARKER, RunnerInitError, isPlaceholderCommand, readConfigObject, runRunnerInit };
+export { PLACEHOLDER_MARKER, RunnerInitError, isPlaceholderCommand, prepareRunnerInit, readConfigObject, runRunnerInit, writeRunnerInit };

package/dist/{chunk-SKHN72JO.js → chunk-MZN7AQOB.js}

@@ -3,22 +3,22 @@ import { createRequire } from 'node:module';
 import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-3FMPZPJQ.js';
 import { startTimeOf, isSameProcess } from './chunk-N5FOE5PS.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
-import { createDockerHost, childEnvironment, spawnRun } from './chunk-GGMRZPEA.js';
+import { createDockerHost, childEnvironment, spawnRun } from './chunk-3KTA5UU2.js';
 import { RecipeError } from './chunk-QOZKPLVJ.js';
-import { builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, containerExecArgs } from './chunk-QEESCZ26.js';
+import { builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, containerExecArgs } from './chunk-NX57IBNK.js';
 import { CLAUDE_CODE_VERSION, firecrackerArch, MICROVM_ARCHES, DEFAULT_BASE_IMAGE, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GUEST_ASSETS_VERSION } from './chunk-CX22S5BA.js';
 import { execCapture } from './chunk-QKFB4K7X.js';
 import { GUEST_CID } from './chunk-RSNSZ2LJ.js';
-import { WorkCommandError, postJson } from './chunk-6FH2AHJY.js';
-import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-3ZPYPFNM.js';
+import { WorkCommandError, postJson } from './chunk-P4MM66C6.js';
+import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-JXYVA45C.js';
 import { hostAllowed } from './chunk-UXYLWVTQ.js';
 import { parseDuKilobytes } from './chunk-7RQ73DLO.js';
 import { repositoriesOf, primaryOf, RELAY_PORT, CHECKOUT_DIR, JOB_MOUNT, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, checkoutPath } from './chunk-4Q7OMKAT.js';
-import { defaultGitRunner, materializeContext } from './chunk-SZOVKFWB.js';
-import { readContextManifest, readSourceCache } from './chunk-G5IEVZGI.js';
-import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-AHZQBGD2.js';
+import { defaultGitRunner, materializeContext } from './chunk-GI4XXD4I.js';
+import { readContextManifest, readSourceCache } from './chunk-LCEXHCHD.js';
+import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-2M63GG56.js';
 import { signingFetchFor } from './chunk-YO4PSLVB.js';
-import { downconvertSession } from './chunk-325272HM.js';
+import { downconvertSession } from './chunk-J5M7BSJQ.js';
 import { signerFor } from './chunk-V7NIVOFD.js';
 import { rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, stagedContextDir, contextHomeDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, RUNNER_DIR_MODE, vmAssetsDir } from './chunk-ZM2IMMYN.js';
 import { relative, join, dirname, basename } from 'path';

package/dist/{chunk-QEESCZ26.js → chunk-NX57IBNK.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { BUILDKIT_IMAGE } from './chunk-CX22S5BA.js';
-import { compareVersions } from './chunk-3ZPYPFNM.js';
+import { compareVersions } from './chunk-JXYVA45C.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
 import { JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_PORT, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-4Q7OMKAT.js';
 import { runnerDir } from './chunk-ZM2IMMYN.js';

package/dist/{chunk-6FH2AHJY.js → chunk-P4MM66C6.js}

@@ -1,13 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { autoConnect } from './chunk-GATMPAMK.js';
+import { autoConnect } from './chunk-EFZLAYPE.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { sanitizeTerminal } from './chunk-JOXYKGUV.js';
-import { resolveRepoIdentity } from './chunk-3ZPYPFNM.js';
+import { workPageUrl } from './chunk-4QVZCVWT.js';
+import { sanitizeTerminal } from './chunk-CNFVHDHG.js';
+import { resolveRepoIdentity } from './chunk-JXYVA45C.js';
+import { C } from './chunk-YRYMNBGQ.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { defaultFetch } from './chunk-YO4PSLVB.js';
 import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-PLMTLGYH.js';
 import { signRunnerRequest } from './chunk-V7NIVOFD.js';
+import { readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 
 createRequire(import.meta.url);
@@ -39,10 +42,6 @@ function isSignatureRefusal(code) {
 }
 
