@outerlayer/cli 0.12.0 → 0.14.0

package/dist/{chunk-G4RXNF2L.js → chunk-NHDVD7DU.js}

@@ -1,24 +1,24 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LEASE_SECONDS, releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, ALREADY_RELEASED } from './chunk-DVT73QJO.js';
+import { LEASE_SECONDS, releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, ALREADY_RELEASED } from './chunk-4OGPT6I2.js';
 import { writePendingUpdate } from './chunk-O765JR4W.js';
 import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-UGP76IZ5.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
-import { writeJobFile, readJobFile, readJobFileChecked } from './chunk-T6OIJQRT.js';
-import { compareVersions, satisfiesRange } from './chunk-I2UOAV7X.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-YETTWTAY.js';
+import { writeJobFile, readJobFile, readJobFileChecked } from './chunk-RMWLBUCJ.js';
+import { compareVersions, satisfiesRange } from './chunk-I2UOAV7X.js';
 import { RUNNER_PROTOCOL } from './chunk-FI5UYJMQ.js';
-import { placeholderQueues, placeholderProblem } from './chunk-PDRYXERC.js';
+import { placeholderQueues, placeholderProblem } from './chunk-SMHOCDCI.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, cleanVersions, isInLayout, stagingDir } from './chunk-TI7B7UEO.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, BuildTokens, classifyRefusal, refusalCode, measureDisk, createRunnerLog, setUpRunnerCgroup, parseCpuList, ensureTunnel, keepGhConfigCurrent, createContainerRuntime, formatClock } from './chunk-SKHN72JO.js';
-import { checkFit } from './chunk-2KLBKHT4.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, BuildTokens, classifyRefusal, refusalCode, measureDisk, createRunnerLog, setUpRunnerCgroup, parseCpuList, ensureTunnel, keepGhConfigCurrent, createContainerRuntime, formatClock } from './chunk-RBKIH5ST.js';
+import { spawnRun } from './chunk-KMDLFI4P.js';
+import { checkFit } from './chunk-RLYZLUQ7.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-SWHQ4LUM.js';
+import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-22RMZBGW.js';
 import { startTimeOf, claimPidFile, readPidFile, isSameProcess, releasePidFile } from './chunk-N5FOE5PS.js';
-import { spawnRun } from './chunk-GGMRZPEA.js';
-import { builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, BUILD_LABEL, RUNNER_LABEL } from './chunk-QEESCZ26.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-6FH2AHJY.js';
-import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-XR3BJN33.js';
+import { builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, BUILD_LABEL, RUNNER_LABEL } from './chunk-4NPZVMJU.js';
 import { exceedsDisk } from './chunk-7RQ73DLO.js';
 import { parseClaimedRepositories, repositoriesOf, primaryOf, sharedUserEnvironment, JOB_MOUNT, claudeCredential } from './chunk-4Q7OMKAT.js';
 import { parseClaimIdentity } from './chunk-BYT5O5RV.js';
@@ -1315,7 +1315,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-JPM37MLF.js');
+  const { postJson: postJson2 } = await import('./work-cmd-RVRQ32EH.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -2072,7 +2072,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     const outcome = await onStartUnderMarker({
       configPath,
       own: ownVersionOf(deps),
-      check: update.check ? () => update.check(configPath) : async () => (await import('./check-RJOJU2WA.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
+      check: update.check ? () => update.check(configPath) : async () => (await import('./check-SRGR36KI.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
     });

package/dist/{chunk-GATMPAMK.js → chunk-NPQWKGUA.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-C7N4TDHW.js';
-import { resolveRepoIdentity } from './chunk-3ZPYPFNM.js';
+import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-YDSMROTB.js';
+import { resolveRepoIdentity } from './chunk-JXYVA45C.js';
 import { resolveGatewayCredentials } from './chunk-PLMTLGYH.js';
 import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';

package/dist/{chunk-YEQL54G5.js → chunk-PQUM37BK.js}

@@ -634,7 +634,7 @@ async function runHookFast(event, home = homeFromEnv(), read = readStdin, env =
       recordHookErrorsSeen(home, hookErrorsBytes);
       if (contextPossiblyGoverned(sessionCwd, home)) {
         try {
-          const { materializeContext: materialize } = await import('./context-materialize-45OVRRK2.js');
+          const { materializeContext: materialize } = await import('./context-materialize-FDHYKNDT.js');
           const sessionId = typeof payload.session_id === "string" ? payload.session_id : "unknown";
           const result = await materialize({ cwd: sessionCwd, sessionId, home });
           materializeMessage = result.message;

