@outerlayer/cli 0.12.0 → 0.14.0

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # @outerlayer/cli
 
+## 0.14.0
+
+### Minor Changes
+
+- 4921c80: `outerlayer init --update` brings the files `init` wrote once up to the installed CLI's version: the template skills, `.outerlayer/policy.yaml`, the `code-review.yaml` and `acceptance-criteria.yaml` checks in `.outerlayer/validators/`, and the `outerlayer` and `outerlayer-docs` MCP entries. A file still equal to what an earlier release wrote is replaced, a missing one is written, and a file you edited is never touched. It then runs `outerlayer context emit` and leaves the changes uncommitted. `--dry-run` prints the plan, with a command to compare each edited file. `outerlayer doctor` adds a **Starter files** check that reports each file as current, outdated, edited or missing. An `outerlayer` MCP entry an earlier `init` wrote is reported there, not by the **MCP server** check. The quickstart no longer says the MCP server needs a global install.
+- 23aa007: The starter skills `outerlayer init` installs gain three practices. `/spec` decides a docs verdict and a structural verdict for every issue, each with a one-line reason, and `writing-specs` defines both. A new `writing-tests` template holds a language-neutral test standard: strong assertions, the right seam, a criterion id in a comment above its test, and an optional mutation check. `writing-specs/references/agents-snippet.md` holds optional writing rules to paste into an instructions file. The `writing-specs` frontmatter now parses as YAML, so tools that read it see its description.
+- 789f55f: `outerlayer sync` prints a line for each artifact it uploads, with its file name, caption and dashboard link, so an agent can pass the link straight to `outerlayer emit code-review --link`. `sync --json` lists them under `uploadedArtifacts`, and the spool state records each artifact's server id and link against its client id. `outerlayer emit artifact` prints the link when it uploads at once, and inside a session says the next `sync` prints it.
+- ef97624: `outerlayer init` writes a second check, `.outerlayer/validators/acceptance-criteria.yaml`, only when it is missing. The starter `/build` skill records its criteria judge's verdict on that check, so every pull request it opens has a row for it. The build records pass only when the judge found every criterion it judged satisfied, and fail when it found one unmet. When there is no criterion to judge, it records nothing, so the row reads "not proven".
+
+### Patch Changes
+
+- 0e6256b: `work comment`, `work threads`, `work pr`, `work open-pr`, `emit result`, `emit artifact`, `emit criteria`, `emit finding`, `context emit`, `import capture` and `import ruler` no longer print ANSI color codes when output is piped or `NO_COLOR` is set. They follow the same color rules as the rest of the CLI, including `--no-color` and `FORCE_COLOR`. Output on a terminal is unchanged.
+
+## 0.13.0
+
+### Minor Changes
+
+- 76222d4: The starter `/build` skill no longer parses fixed shapes out of an issue. The agent reads the issue's acceptance criteria in any form and keeps their text as written. `record-criteria.mjs` now takes the agent's file with `--criteria-file`. It keeps the issue's ids when every criterion has one that fits the id grammar, and otherwise numbers them `AC-<item>-NN`. A partly numbered list is now numbered and recorded, not skipped. When an issue has no criteria, the build drafts them from the description and runs the script with `--drafted`, which records the list with `drafted: true`. `outerlayer emit criteria` reads an optional top-level `"drafted": true` from its file and sends it with the list.
+- 07677fd: `outerlayer runner init` creates the runner's API key from your login when the config file has none. It uses the Runner preset, names the key after the machine (`--key-name` to override), creates it on the factory `--app-id` names, and checks it before any VM or service step. On a Mac with `--vm`, the key goes straight into the VM and is never written on the Mac. A login that cannot create keys gets a refusal naming the pasted-key path, which still works as before.
+
+### Patch Changes
+
+- b831165: Fix rough edges a first-time user meets. `init` writes an MCP server entry that runs through npx, so it starts without a global install, and `doctor` warns when the entry's command is not on PATH. `init` marks a connection whose repository still needs linking with `!` and names the factory by its slug. `login` suggests `init` in a repository that is not set up. `doctor` warns when a factory has no connected repository, stops listing one Claude Code install twice, and says the first hook run creates the spool. `work build` names the item and the issue separately, prints the item's page, and honours NO_COLOR and non-terminal output. A runner keeps the build's item key in its own owner-only file instead of `job.json`. The starter build skill uses the branch a host allows, and the code review check says the report's link can take a minute to appear. `runner init`, `runner check` and `runner start` refuse an empty or blank runner key or factory id, or one still holding a `<...>` placeholder, naming the field and the config file.
+- 836d0e0: A validator file can no longer declare `artifact`, `finding` or `findings` as its emit name, the same as `criteria`. Each is an `outerlayer emit` subcommand, so `outerlayer emit <name>` ran the subcommand and the check could never be recorded. A file that declares one now fails to load with a policy error naming the subcommand.
+
 ## 0.12.0
 