 // src/work-cmd.ts
-var GREEN = "\x1B[32m";
-var YELLOW = "\x1B[33m";
-var DIM = "\x1B[2m";
-var RESET = "\x1B[0m";
 async function signatureHeaders(method, endpoint, payload, signer) {
   if (signer === void 0) return {};
   return { ...await signRunnerRequest({ method, url: endpoint, body: new TextEncoder().encode(payload), signer }) };
@@ -298,7 +297,19 @@ function tokenWarning(data) {
   if (tokens === void 0 || tokens === null || tokens.earnable !== false) return "";
   const why = typeof tokens.message === "string" ? sanitizeTerminal(tokens.message) : "the gateway named no reason";
   return `
-${YELLOW}!${RESET} a container host will fail this build: ${why}`;
+${C.yellow}!${C.reset} a container host will fail this build: ${why}`;
+}
+function itemLabel(data) {
+  return data.number != null ? `item #${data.number}` : `item ${sanitizeTerminal(String(data.workItemId))}`;
+}
+function issueLabel(subject) {
+  if ("issue" in subject) return `issue ${sanitizeTerminal(subject.repository)}#${subject.issue}`;
+  return `issue ${sanitizeTerminal(subject.key)}`;
+}
+function itemPageUrl(home, cwd, appId, workItemId) {
+  const connection = readRepoConnection(cwd);
+  if (connection === void 0 || connection.appId !== appId || typeof workItemId !== "string" || workItemId === "") return void 0;
+  return `${workPageUrl(home, connection.organization.name, connection.factory.name)}/${encodeURIComponent(workItemId)}`;
 }
 async function runWorkBuild(opts) {
   const cwd = opts.cwd ?? process.cwd();
@@ -326,7 +337,7 @@ async function runWorkBuild(opts) {
     const label = data2.number != null ? `#${data2.number}` : String(data2.workItemId);
     const launch = data2.number != null ? `OUTERLAYER_WORK=${data2.number} claude` : null;
     const branch = typeof data2.branch === "string" && data2.branch !== "" ? data2.branch : null;
-    const output2 = opts.json ? JSON.stringify({ ...data2, ...launch !== null ? { launchCommand: launch } : {} }) : `${GREEN}\u2713${RESET} on Work for you to build ${DIM}\xB7${RESET} ${label} ${DIM}\xB7${RESET} no host will take it` + (branch !== null ? `
+    const output2 = opts.json ? JSON.stringify({ ...data2, ...launch !== null ? { launchCommand: launch } : {} }) : `${C.green}\u2713${C.reset} on Work for you to build ${C.dim}\xB7${C.reset} ${label} ${C.dim}\xB7${C.reset} no host will take it` + (branch !== null ? `
   branch: ${branch}` : "") + (launch !== null ? `
   start your session with: ${launch}` : "");
     if (!opts.quiet) process.stdout.write(output2 + "\n");
@@ -338,7 +349,9 @@ async function runWorkBuild(opts) {
     ...facts
   };
   const { data } = await postJsonWithRetry(url, "/v1/work-items/build", apiKey, appId, body, fetchImpl, retries, sleep);
-  const output = opts.json ? JSON.stringify(data) : `${GREEN}\u2713${RESET} build requested ${DIM}\xB7${RESET} ${data.number != null ? `#${data.number}` : data.workItemId} ${DIM}\xB7${RESET} by ${data.attestor}` + tokenWarning(data);
+  const page = itemPageUrl(home, cwd, appId, data.workItemId);
+  const output = opts.json ? JSON.stringify(data) : `${C.green}\u2713${C.reset} build requested ${C.dim}\xB7${C.reset} ${itemLabel(data)}${"subject" in body ? ` (${issueLabel(body.subject)})` : ""} ${C.dim}\xB7${C.reset} by ${data.attestor}` + (page !== void 0 ? `
+  ${page}` : "") + tokenWarning(data);
   if (!opts.quiet) process.stdout.write(output + "\n");
   return { data, output };
 }
@@ -347,7 +360,7 @@ async function runWorkLinkSession(opts) {
     return await linkSession(opts);
   } catch (err) {
     if (opts.logFailures) {
-      const { logHookError } = await import('./hook-fast-HLESEJAL.js');
+      const { logHookError } = await import('./hook-fast-PXWKQPN6.js');
       const reason = err instanceof Error ? err.message : String(err);
       logHookError(opts.home ?? homeFromEnv(opts.env ?? process.env), new Error(`work link-session #${opts.number} failed: ${reason}`));
     }
@@ -387,7 +400,7 @@ async function linkSession(opts) {
   }
   const heldBy = typeof data.heldBy === "string" ? data.heldBy : void 0;