package/dist/{chunk-GEBQXUFY.js → chunk-Q2UK3C4P.js}

@@ -1,9 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-IBB4D4KE.js';
-import { MIN_ENGINE_MAJOR } from './chunk-SKHN72JO.js';
-import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-VK25O2ZM.js';
-import { RUNNER_DIR_MODE, runnerDir, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-JYIEHQIF.js';
+import { MIN_ENGINE_MAJOR } from './chunk-RBKIH5ST.js';
+import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-T5VPP6H7.js';
+import { runnerCredentialProblem } from './chunk-22RMZBGW.js';
+import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import { dirname } from 'path';
 
@@ -61,9 +62,8 @@ function parseStdinConfig(configPath, text) {
   } catch (err) {
     throw new RunnerInitError(`the config on stdin is not valid JSON (${err instanceof Error ? err.message : String(err)})`);
   }
-  if (typeof config.url !== "string" || typeof config.apiKey !== "string" || typeof config.appId !== "string") {
-    throw new RunnerInitError("the config on stdin needs url, apiKey and appId.");
-  }
+  const problem = runnerCredentialProblem(config);
+  if (problem !== void 0) throw new RunnerInitError(`the config on stdin: ${problem.field} ${problem.reason}.`);
   const carried = config.runner;
   const credential = handedCredential(config.claudeCredential);
   const agent = handedAgent(config.agent);
@@ -73,15 +73,22 @@ function parseStdinConfig(configPath, text) {
   return { config, carried, credential, agent };
 }
 function runRunnerInit(configPath, opts = {}) {
+  return writeRunnerInit(prepareRunnerInit(configPath, opts));
+}
+function prepareRunnerInit(configPath, opts = {}) {
   let config;
   let carried;
   let credential = opts.credential;
   let agent = opts.agent;
+  let needsKey = false;
   if (opts.configFromStdin === void 0) {
-    config = readConfigObject(configPath);
+    config = opts.keyFromLogin === true && !existsSync(configPath) ? {} : readConfigObject(configPath);
     if (config.runner !== void 0) {
       throw new RunnerInitError(`${configPath}: a runner block is already here. Edit it, or remove it and run this again.`);
     }
+    needsKey = opts.keyFromLogin === true && config.apiKey === void 0;
+    const problem = needsKey ? void 0 : runnerCredentialProblem(config);
+    if (problem !== void 0) throw new RunnerInitError(`${configPath}: ${problem.field} ${problem.reason}.`);
   } else {
     const handed = parseStdinConfig(configPath, opts.configFromStdin);
     ({ config, carried } = handed);
@@ -100,7 +107,14 @@ function runRunnerInit(configPath, opts = {}) {
       "--agent claude needs Claude's credential, and none was piped on stdin or is in the runner.env beside the config. Pipe a token from `claude setup-token`, or an Anthropic API key: printf '%s' \"$CLAUDE_CODE_OAUTH_TOKEN\" | outerlayer runner init --agent claude"
     );
   }
-  if (opts.configFromStdin !== void 0) mkdirSync(dirname(configPath), { recursive: true, mode: RUNNER_DIR_MODE });
+  return { configPath, config, carried, credential, agent, machine, hooks, needsKey };
+}
+function writeRunnerInit(prepared, runnerKey) {
+  const { configPath, config, carried, credential, agent, machine, hooks } = prepared;
+  if (prepared.needsKey && runnerKey === void 0) {
+    throw new RunnerInitError(`${configPath}: apiKey is missing, and no runner key was created from the login.`);
+  }
+  if (runnerKey !== void 0) Object.assign(config, { url: runnerKey.url, apiKey: runnerKey.apiKey, appId: runnerKey.appId });
   mkdirSync(runnerDir(configPath), { recursive: true, mode: RUNNER_DIR_MODE });
   config.runner = {
     queues: ["implement", "amend"],
@@ -127,4 +141,4 @@ function runRunnerInit(configPath, opts = {}) {
   return { configPath, hooks, ...hooks === "builtin:process" ? { note: isolationNote(machine) } : {}, credential: stored };
 }
 