 ### Minor Changes

package/README.md

@@ -142,9 +142,14 @@ content:
   request it makes with the host key, the way the runner does. The signature
   covers the request's method, path, query and body, and adds nothing else
   to it.
-- **`outerlayer runner init`** makes no network call, except `runner init --vm`
-  on a Mac. That runs `limactl`, and Lima downloads a Linux VM image. Inside
-  the VM, `apt` downloads Node and `npm` downloads this CLI. Your runner key goes to the VM on the standard
+- **`outerlayer runner init`** makes no network call when the config file
+  already holds a runner key. With no key there and a saved login, it
+  creates one: `POST /v1/api-keys` with your login's token, sending the key's
+  name (this machine's name, or `--key-name`), the Runner preset's
+  permissions and the factory id. It then checks the new key, unsigned, with
+  `GET /v1/runner/host-key`. `runner init --vm` on a Mac also runs `limactl`,
+  and Lima downloads a Linux VM image. Inside the VM, `apt` downloads Node and
+  `npm` downloads this CLI. Your runner key goes to the VM on the standard
   input of a `limactl shell` command and is never a file or an argument on the
   Mac.
 - **`outerlayer login`**, with no key on stdin, signs in to your account by
@@ -386,7 +391,7 @@ before it gives up.
 | `outerlayer work claim --item <n>\|--issue <n> --kind implement\|amend [--repo] [--host] [--seconds]` | Records a lease for this host (default: its own hostname), so two hosts never build the same item at once. The lease belongs to the runner key that claimed it: a live lease held by a different key is refused, even under the same host name, and claiming again with the same key extends it. The first claim creates the host key (`host-key.pem` beside the config file) and binds the runner key to it; from then on every request made with that key is signed. Lease length defaults to 900 seconds, the server's own cap. |
 | `outerlayer work renew --item <n>\|--issue <n> [--repo] [--host] [--seconds]` | Extends this host's own live lease. Refused if the lease has expired, or if a different runner key holds it (403 `claim_not_held`). |
 | `outerlayer work release --item <n>\|--issue <n> [--repo] [--host] [--session-id] [--outcome]` | Marks the lease this API key holds released, optionally recording how the attempt ended. Releasing an already-released lease is a no-op that returns the recorded release time and outcome. Run inside a session with no `--host`, it releases that session's own lease instead (`--session-id` names the session when it cannot be detected), so the item's review opens without ending the session. |
-| `outerlayer runner init [--vm\|--no-vm] [--config <path>]` | Writes a `runner` block with defaults, keeping every key the config already had. It names `builtin:vm` on a Linux machine where the user can use `/dev/kvm` and Docker Engine can build images once the guest kernel and helper are published (not yet), `builtin:container` on that machine until then, `builtin:container` on any other machine with Docker Engine, and `builtin:process` on one without, and writes no hook script. Refuses rather than overwriting an existing block. On macOS it asks whether to create a Linux VM with Lima, installs Docker Engine and the runner in it, and starts both at login; `--vm` answers yes and `--no-vm` answers no, and a run with no terminal answers no. The runner key and the host key then live only in the VM: the Mac's config loses `apiKey` and `runner` and gains a `runnerVm` note, which `outerlayer doctor` reads. |
+| `outerlayer runner init [--vm\|--no-vm] [--app-id <id>] [--key-name <name>] [--config <path>]` | Writes a `runner` block with defaults, keeping every key the config already had. With no `apiKey` in the config and a saved login, it first creates a runner key from the login with the Runner preset, named after the machine or `--key-name`, on the factory `--app-id` names, and checks it before anything else changes. It names `builtin:vm` on a Linux machine where the user can use `/dev/kvm` and Docker Engine can build images once the guest kernel and helper are published (not yet), `builtin:container` on that machine until then, `builtin:container` on any other machine with Docker Engine, and `builtin:process` on one without, and writes no hook script. Refuses rather than overwriting an existing block. On macOS it asks whether to create a Linux VM with Lima, installs Docker Engine and the runner in it, and starts both at login; `--vm` answers yes and `--no-vm` answers no, and a run with no terminal answers no. The runner key and the host key then live only in the VM: the Mac's config loses `apiKey` and `runner` and gains a `runnerVm` note, which `outerlayer doctor` reads. |
 | `outerlayer runner check [--config <path>]` | Validates the config, the hooks and the key, prints the settings the runner would use, and exits non-zero on a problem. Takes no work and writes no pid file. |
 | `outerlayer runner start [--config <path>]` | Runs the loop: claim work, run it, sync, clean up, report, release with an outcome. Repeat. Reads the `runner` block from the config file (default `~/.outerlayer/config.json`). Refuses to start on a bad config, an unrunnable hook, or a refused key. |
 | `outerlayer runner image --repository <owner/name> [--remote <url>] [--config <path>] [--json]` | Builds the image a repository's builds run in. Fetches the head of the default branch into the runner's cache, builds its `.devcontainer/devcontainer.json` with the devcontainer CLI, ignores every setting that reaches the host or widens the container's privileges, and adds this CLI and a pinned Claude Code. Reuses the image until the recipe or the tools change, keeps the newest three, and writes `recipe.json` beside the image record. Refuses a Compose recipe (`recipe_needs_docker`) and a repository with only named configurations (`recipe_ambiguous`). |