   const linked = data.linked === true;
-  const output = opts.json ? JSON.stringify(data) : opts.ended ? linked ? `${GREEN}\u2713${RESET} ended ${DIM}\xB7${RESET} session ${sessionId} ${DIM}\xB7${RESET} #${number}` : `${DIM}\xB7${RESET} session ${sessionId} was not linked to #${number}` : heldBy ? `${DIM}\xB7${RESET} session ${sessionId} linked to #${number}, held by ${sanitizeTerminal(heldBy)} \u2014 no lease taken` : `${GREEN}\u2713${RESET} linked ${DIM}\xB7${RESET} session ${sessionId} ${DIM}\xB7${RESET} #${number}`;
+  const output = opts.json ? JSON.stringify(data) : opts.ended ? linked ? `${C.green}\u2713${C.reset} ended ${C.dim}\xB7${C.reset} session ${sessionId} ${C.dim}\xB7${C.reset} #${number}` : `${C.dim}\xB7${C.reset} session ${sessionId} was not linked to #${number}` : heldBy ? `${C.dim}\xB7${C.reset} session ${sessionId} linked to #${number}, held by ${sanitizeTerminal(heldBy)} \u2014 no lease taken` : `${C.green}\u2713${C.reset} linked ${C.dim}\xB7${C.reset} session ${sessionId} ${C.dim}\xB7${C.reset} #${number}`;
   if (!opts.quiet) process.stdout.write(output + "\n");
   return { data, output };
 }
@@ -411,7 +424,7 @@ async function runWorkRemove(opts) {
       { reason: opts.reason, ...environmentFacts({ cwd, env, home }) },
       fetchImpl
     );
-    const output2 = opts.json ? JSON.stringify(data2) : `${GREEN}\u2713${RESET} removed ${DIM}\xB7${RESET} ${data2.workItemId} ${DIM}\xB7${RESET} withdrawn ${data2.itemWithdrawn}`;
+    const output2 = opts.json ? JSON.stringify(data2) : `${C.green}\u2713${C.reset} removed ${C.dim}\xB7${C.reset} ${data2.workItemId} ${C.dim}\xB7${C.reset} withdrawn ${data2.itemWithdrawn}`;
     if (!opts.quiet) process.stdout.write(output2 + "\n");
     return { data: data2, output: output2 };
   }
@@ -421,7 +434,7 @@ async function runWorkRemove(opts) {
   const item = await findLiveItem(creds, repository, subject, fetchImpl);
   if (!item) {
     const data2 = { workItemId: null, removed: true, itemWithdrawn: false, noLiveAddition: true };
-    const output2 = opts.json ? JSON.stringify(data2) : `${GREEN}\u2713${RESET} nothing to remove ${DIM}\xB7${RESET} no live addition on ${repository}#${number}`;
+    const output2 = opts.json ? JSON.stringify(data2) : `${C.green}\u2713${C.reset} nothing to remove ${C.dim}\xB7${C.reset} no live addition on ${repository}#${number}`;
     if (!opts.quiet) process.stdout.write(output2 + "\n");
     return { data: data2, output: output2 };
   }
@@ -433,7 +446,7 @@ async function runWorkRemove(opts) {
     { reason: opts.reason, ...environmentFacts({ cwd, env, home }) },
     fetchImpl
   );
-  const output = opts.json ? JSON.stringify(data) : `${GREEN}\u2713${RESET} removed ${DIM}\xB7${RESET} ${data.workItemId} ${DIM}\xB7${RESET} withdrawn ${data.itemWithdrawn}`;
+  const output = opts.json ? JSON.stringify(data) : `${C.green}\u2713${C.reset} removed ${C.dim}\xB7${C.reset} ${data.workItemId} ${C.dim}\xB7${C.reset} withdrawn ${data.itemWithdrawn}`;
   if (!opts.quiet) process.stdout.write(output + "\n");
   return { data, output };
 }
@@ -496,10 +509,10 @@ async function runWorkList(opts) {
   const claimSuffix = (claim) => {
     if (!claim) return "";
     const holder = claim.holderKind === "session" ? `${claim.memberName || "a member"} (local session` : `${sanitizeTerminal(claim.host)} (${claim.kind}`;
-    return ` ${DIM}\xB7${RESET} claimed by ${holder}, since ${claim.createdAt}, until ${claim.expiresAt})`;
+    return ` ${C.dim}\xB7${C.reset} claimed by ${holder}, since ${claim.createdAt}, until ${claim.expiresAt})`;
   };
   const output = opts.json ? JSON.stringify(data) : items.length === 0 ? "no live work items" : items.map(
-    (i) => `${i.trackerKey} ${DIM}\xB7${RESET} ${i.stage} ${DIM}\xB7${RESET} ${i.section} ${DIM}\xB7${RESET} ${i.title}${claimSuffix(i.claim)}`
+    (i) => `${i.trackerKey} ${C.dim}\xB7${C.reset} ${i.stage} ${C.dim}\xB7${C.reset} ${i.section} ${C.dim}\xB7${C.reset} ${i.title}${claimSuffix(i.claim)}`
   ).join("\n");
   if (!opts.quiet) process.stdout.write(output + "\n");
   return { data, output };