-export { PLACEHOLDER_MARKER, RunnerInitError, isPlaceholderCommand, readConfigObject, runRunnerInit };
+export { PLACEHOLDER_MARKER, RunnerInitError, isPlaceholderCommand, prepareRunnerInit, readConfigObject, runRunnerInit, writeRunnerInit };

package/dist/{chunk-SKHN72JO.js → chunk-RBKIH5ST.js}

@@ -1,24 +1,24 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-3FMPZPJQ.js';
-import { startTimeOf, isSameProcess } from './chunk-N5FOE5PS.js';
-import { currentCliBuild } from './chunk-OGFGZQA3.js';
-import { createDockerHost, childEnvironment, spawnRun } from './chunk-GGMRZPEA.js';
-import { RecipeError } from './chunk-QOZKPLVJ.js';
-import { builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, containerExecArgs } from './chunk-QEESCZ26.js';
-import { CLAUDE_CODE_VERSION, firecrackerArch, MICROVM_ARCHES, DEFAULT_BASE_IMAGE, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GUEST_ASSETS_VERSION } from './chunk-CX22S5BA.js';
+import { createDockerHost, childEnvironment, spawnRun } from './chunk-KMDLFI4P.js';
 import { execCapture } from './chunk-QKFB4K7X.js';
 import { GUEST_CID } from './chunk-RSNSZ2LJ.js';
-import { WorkCommandError, postJson } from './chunk-6FH2AHJY.js';
-import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-3ZPYPFNM.js';
+import { WorkCommandError, postJson } from './chunk-SWHQ4LUM.js';
 import { hostAllowed } from './chunk-UXYLWVTQ.js';
+import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-R7PF5OOU.js';
+import { RecipeError } from './chunk-QOZKPLVJ.js';
+import { startTimeOf, isSameProcess } from './chunk-N5FOE5PS.js';
+import { currentCliBuild } from './chunk-OGFGZQA3.js';
+import { builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, containerExecArgs } from './chunk-4NPZVMJU.js';
 import { parseDuKilobytes } from './chunk-7RQ73DLO.js';
 import { repositoriesOf, primaryOf, RELAY_PORT, CHECKOUT_DIR, JOB_MOUNT, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, checkoutPath } from './chunk-4Q7OMKAT.js';
-import { defaultGitRunner, materializeContext } from './chunk-SZOVKFWB.js';
-import { readContextManifest, readSourceCache } from './chunk-G5IEVZGI.js';
-import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-AHZQBGD2.js';
+import { CLAUDE_CODE_VERSION, firecrackerArch, MICROVM_ARCHES, DEFAULT_BASE_IMAGE, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GUEST_ASSETS_VERSION } from './chunk-CX22S5BA.js';
+import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-JXYVA45C.js';
+import { defaultGitRunner, materializeContext } from './chunk-3NLOVYJQ.js';
+import { readContextManifest, readSourceCache } from './chunk-LCEXHCHD.js';
 import { signingFetchFor } from './chunk-YO4PSLVB.js';
-import { downconvertSession } from './chunk-325272HM.js';
+import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-2M63GG56.js';
+import { downconvertSession } from './chunk-J5M7BSJQ.js';
 import { signerFor } from './chunk-V7NIVOFD.js';
 import { rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, stagedContextDir, contextHomeDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, RUNNER_DIR_MODE, vmAssetsDir } from './chunk-ZM2IMMYN.js';
 import { relative, join, dirname, basename } from 'path';

package/dist/{chunk-2KLBKHT4.js → chunk-RLYZLUQ7.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { builtinKind } from './chunk-XR3BJN33.js';
+import { builtinKind } from './chunk-22RMZBGW.js';
 import { parseSize } from './chunk-7RQ73DLO.js';
 import { runnerDir } from './chunk-ZM2IMMYN.js';
 import { dirname } from 'path';