package/dist/agent-setup-CN2HUBEJ.js

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+export { keepHandWritten, runAgentSetup } from './chunk-SXWS25JC.js';
+import './chunk-HFKKFTXU.js';
+import './chunk-XCK2YAY5.js';
+import './chunk-FOJGZYFC.js';
+import './chunk-YRYMNBGQ.js';
+import './chunk-3NLOVYJQ.js';
+import './chunk-LCEXHCHD.js';
+import './chunk-ZJSNLVCE.js';
+import './chunk-YO4PSLVB.js';
+import './chunk-BYT5O5RV.js';
+import './chunk-ZA5CHAFY.js';
+import './chunk-2M63GG56.js';
+import './chunk-PLMTLGYH.js';
+import './chunk-J5M7BSJQ.js';
+import './chunk-EABW6AJQ.js';
+import './chunk-RA3O54FC.js';
+import './chunk-V7NIVOFD.js';
+import './chunk-ZM2IMMYN.js';
+import './chunk-XCCLFVXM.js';
+import './chunk-BJ3KTMDH.js';
+import './chunk-VNVZDWO3.js';
+import './chunk-Z5GEFMRW.js';
+
+createRequire(import.meta.url);

package/dist/{build-LELVCWHV.js → build-BG2YENGK.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { buildRepositoryImage } from './chunk-3FMPZPJQ.js';
-import './chunk-N5FOE5PS.js';
+export { buildRepositoryImage } from './chunk-R7PF5OOU.js';
 export { RecipeError } from './chunk-QOZKPLVJ.js';
+import './chunk-N5FOE5PS.js';
 import './chunk-CX22S5BA.js';
 import './chunk-BYT5O5RV.js';
 import './chunk-ZM2IMMYN.js';

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-08T01:27:55.356Z+5a1c8e3","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-08T21:15:36.925Z+415a9ac","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{builder-OF67QKDS.js → builder-2D3WSOOY.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-QEESCZ26.js';
-import './chunk-CX22S5BA.js';
-import './chunk-3ZPYPFNM.js';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-4NPZVMJU.js';
 import './chunk-7RQ73DLO.js';
 import './chunk-4Q7OMKAT.js';
-import './chunk-325272HM.js';
+import './chunk-CX22S5BA.js';
+import './chunk-JXYVA45C.js';
 import './chunk-BYT5O5RV.js';
+import './chunk-J5M7BSJQ.js';
 import './chunk-ZM2IMMYN.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/{check-RJOJU2WA.js → check-SRGR36KI.js}