package/dist/{chunk-IBB4D4KE.js → chunk-P6FX4D43.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-SKHN72JO.js';
+import { MIN_ENGINE_MAJOR } from './chunk-MZN7AQOB.js';
 import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-CX22S5BA.js';
 import { spawnSync } from 'child_process';
 import { existsSync, accessSync, constants, statSync, readFileSync } from 'fs';

package/dist/{chunk-A56PYPDF.js → chunk-R7OQTKWT.js}

@@ -62,8 +62,9 @@ function addMcpEntryIfAbsent(repoRoot, name, entry) {
 `);
   return { path: relPath, added: true };
 }
+var INIT_STDIO_ENTRY = { type: "stdio", command: "npx", args: ["-y", "@outerlayer/cli", "mcp", "serve"] };
 function addStdioMcpEntryIfAbsent(repoRoot, name = "outerlayer") {
-  return addMcpEntryIfAbsent(repoRoot, name, buildStdioServerEntry(DEFAULT_MCP_COMMAND, void 0, void 0));
+  return addMcpEntryIfAbsent(repoRoot, name, { ...INIT_STDIO_ENTRY, args: [...INIT_STDIO_ENTRY.args] });
 }
 var DOCS_MCP_SERVER_NAME = "outerlayer-docs";
 var DOCS_MCP_URL = "https://docs.outerlayer.ai/mcp";

package/dist/{chunk-2KLBKHT4.js → chunk-RLYZLUQ7.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { builtinKind } from './chunk-XR3BJN33.js';
+import { builtinKind } from './chunk-22RMZBGW.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
 import { runnerDir } from './chunk-ZM2IMMYN.js';
 import { dirname } from 'path';