package/dist/chunk-RMWLBUCJ.js

@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
+import { existsSync, readFileSync, mkdirSync, chmodSync, writeFileSync } from 'fs';
+import { dirname, join } from 'path';
+
+createRequire(import.meta.url);
+var ITEM_KEY_FILE = "item-key";
+function itemKeyPath(jobPath) {
+  return join(dirname(jobPath), ITEM_KEY_FILE);
+}
+function withItemKey(jobPath, job) {
+  let key;
+  try {
+    key = readFileSync(itemKeyPath(jobPath), "utf8").trim();
+  } catch {
+    return job;
+  }
+  return key === "" ? job : { ...job, itemKey: key };
+}
+function writeOwnerOnly(path, content) {
+  if (existsSync(path)) chmodSync(path, RUNNER_FILE_MODE);
+  writeFileSync(path, content, { mode: RUNNER_FILE_MODE });
+}
+function readJobFile(path) {
+  if (!existsSync(path)) return null;
+  try {
+    return withItemKey(path, JSON.parse(readFileSync(path, "utf8")));
+  } catch {
+    return null;
+  }
+}
+function readJobFileChecked(path) {
+  if (!existsSync(path)) return { kind: "missing" };
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return { kind: "unreadable" };
+    return { kind: "ok", job: withItemKey(path, parsed) };
+  } catch {
+    return { kind: "unreadable" };
+  }
+}
+function writeJobFile(path, job) {
+  mkdirSync(dirname(path), { recursive: true, mode: RUNNER_DIR_MODE });
+  const { itemKey, ...rest } = job;
+  if (itemKey !== void 0) writeOwnerOnly(itemKeyPath(path), itemKey);
+  writeOwnerOnly(path, JSON.stringify(rest, null, 2));
+}
+
+export { readJobFile, readJobFileChecked, writeJobFile };

package/dist/{chunk-PDRYXERC.js → chunk-SMHOCDCI.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-GEBQXUFY.js';
-import { describeCallFailure } from './chunk-SKHN72JO.js';
-import { WorkCommandError, getJson } from './chunk-6FH2AHJY.js';
-import { sanitizeTerminal } from './chunk-JOXYKGUV.js';
-import { builtinKind } from './chunk-XR3BJN33.js';
+import { isPlaceholderCommand } from './chunk-Q2UK3C4P.js';
+import { describeCallFailure } from './chunk-RBKIH5ST.js';
+import { WorkCommandError, getJson } from './chunk-SWHQ4LUM.js';
+import { builtinKind } from './chunk-22RMZBGW.js';
 import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential } from './chunk-4Q7OMKAT.js';
+import { sanitizeTerminal } from './chunk-WUYTWNMA.js';
 import { signerFor } from './chunk-V7NIVOFD.js';
 
 createRequire(import.meta.url);

package/dist/{chunk-6FH2AHJY.js → chunk-SWHQ4LUM.js}

@@ -1,13 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { autoConnect } from './chunk-GATMPAMK.js';
+import { autoConnect } from './chunk-NPQWKGUA.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
-import { sanitizeTerminal } from './chunk-JOXYKGUV.js';
-import { resolveRepoIdentity } from './chunk-3ZPYPFNM.js';
+import { workPageUrl } from './chunk-YDSMROTB.js';
+import { sanitizeTerminal } from './chunk-WUYTWNMA.js';
+import { resolveRepoIdentity } from './chunk-JXYVA45C.js';
+import { C } from './chunk-YRYMNBGQ.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { defaultFetch } from './chunk-YO4PSLVB.js';
 import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-PLMTLGYH.js';
 import { signRunnerRequest } from './chunk-V7NIVOFD.js';
+import { readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 
 createRequire(import.meta.url);
@@ -39,10 +42,6 @@ function isSignatureRefusal(code) {
 }
 