@@ -1,69 +1,69 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-G4RXNF2L.js';
-import './chunk-DVT73QJO.js';
+import { probeCredentials } from './chunk-NHDVD7DU.js';
+import './chunk-4OGPT6I2.js';
 import './chunk-O765JR4W.js';
 import './chunk-UGP76IZ5.js';
 import './chunk-3JVYMD4G.js';
-import './chunk-T6OIJQRT.js';
-import './chunk-I2UOAV7X.js';
 import './chunk-YETTWTAY.js';
+import './chunk-RMWLBUCJ.js';
+import './chunk-I2UOAV7X.js';
+import './chunk-HYZRY4KZ.js';
 import './chunk-FI5UYJMQ.js';
-import './chunk-5TGQHOUX.js';
-import './chunk-27Y7AX2O.js';
+import './chunk-KFRM23WD.js';
+import './chunk-MSASO5O4.js';
 import './chunk-HHJDN6AU.js';
-import './chunk-HYZRY4KZ.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem } from './chunk-PDRYXERC.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem } from './chunk-SMHOCDCI.js';
 import './chunk-YYYRBYWG.js';
 import './chunk-TI7B7UEO.js';
 import './chunk-TBT347UY.js';
-import './chunk-GEBQXUFY.js';
-import './chunk-IBB4D4KE.js';
-import './chunk-SKHN72JO.js';
-import './chunk-VK25O2ZM.js';
-import './chunk-2KLBKHT4.js';
+import './chunk-Q2UK3C4P.js';
+import './chunk-JYIEHQIF.js';
+import './chunk-RBKIH5ST.js';
+import './chunk-KMDLFI4P.js';
+import './chunk-QKFB4K7X.js';
+import './chunk-RSNSZ2LJ.js';
+import './chunk-T5VPP6H7.js';
+import './chunk-RLYZLUQ7.js';
 import { parseRunnerEnv } from './chunk-6MZSX4M7.js';
-import './chunk-3FMPZPJQ.js';
+import './chunk-SWHQ4LUM.js';
+import './chunk-NPQWKGUA.js';
+import './chunk-IP7BIBXJ.js';
+import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-22RMZBGW.js';
+import './chunk-UXYLWVTQ.js';
+import './chunk-R7PF5OOU.js';
+import './chunk-QOZKPLVJ.js';
 import './chunk-N5FOE5PS.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-GGMRZPEA.js';
-import './chunk-QOZKPLVJ.js';
-import './chunk-QEESCZ26.js';
+import './chunk-4NPZVMJU.js';
+import './chunk-7RQ73DLO.js';
+import './chunk-4Q7OMKAT.js';
 import './chunk-CX22S5BA.js';
-import './chunk-QKFB4K7X.js';
-import './chunk-RSNSZ2LJ.js';
 import './chunk-F7CU5ABH.js';
 import './chunk-BKO6JEZI.js';
-import './chunk-6FH2AHJY.js';
-import './chunk-GATMPAMK.js';
-import './chunk-IP7BIBXJ.js';
-import './chunk-C7N4TDHW.js';
-import './chunk-JOXYKGUV.js';
-import './chunk-3ZPYPFNM.js';
-import './chunk-USO2DKBD.js';
+import './chunk-YDSMROTB.js';
+import './chunk-WUYTWNMA.js';
+import './chunk-JXYVA45C.js';
+import './chunk-4KSQKQXE.js';
 import './chunk-N6LURUEF.js';
 import './chunk-YRYMNBGQ.js';
-import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-XR3BJN33.js';
-import './chunk-UXYLWVTQ.js';
-import './chunk-7RQ73DLO.js';
-import './chunk-4Q7OMKAT.js';
 import './chunk-GQD22KKN.js';
 import './chunk-WZBHBH3J.js';
 import './chunk-5QRP3MVS.js';
-import './chunk-SZOVKFWB.js';
+import './chunk-3NLOVYJQ.js';
+import './chunk-LCEXHCHD.js';
 import './chunk-ZJSNLVCE.js';
-import './chunk-FO7KKPYG.js';
-import './chunk-G5IEVZGI.js';
-import './chunk-AHZQBGD2.js';
 import './chunk-YO4PSLVB.js';
+import './chunk-BYT5O5RV.js';
+import './chunk-ZA5CHAFY.js';
+import './chunk-2M63GG56.js';
 import './chunk-PLMTLGYH.js';
-import './chunk-325272HM.js';
+import './chunk-J5M7BSJQ.js';
 import './chunk-EABW6AJQ.js';
-import './chunk-BYT5O5RV.js';
 import './chunk-RA3O54FC.js';
 import './chunk-V7NIVOFD.js';
 import './chunk-ZM2IMMYN.js';
-import './chunk-YEQL54G5.js';
+import './chunk-PQUM37BK.js';
 import './chunk-XCCLFVXM.js';
 import './chunk-BJ3KTMDH.js';
 import './chunk-VNVZDWO3.js';

package/dist/{chunk-XR3BJN33.js → chunk-22RMZBGW.js}

@@ -47,6 +47,23 @@ function defaultRunnerConfigPath(home = homeFromEnv()) {
 function fail(configPath, key, reason) {
   throw new RunnerConfigError(`${configPath}: ${key} ${reason}`);
 }
+var PLACEHOLDER = /[<>]/;
+function runnerCredentialProblem(config) {
+  for (const field of ["url", "apiKey", "appId"]) {
+    const value = config[field];
+    if (value === void 0) return { field, reason: "is missing" };
+    if (typeof value !== "string") return { field, reason: "is not text" };
+    if (value.trim() === "") return { field, reason: "is empty" };
+  }
+  if (PLACEHOLDER.test(config.apiKey)) {
+    return { field: "apiKey", reason: "is still a <...> placeholder. Put the factory's runner key there: an API key made with the Runner preset" };
+  }
+  const appId = config.appId;
+  if (PLACEHOLDER.test(appId)) {
+    return { field: "appId", reason: `is still the placeholder ${JSON.stringify(appId)}. Put the Factory Id from the factory's Settings \u2192 General there` };
+  }
+  return void 0;
+}
 function readConfigFile(configPath) {
   if (!existsSync(configPath)) return {};
   const text = readFileSync(configPath, "utf8");
@@ -171,6 +188,8 @@ function loadRunnerConfig(configPath) {
   if (!config.url || !config.apiKey || !config.appId) {
     fail(configPath, "url/apiKey/appId", "missing \u2014 pipe a factory key into `outerlayer login` for this config file first; a runner uses a factory key, never a person's login");
   }
+  const credentialProblem = runnerCredentialProblem(config);
+  if (credentialProblem !== void 0) fail(configPath, credentialProblem.field, credentialProblem.reason);
   const runner = config.runner;
   if (!runner) {
     fail(configPath, "runner", "block is missing");
@@ -379,4 +398,4 @@ function resolveBuild(configPath, block) {
   };
 }
 