package/dist/chunk-RMWLBUCJ.js

@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
+import { existsSync, readFileSync, mkdirSync, chmodSync, writeFileSync } from 'fs';
+import { dirname, join } from 'path';
+
+createRequire(import.meta.url);
+var ITEM_KEY_FILE = "item-key";
+function itemKeyPath(jobPath) {
+  return join(dirname(jobPath), ITEM_KEY_FILE);
+}
+function withItemKey(jobPath, job) {
+  let key;
+  try {
+    key = readFileSync(itemKeyPath(jobPath), "utf8").trim();
+  } catch {
+    return job;
+  }
+  return key === "" ? job : { ...job, itemKey: key };
+}
+function writeOwnerOnly(path, content) {
+  if (existsSync(path)) chmodSync(path, RUNNER_FILE_MODE);
+  writeFileSync(path, content, { mode: RUNNER_FILE_MODE });
+}
+function readJobFile(path) {
+  if (!existsSync(path)) return null;
+  try {
+    return withItemKey(path, JSON.parse(readFileSync(path, "utf8")));
+  } catch {
+    return null;
+  }
+}
+function readJobFileChecked(path) {
+  if (!existsSync(path)) return { kind: "missing" };
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return { kind: "unreadable" };
+    return { kind: "ok", job: withItemKey(path, parsed) };
+  } catch {
+    return { kind: "unreadable" };
+  }
+}
+function writeJobFile(path, job) {
+  mkdirSync(dirname(path), { recursive: true, mode: RUNNER_DIR_MODE });
+  const { itemKey, ...rest } = job;
+  if (itemKey !== void 0) writeOwnerOnly(itemKeyPath(path), itemKey);
+  writeOwnerOnly(path, JSON.stringify(rest, null, 2));
+}
+
+export { readJobFile, readJobFileChecked, writeJobFile };

package/dist/{chunk-YEQL54G5.js → chunk-SFFHGX3G.js}

@@ -634,7 +634,7 @@ async function runHookFast(event, home = homeFromEnv(), read = readStdin, env =
       recordHookErrorsSeen(home, hookErrorsBytes);
       if (contextPossiblyGoverned(sessionCwd, home)) {
         try {
-          const { materializeContext: materialize } = await import('./context-materialize-45OVRRK2.js');
+          const { materializeContext: materialize } = await import('./context-materialize-7S6NLLRO.js');
           const sessionId = typeof payload.session_id === "string" ? payload.session_id : "unknown";
           const result = await materialize({ cwd: sessionCwd, sessionId, home });
           materializeMessage = result.message;