 // src/work-cmd.ts
-var GREEN = "\x1B[32m";
-var YELLOW = "\x1B[33m";
-var DIM = "\x1B[2m";
-var RESET = "\x1B[0m";
 async function signatureHeaders(method, endpoint, payload, signer) {
   if (signer === void 0) return {};
   return { ...await signRunnerRequest({ method, url: endpoint, body: new TextEncoder().encode(payload), signer }) };
@@ -298,7 +297,19 @@ function tokenWarning(data) {
   if (tokens === void 0 || tokens === null || tokens.earnable !== false) return "";
   const why = typeof tokens.message === "string" ? sanitizeTerminal(tokens.message) : "the gateway named no reason";
   return `
-${YELLOW}!${RESET} a container host will fail this build: ${why}`;
+${C.yellow}!${C.reset} a container host will fail this build: ${why}`;
+}
+function itemLabel(data) {
+  return data.number != null ? `item #${data.number}` : `item ${sanitizeTerminal(String(data.workItemId))}`;
+}
+function issueLabel(subject) {
+  if ("issue" in subject) return `issue ${sanitizeTerminal(subject.repository)}#${subject.issue}`;
+  return `issue ${sanitizeTerminal(subject.key)}`;
+}
+function itemPageUrl(home, cwd, appId, workItemId) {
+  const connection = readRepoConnection(cwd);
+  if (connection === void 0 || connection.appId !== appId || typeof workItemId !== "string" || workItemId === "") return void 0;
+  return `${workPageUrl(home, connection.organization.name, connection.factory.name)}/${encodeURIComponent(workItemId)}`;
 }
 async function runWorkBuild(opts) {
   const cwd = opts.cwd ?? process.cwd();
@@ -326,7 +337,7 @@ async function runWorkBuild(opts) {
     const label = data2.number != null ? `#${data2.number}` : String(data2.workItemId);
     const launch = data2.number != null ? `OUTERLAYER_WORK=${data2.number} claude` : null;
     const branch = typeof data2.branch === "string" && data2.branch !== "" ? data2.branch : null;
-    const output2 = opts.json ? JSON.stringify({ ...data2, ...launch !== null ? { launchCommand: launch } : {} }) : `${GREEN}\u2713${RESET} on Work for you to build ${DIM}\xB7${RESET} ${label} ${DIM}\xB7${RESET} no host will take it` + (branch !== null ? `
+    const output2 = opts.json ? JSON.stringify({ ...data2, ...launch !== null ? { launchCommand: launch } : {} }) : `${C.green}\u2713${C.reset} on Work for you to build ${C.dim}\xB7${C.reset} ${label} ${C.dim}\xB7${C.reset} no host will take it` + (branch !== null ? `
   branch: ${branch}` : "") + (launch !== null ? `
   start your session with: ${launch}` : "");
     if (!opts.quiet) process.stdout.write(output2 + "\n");
@@ -338,7 +349,9 @@ async function runWorkBuild(opts) {
     ...facts
   };
   const { data } = await postJsonWithRetry(url, "/v1/work-items/build", apiKey, appId, body, fetchImpl, retries, sleep);
-  const output = opts.json ? JSON.stringify(data) : `${GREEN}\u2713${RESET} build requested ${DIM}\xB7${RESET} ${data.number != null ? `#${data.number}` : data.workItemId} ${DIM}\xB7${RESET} by ${data.attestor}` + tokenWarning(data);
+  const page = itemPageUrl(home, cwd, appId, data.workItemId);
+  const output = opts.json ? JSON.stringify(data) : `${C.green}\u2713${C.reset} build requested ${C.dim}\xB7${C.reset} ${itemLabel(data)}${"subject" in body ? ` (${issueLabel(body.subject)})` : ""} ${C.dim}\xB7${C.reset} by ${data.attestor}` + (page !== void 0 ? `
+  ${page}` : "") + tokenWarning(data);
   if (!opts.quiet) process.stdout.write(output + "\n");
   return { data, output };
 }
@@ -347,7 +360,7 @@ async function runWorkLinkSession(opts) {
     return await linkSession(opts);
   } catch (err) {
     if (opts.logFailures) {
-      const { logHookError } = await import('./hook-fast-HLESEJAL.js');
+      const { logHookError } = await import('./hook-fast-WYQD6D7T.js');
       const reason = err instanceof Error ? err.message : String(err);
       logHookError(opts.home ?? homeFromEnv(opts.env ?? process.env), new Error(`work link-session #${opts.number} failed: ${reason}`));
     }
@@ -387,7 +400,7 @@ async function linkSession(opts) {
   }
   const heldBy = typeof data.heldBy === "string" ? data.heldBy : void 0;