-export { DEFAULT_CHECK_TIME_LIMIT_MINUTES, DEFAULT_UPDATE_MAX_WAIT_HOURS, RunnerConfigError, builtinKind, checkHooks, defaultRunnerConfigPath, hasRunnerBlock, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, loadRunnerConfig, resolveBuild, resolveHousekeeping, runnerVmOf };
+export { DEFAULT_CHECK_TIME_LIMIT_MINUTES, DEFAULT_UPDATE_MAX_WAIT_HOURS, RunnerConfigError, builtinKind, checkHooks, defaultRunnerConfigPath, hasRunnerBlock, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, loadRunnerConfig, resolveBuild, resolveHousekeeping, runnerCredentialProblem, runnerVmOf };

package/dist/{chunk-AHZQBGD2.js → chunk-2M63GG56.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RESERVED_EMIT_NAMES, ARTIFACT_KINDS, ArtifactCriterionIdSchema } from './chunk-325272HM.js';
+import { RESERVED_EMIT_NAMES, ARTIFACT_KINDS, ArtifactCriterionIdSchema } from './chunk-J5M7BSJQ.js';
 import { __commonJS, __require, __toESM } from './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);

package/dist/{chunk-SZOVKFWB.js → chunk-3NLOVYJQ.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
+import { readPin, pinExists, readBuildHold, readContextManifest, manifestFilesPresent, writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, SOURCE_CACHE_TTL_SUCCESS_MS, isLastCheckFresh, readDegraded, touchLastCheck, clearDegraded, writeContextManifest, writePinIfChanged, readSourceCache, isSourceCacheFresh } from './chunk-LCEXHCHD.js';
 import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
-import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-FO7KKPYG.js';
-import { readPin, pinExists, readBuildHold, readContextManifest, manifestFilesPresent, writeDegraded, writeSourceCache, SOURCE_CACHE_TTL_RETRY_MS, SOURCE_CACHE_TTL_SUCCESS_MS, isLastCheckFresh, readDegraded, touchLastCheck, clearDegraded, writeContextManifest, writePinIfChanged, readSourceCache, isSourceCacheFresh } from './chunk-G5IEVZGI.js';
-import { normalizeRepoName, parseGoverns, CONTEXT_SOURCE_CONFIG_PATH, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-AHZQBGD2.js';
 import { defaultFetch } from './chunk-YO4PSLVB.js';
-import { resolveGatewayCredentials } from './chunk-PLMTLGYH.js';
 import { withTokenHeader } from './chunk-BYT5O5RV.js';
+import { loadMaintainedFiles, writeMaintainedFiles } from './chunk-ZA5CHAFY.js';
+import { normalizeRepoName, parseGoverns, CONTEXT_SOURCE_CONFIG_PATH, parseOuterlayerConfig, classifyTree, emitTree } from './chunk-2M63GG56.js';
+import { resolveGatewayCredentials } from './chunk-PLMTLGYH.js';
 import { ensureContextExcludes, ensurePreCommitGuardHook } from './chunk-XCCLFVXM.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { execFileSync } from 'child_process';