package/dist/{chunk-G4RXNF2L.js → chunk-SVEP7PVH.js}

@@ -1,24 +1,24 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LEASE_SECONDS, releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, ALREADY_RELEASED } from './chunk-DVT73QJO.js';
+import { LEASE_SECONDS, releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, ALREADY_RELEASED } from './chunk-C6IV5BV7.js';
 import { writePendingUpdate } from './chunk-O765JR4W.js';
 import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-UGP76IZ5.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
-import { writeJobFile, readJobFile, readJobFileChecked } from './chunk-T6OIJQRT.js';
-import { compareVersions, satisfiesRange } from './chunk-I2UOAV7X.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-YETTWTAY.js';
+import { writeJobFile, readJobFile, readJobFileChecked } from './chunk-RMWLBUCJ.js';
+import { compareVersions, satisfiesRange } from './chunk-I2UOAV7X.js';
 import { RUNNER_PROTOCOL } from './chunk-FI5UYJMQ.js';
-import { placeholderQueues, placeholderProblem } from './chunk-PDRYXERC.js';
+import { placeholderQueues, placeholderProblem } from './chunk-TOPDNXHZ.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, cleanVersions, isInLayout, stagingDir } from './chunk-TI7B7UEO.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, BuildTokens, classifyRefusal, refusalCode, measureDisk, createRunnerLog, setUpRunnerCgroup, parseCpuList, ensureTunnel, keepGhConfigCurrent, createContainerRuntime, formatClock } from './chunk-SKHN72JO.js';
-import { checkFit } from './chunk-2KLBKHT4.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, BuildTokens, classifyRefusal, refusalCode, measureDisk, createRunnerLog, setUpRunnerCgroup, parseCpuList, ensureTunnel, keepGhConfigCurrent, createContainerRuntime, formatClock } from './chunk-MZN7AQOB.js';
+import { checkFit } from './chunk-RLYZLUQ7.js';
 import { startTimeOf, claimPidFile, readPidFile, isSameProcess, releasePidFile } from './chunk-N5FOE5PS.js';
-import { spawnRun } from './chunk-GGMRZPEA.js';
-import { builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, BUILD_LABEL, RUNNER_LABEL } from './chunk-QEESCZ26.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-6FH2AHJY.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-XR3BJN33.js';
+import { spawnRun } from './chunk-3KTA5UU2.js';
+import { builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, BUILD_LABEL, RUNNER_LABEL } from './chunk-NX57IBNK.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-P4MM66C6.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-22RMZBGW.js';
 import { exceedsDisk } from './chunk-7RQ73DLO.js';
 import { parseClaimedRepositories, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, claudeCredential } from './chunk-4Q7OMKAT.js';
 import { parseClaimIdentity } from './chunk-BYT5O5RV.js';
@@ -1315,7 +1315,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-JPM37MLF.js');
+  const { postJson: postJson2 } = await import('./work-cmd-X7NMJDFL.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -2072,7 +2072,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     const outcome = await onStartUnderMarker({
       configPath,
       own: ownVersionOf(deps),
-      check: update.check ? () => update.check(configPath) : async () => (await import('./check-RJOJU2WA.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
+      check: update.check ? () => update.check(configPath) : async () => (await import('./check-63IDCEEV.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
     });

package/dist/{chunk-VK25O2ZM.js → chunk-T5VPP6H7.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_UNIT_NAME } from './chunk-2KLBKHT4.js';
+import { DEFAULT_UNIT_NAME } from './chunk-RLYZLUQ7.js';
 import { parseRunnerEnv } from './chunk-6MZSX4M7.js';
 import { RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
 import { existsSync, readFileSync, writeFileSync, renameSync, rmSync } from 'fs';

package/dist/{chunk-FO7KKPYG.js → chunk-TCIW27FM.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { splitRawFile } from './chunk-AHZQBGD2.js';
+import { splitRawFile } from './chunk-2M63GG56.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, readdirSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-PDRYXERC.js → chunk-TOPDNXHZ.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-GEBQXUFY.js';
-import { describeCallFailure } from './chunk-SKHN72JO.js';
-import { WorkCommandError, getJson } from './chunk-6FH2AHJY.js';
-import { sanitizeTerminal } from './chunk-JOXYKGUV.js';
-import { builtinKind } from './chunk-XR3BJN33.js';
+import { isPlaceholderCommand } from './chunk-MJXXRX4M.js';
+import { describeCallFailure } from './chunk-MZN7AQOB.js';
+import { WorkCommandError, getJson } from './chunk-P4MM66C6.js';
+import { sanitizeTerminal } from './chunk-CNFVHDHG.js';
+import { builtinKind } from './chunk-22RMZBGW.js';
 import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential } from './chunk-4Q7OMKAT.js';
 import { signerFor } from './chunk-V7NIVOFD.js';
 

package/dist/{chunk-5TGQHOUX.js → chunk-XJKL4BNU.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-27Y7AX2O.js';
-import { CaptureDaemon } from './chunk-3ZPYPFNM.js';
+import { LiveUploader } from './chunk-3D4OYFCD.js';
+import { CaptureDaemon } from './chunk-JXYVA45C.js';
 import { parseWorkItemEnv } from './chunk-GQD22KKN.js';
-import { spoolDir } from './chunk-YEQL54G5.js';
+import { spoolDir } from './chunk-SFFHGX3G.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, writeFileSync, rmSync } from 'fs';
 import { join } from 'path';