   const linked = data.linked === true;
-  const output = opts.json ? JSON.stringify(data) : opts.ended ? linked ? `${GREEN}\u2713${RESET} ended ${DIM}\xB7${RESET} session ${sessionId} ${DIM}\xB7${RESET} #${number}` : `${DIM}\xB7${RESET} session ${sessionId} was not linked to #${number}` : heldBy ? `${DIM}\xB7${RESET} session ${sessionId} linked to #${number}, held by ${sanitizeTerminal(heldBy)} \u2014 no lease taken` : `${GREEN}\u2713${RESET} linked ${DIM}\xB7${RESET} session ${sessionId} ${DIM}\xB7${RESET} #${number}`;
+  const output = opts.json ? JSON.stringify(data) : opts.ended ? linked ? `${C.green}\u2713${C.reset} ended ${C.dim}\xB7${C.reset} session ${sessionId} ${C.dim}\xB7${C.reset} #${number}` : `${C.dim}\xB7${C.reset} session ${sessionId} was not linked to #${number}` : heldBy ? `${C.dim}\xB7${C.reset} session ${sessionId} linked to #${number}, held by ${sanitizeTerminal(heldBy)} \u2014 no lease taken` : `${C.green}\u2713${C.reset} linked ${C.dim}\xB7${C.reset} session ${sessionId} ${C.dim}\xB7${C.reset} #${number}`;
   if (!opts.quiet) process.stdout.write(output + "\n");
   return { data, output };
 }
@@ -411,7 +424,7 @@ async function runWorkRemove(opts) {
       { reason: opts.reason, ...environmentFacts({ cwd, env, home }) },
       fetchImpl
     );
-    const output2 = opts.json ? JSON.stringify(data2) : `${GREEN}\u2713${RESET} removed ${DIM}\xB7${RESET} ${data2.workItemId} ${DIM}\xB7${RESET} withdrawn ${data2.itemWithdrawn}`;
+    const output2 = opts.json ? JSON.stringify(data2) : `${C.green}\u2713${C.reset} removed ${C.dim}\xB7${C.reset} ${data2.workItemId} ${C.dim}\xB7${C.reset} withdrawn ${data2.itemWithdrawn}`;
     if (!opts.quiet) process.stdout.write(output2 + "\n");
     return { data: data2, output: output2 };
   }
@@ -421,7 +434,7 @@ async function runWorkRemove(opts) {
   const item = await findLiveItem(creds, repository, subject, fetchImpl);
   if (!item) {
     const data2 = { workItemId: null, removed: true, itemWithdrawn: false, noLiveAddition: true };
-    const output2 = opts.json ? JSON.stringify(data2) : `${GREEN}\u2713${RESET} nothing to remove ${DIM}\xB7${RESET} no live addition on ${repository}#${number}`;
+    const output2 = opts.json ? JSON.stringify(data2) : `${C.green}\u2713${C.reset} nothing to remove ${C.dim}\xB7${C.reset} no live addition on ${repository}#${number}`;
     if (!opts.quiet) process.stdout.write(output2 + "\n");
     return { data: data2, output: output2 };
   }
@@ -433,7 +446,7 @@ async function runWorkRemove(opts) {
     { reason: opts.reason, ...environmentFacts({ cwd, env, home }) },
     fetchImpl
   );
-  const output = opts.json ? JSON.stringify(data) : `${GREEN}\u2713${RESET} removed ${DIM}\xB7${RESET} ${data.workItemId} ${DIM}\xB7${RESET} withdrawn ${data.itemWithdrawn}`;
+  const output = opts.json ? JSON.stringify(data) : `${C.green}\u2713${C.reset} removed ${C.dim}\xB7${C.reset} ${data.workItemId} ${C.dim}\xB7${C.reset} withdrawn ${data.itemWithdrawn}`;
   if (!opts.quiet) process.stdout.write(output + "\n");
   return { data, output };
 }
@@ -496,10 +509,10 @@ async function runWorkList(opts) {
   const claimSuffix = (claim) => {
     if (!claim) return "";
     const holder = claim.holderKind === "session" ? `${claim.memberName || "a member"} (local session` : `${sanitizeTerminal(claim.host)} (${claim.kind}`;
-    return ` ${DIM}\xB7${RESET} claimed by ${holder}, since ${claim.createdAt}, until ${claim.expiresAt})`;
+    return ` ${C.dim}\xB7${C.reset} claimed by ${holder}, since ${claim.createdAt}, until ${claim.expiresAt})`;
   };
   const output = opts.json ? JSON.stringify(data) : items.length === 0 ? "no live work items" : items.map(
-    (i) => `${i.trackerKey} ${DIM}\xB7${RESET} ${i.stage} ${DIM}\xB7${RESET} ${i.section} ${DIM}\xB7${RESET} ${i.title}${claimSuffix(i.claim)}`
+    (i) => `${i.trackerKey} ${C.dim}\xB7${C.reset} ${i.stage} ${C.dim}\xB7${C.reset} ${i.section} ${C.dim}\xB7${C.reset} ${i.title}${claimSuffix(i.claim)}`
   ).join("\n");
   if (!opts.quiet) process.stdout.write(output + "\n");
   return { data, output };