package/dist/{chunk-USO2DKBD.js → chunk-4KSQKQXE.js}

@@ -3,6 +3,7 @@ import { createRequire } from 'node:module';
 import { revokeTokenOnDashboard } from './chunk-N6LURUEF.js';
 import { C } from './chunk-YRYMNBGQ.js';
 import { readCloudConfig, writeCloudConfig, cloudConfigPath } from './chunk-EABW6AJQ.js';
+import { findGitDirs } from './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { generateKeyPairSync, privateDecrypt, constants, createPrivateKey } from 'crypto';
 import { spawn } from 'child_process';
@@ -269,14 +270,19 @@ async function finishApproved(flags, deps, home, dashboard, approved, privateKey
   }
   deps.stdout.write(
     `${C.green}\u2713${C.reset} Logged in as ${approved.email}. Saved the login to ${path}
-Next: run \`outerlayer connect\` to choose a factory.
-`
+` + nextAfterLogin(deps.cwd ?? process.cwd())
   );
   if (before.apiKey) {
     deps.stdout.write("A factory key is also saved on this machine, so commands here keep using the key, not this login.\n");
   }
   return 0;
 }
+function nextAfterLogin(cwd) {
+  const dirs = findGitDirs(cwd);
+  if (dirs === void 0) return "Next: in your repository, run `outerlayer init --factory <org>/<factory>`.\n";
+  if (existsSync(join(dirs.repoRoot, ".outerlayer"))) return "Next: run `outerlayer connect` to choose a factory.\n";
+  return "Next: run `outerlayer init --factory <org>/<factory>` to set up this repository.\n";
+}
 function fail(deps, message) {
   deps.stderr.write(`${C.red}\u2717${C.reset} ${message}
 `);

package/dist/{chunk-QEESCZ26.js → chunk-4NPZVMJU.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { BUILDKIT_IMAGE } from './chunk-CX22S5BA.js';
-import { compareVersions } from './chunk-3ZPYPFNM.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
 import { JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_PORT, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-4Q7OMKAT.js';
+import { BUILDKIT_IMAGE } from './chunk-CX22S5BA.js';
+import { compareVersions } from './chunk-JXYVA45C.js';
 import { runnerDir } from './chunk-ZM2IMMYN.js';
 import { createHash } from 'crypto';
 import { realpathSync } from 'fs';

package/dist/{chunk-DVT73QJO.js → chunk-4OGPT6I2.js}

@@ -1,25 +1,25 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { writeJobFile, readJobFile } from './chunk-T6OIJQRT.js';
-import { senderPidfile } from './chunk-5TGQHOUX.js';
-import { installScrubContext } from './chunk-27Y7AX2O.js';
+import { writeJobFile, readJobFile } from './chunk-RMWLBUCJ.js';
 import { DOCKERD_LOG } from './chunk-HYZRY4KZ.js';
-import { AssetError, describeCallFailure, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, refusalCode, resolveAgentUser, AgentUserError, runBuildSteps, removeStagedContext, stageGovernedContext, shellQuote, createRunnerLog, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, formatDuration, retrySend, formatClock, containerSenderCommand, syncInContainer, copyTranscriptsFromContainer, GH_CONFIG_YML, ghHostsYml, ADDED_USER, isLiteralAddress, signalInContainer, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript } from './chunk-SKHN72JO.js';
-import { readBranchHead, diffBetween, fetchCommit } from './chunk-3FMPZPJQ.js';
-import { isSameProcess, startTimeOf } from './chunk-N5FOE5PS.js';
-import { childEnvironment } from './chunk-GGMRZPEA.js';
-import { CLAUDE_CODE_VERSION } from './chunk-CX22S5BA.js';
+import { senderPidfile } from './chunk-KFRM23WD.js';
+import { installScrubContext } from './chunk-MSASO5O4.js';
+import { AssetError, describeCallFailure, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, refusalCode, resolveAgentUser, AgentUserError, runBuildSteps, removeStagedContext, stageGovernedContext, shellQuote, createRunnerLog, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, formatDuration, retrySend, formatClock, containerSenderCommand, syncInContainer, copyTranscriptsFromContainer, GH_CONFIG_YML, ghHostsYml, ADDED_USER, isLiteralAddress, signalInContainer, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript } from './chunk-RBKIH5ST.js';
+import { childEnvironment } from './chunk-KMDLFI4P.js';
 import { waitForAgent, vmExecArgs } from './chunk-QKFB4K7X.js';
 import { socketPathProblem, vsockLinks, linkVsockSockets } from './chunk-RSNSZ2LJ.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-6FH2AHJY.js';
-import { planArtifactUpload } from './chunk-JOXYKGUV.js';
-import { scrubText } from './chunk-3ZPYPFNM.js';
-import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-XR3BJN33.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-SWHQ4LUM.js';
+import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-22RMZBGW.js';
+import { readBranchHead, diffBetween, fetchCommit } from './chunk-R7PF5OOU.js';
+import { isSameProcess, startTimeOf } from './chunk-N5FOE5PS.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
 import { claudeCredential, repositoriesOf, primaryOf, buildEnvironment, JOB_MOUNT, CHECKOUT_DIR, parseIsolation, proxyEnvironment, containerLocalAddress, destinationEnvironment, CLAUDE_CREDENTIAL_VARIABLES, builtInEnvironment, startBuildServices, BUILT_IN_NAMES, AGENT_CREDENTIAL_MISSING, sharedUserEnvironment, headerVariables, withTunnelRecord, RELAY_PORT, checkEnvironment, EVAL_INPUT_DIR } from './chunk-4Q7OMKAT.js';
-import { parsePolicy } from './chunk-AHZQBGD2.js';
-import { readCloudConfig } from './chunk-EABW6AJQ.js';
+import { CLAUDE_CODE_VERSION } from './chunk-CX22S5BA.js';
+import { planArtifactUpload } from './chunk-WUYTWNMA.js';
+import { scrubText } from './chunk-JXYVA45C.js';
 import { withHooksPath, authorEnvironment, commitIdentityRecord } from './chunk-BYT5O5RV.js';
+import { parsePolicy } from './chunk-2M63GG56.js';
+import { readCloudConfig } from './chunk-EABW6AJQ.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
 import { signerFor } from './chunk-V7NIVOFD.js';
 import { runnerDir, buildDir, vsockPath, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';

package/dist/{chunk-ZQUCTFXC.js → chunk-FOJGZYFC.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { C } from './chunk-YRYMNBGQ.js';
-import { resolvePackRoot, loadTemplateFiles, loadMaintainedFiles, TEMPLATE_SKILLS, skillDir, writeMaintainedFiles, MAINTAINED_SKILLS } from './chunk-FO7KKPYG.js';
+import { resolvePackRoot, loadTemplateFiles, loadMaintainedFiles, TEMPLATE_SKILLS, skillDir, writeMaintainedFiles, MAINTAINED_SKILLS } from './chunk-ZA5CHAFY.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
 import { readFileSync, existsSync, mkdirSync, writeFileSync } from 'fs';
 import { join, dirname } from 'path';
@@ -10,7 +10,10 @@ createRequire(import.meta.url);
 var DEFAULT_TEMPLATE = "default";
 var POLICY_PATH = ".outerlayer/policy.yaml";
 var POLICY_CONTENT = "review: required\n";
-var VALIDATOR_FILES = ["code-review.yaml"];
+var VALIDATOR_FILES = [
+  { name: "code-review.yaml", label: "the code review check" },
+  { name: "acceptance-criteria.yaml", label: "the criteria judge check" }
+];
 var VALIDATORS_DIR = ".outerlayer/validators";
 var StarterPackError = class extends Error {
 };
@@ -24,7 +27,7 @@ function installStarterPack(opts) {
   const version = opts.version ?? resolvePackageVersion();
   const templateFiles = loadTemplateFiles(packRoot, version);
   const maintainedFiles = loadMaintainedFiles(packRoot, version);
-  const validatorFiles = VALIDATOR_FILES.map((name) => ({
+  const validatorFiles = VALIDATOR_FILES.map(({ name }) => ({
     path: `${VALIDATORS_DIR}/${name}`,
     content: readFileSync(join(packRoot, "validators", name), "utf8")
   }));
@@ -72,6 +75,9 @@ function installStarterPack(opts) {
   };
 }
 var skillFile = (skill) => `${skillDir(skill)}/SKILL.md`;
+function validatorLabel(path) {
+  return VALIDATOR_FILES.find(({ name }) => path === `${VALIDATORS_DIR}/${name}`)?.label ?? "a check";
+}
 function formatStarterPackOutput(result) {
   const lines = [];
   lines.push(`${C.green}\u2713${C.reset} Installed the starter skills in .outerlayer/skills/`, "");
@@ -87,7 +93,7 @@ function formatStarterPackOutput(result) {
     "",
     result.policy === "written" ? `${C.green}\u2713${C.reset} Wrote ${POLICY_PATH} (review required)` : `${C.dim}${POLICY_PATH} already exists \u2014 left as it is${C.reset}`,
     ...result.validatorsWritten.map(
-      (path) => `${C.green}\u2713${C.reset} Wrote ${path} (yours to edit \u2014 the code review check)`
+      (path) => `${C.green}\u2713${C.reset} Wrote ${path} (yours to edit \u2014 ${validatorLabel(path)})`
     ),
     ...result.validatorsKept.map((path) => `${C.dim}${path} already exists \u2014 left as it is${C.reset}`),
     "",
@@ -97,4 +103,4 @@ function formatStarterPackOutput(result) {
   return lines.join("\n") + "\n";
 }
 
-export { StarterPackError, assertKnownTemplate, formatStarterPackOutput, installStarterPack };
+export { POLICY_CONTENT, POLICY_PATH, StarterPackError, VALIDATORS_DIR, VALIDATOR_FILES, assertKnownTemplate, formatStarterPackOutput, installStarterPack };

package/dist/{chunk-G5XY6CVG.js → chunk-HFKKFTXU.js}

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { maintainedFilesForExistingSkills, loadMaintainedFiles, writeMaintainedFiles } from './chunk-FO7KKPYG.js';
-import { emitTree, parseOuterlayerConfig, classifyTree, generatedHeaderSource, CONTEXT_PIN_FILENAME, normalizePath } from './chunk-AHZQBGD2.js';
+import { C } from './chunk-YRYMNBGQ.js';
+import { maintainedFilesForExistingSkills, loadMaintainedFiles, writeMaintainedFiles } from './chunk-ZA5CHAFY.js';
+import { emitTree, parseOuterlayerConfig, classifyTree, generatedHeaderSource, CONTEXT_PIN_FILENAME, normalizePath } from './chunk-2M63GG56.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, copyFileSync, readdirSync } from 'fs';
 import { join, dirname, relative, sep } from 'path';
 
@@ -9,11 +10,6 @@ createRequire(import.meta.url);
 var CONTENT_KINDS = /* @__PURE__ */ new Set(["instructions", "skill", "skill-reference", "command", "mcp"]);
 var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git"]);
 var NO_CONFIG_MESSAGE = 'no .outerlayer/config.json with a non-empty targets array \u2014 create one, e.g. {"targets": ["claude-code"]}';
-var GREEN = "\x1B[32m";
-var YELLOW = "\x1B[33m";
-var RED = "\x1B[31m";
-var DIM = "\x1B[2m";
-var RESET = "\x1B[0m";
 var EmitError = class extends Error {
 };
 function resolveTargetsFromConfig(repoRoot) {
@@ -87,20 +83,20 @@ function writeOutputs(repoRoot, result, maintained) {
 function renderSuccess(targets, files, copies, maintained) {
   const copySuffix = copies.length > 0 ? `, ${copies.length} ${copies.length === 1 ? "copy" : "copies"}` : "";
   const lines = [
-    `${GREEN}\u2713${RESET} emitted ${files.length} file${files.length === 1 ? "" : "s"}${copySuffix} for ${DIM}${targets.join(", ")}${RESET}`
+    `${C.green}\u2713${C.reset} emitted ${files.length} file${files.length === 1 ? "" : "s"}${copySuffix} for ${C.dim}${targets.join(", ")}${C.reset}`
   ];
-  for (const path of maintained) lines.push(`  ${DIM}updated ${path} to this CLI's version${RESET}`);
+  for (const path of maintained) lines.push(`  ${C.dim}updated ${path} to this CLI's version${C.reset}`);
   return lines.join("\n");
 }
 function renderFailure(errors) {
-  const lines = [`${RED}\u2717${RESET} emit failed \u2014 nothing written`];
-  for (const e of errors) lines.push(`  ${RED}\u2717${RESET} ${e.path}: ${e.message}`);
+  const lines = [`${C.red}\u2717${C.reset} emit failed \u2014 nothing written`];
+  for (const e of errors) lines.push(`  ${C.red}\u2717${C.reset} ${e.path}: ${e.message}`);
   return lines.join("\n");
 }
 function renderCheck(targets, drift) {
-  if (drift.length === 0) return `${GREEN}\u2713${RESET} up to date for ${DIM}${targets.join(", ")}${RESET}`;
-  const lines = [`${RED}\u2717${RESET} drift detected (${drift.length}) \u2014 run \`outerlayer emit\` to update`];
-  for (const d of drift) lines.push(`  ${RED}\u2717${RESET} ${d.kind.padEnd(8)} ${d.path}`);
+  if (drift.length === 0) return `${C.green}\u2713${C.reset} up to date for ${C.dim}${targets.join(", ")}${C.reset}`;
+  const lines = [`${C.red}\u2717${C.reset} drift detected (${drift.length}) \u2014 run \`outerlayer emit\` to update`];
+  for (const d of drift) lines.push(`  ${C.red}\u2717${C.reset} ${d.kind.padEnd(8)} ${d.path}`);
   return lines.join("\n");
 }
 function compareFile(repoRoot, path, expectedContent) {
@@ -205,7 +201,7 @@ function runEmit(opts = {}) {
       process.stderr.write(output + "\n");
     } else {
       process.stdout.write(output + "\n");
-      for (const w of result.warnings) process.stderr.write(`  ${YELLOW}!${RESET} ${w.path}: ${w.message}
+      for (const w of result.warnings) process.stderr.write(`  ${C.yellow}!${C.reset} ${w.path}: ${w.message}
 `);
     }
   }
@@ -249,7 +245,7 @@ function runCheck(cwd, opts, targets, result, hasErrors, sourcePaths, maintained
       process.stderr.write(output + "\n");
     } else {
       process.stdout.write(output + "\n");
-      for (const w of result.warnings) process.stderr.write(`  ${YELLOW}!${RESET} ${w.path}: ${w.message}
+      for (const w of result.warnings) process.stderr.write(`  ${C.yellow}!${C.reset} ${w.path}: ${w.message}
 `);
     }
   }