package/dist/{agent-setup-52LRZ6AY.js → chunk-SXWS25JC.js}

@@ -1,26 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runEmit } from './chunk-G5XY6CVG.js';
-import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME } from './chunk-A56PYPDF.js';
-import { installStarterPack } from './chunk-ZQUCTFXC.js';
+import { runEmit } from './chunk-HFKKFTXU.js';
+import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME } from './chunk-XCK2YAY5.js';
+import { installStarterPack } from './chunk-FOJGZYFC.js';
 import { C } from './chunk-YRYMNBGQ.js';
-import { resolveGitCommonDir, defaultGitRunner } from './chunk-SZOVKFWB.js';
-import './chunk-ZJSNLVCE.js';
-import { loadTemplateFiles, loadMaintainedFiles, skillDir } from './chunk-FO7KKPYG.js';
-import { pinExists, readContextManifest } from './chunk-G5IEVZGI.js';
-import { generatedHeaderSource } from './chunk-AHZQBGD2.js';
-import './chunk-YO4PSLVB.js';
-import './chunk-PLMTLGYH.js';
-import './chunk-325272HM.js';
-import './chunk-EABW6AJQ.js';
-import './chunk-BYT5O5RV.js';
-import './chunk-RA3O54FC.js';
-import './chunk-V7NIVOFD.js';
-import './chunk-ZM2IMMYN.js';
-import './chunk-XCCLFVXM.js';
-import './chunk-BJ3KTMDH.js';
-import './chunk-VNVZDWO3.js';
-import './chunk-Z5GEFMRW.js';
+import { resolveGitCommonDir, defaultGitRunner } from './chunk-3NLOVYJQ.js';
+import { pinExists, readContextManifest } from './chunk-LCEXHCHD.js';
+import { loadTemplateFiles, loadMaintainedFiles, skillDir } from './chunk-ZA5CHAFY.js';
+import { generatedHeaderSource } from './chunk-2M63GG56.js';
 import { execFileSync } from 'child_process';
 import { existsSync, mkdirSync, writeFileSync } from 'fs';
 import { join, dirname } from 'path';
@@ -201,4 +188,4 @@ ${renderPaths(paths, kept)}${mcpNote}`;
 `;
 }
 
-export { runAgentSetup };
+export { keepHandWritten, runAgentSetup };

package/dist/{chunk-VK25O2ZM.js → chunk-T5VPP6H7.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_UNIT_NAME } from './chunk-2KLBKHT4.js';
+import { DEFAULT_UNIT_NAME } from './chunk-RLYZLUQ7.js';
 import { parseRunnerEnv } from './chunk-6MZSX4M7.js';
 import { RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
 import { existsSync, readFileSync, writeFileSync, renameSync, rmSync } from 'fs';

package/dist/{chunk-JOXYKGUV.js → chunk-WUYTWNMA.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { ArtifactTombstoneRecordSchema, ArtifactSpoolRecordSchema } from './chunk-325272HM.js';
+import { ArtifactTombstoneRecordSchema, ArtifactSpoolRecordSchema } from './chunk-J5M7BSJQ.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, appendFileSync, writeFileSync, renameSync, unlinkSync, existsSync, readdirSync, readFileSync, statSync } from 'fs';
 import { join, dirname } from 'path';
@@ -214,7 +214,9 @@ function readPersistedArtifactSpoolState(home) {
         attempts: typeof e.attempts === "number" && Number.isFinite(e.attempts) ? e.attempts : 0,
         firstSeen: typeof e.firstSeen === "string" ? e.firstSeen : (/* @__PURE__ */ new Date(0)).toISOString(),
         sha256: typeof e.sha256 === "string" ? e.sha256 : "",
-        reachedServer: e.reachedServer === true
+        reachedServer: e.reachedServer === true,
+        ...typeof e.serverId === "string" ? { serverId: e.serverId } : {},
+        ...typeof e.url === "string" ? { url: e.url } : {}
       });
     }
     return { state, corrupt: false };

package/dist/{chunk-A56PYPDF.js → chunk-XCK2YAY5.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { C } from './chunk-YRYMNBGQ.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
-import { existsSync, writeFileSync, mkdirSync, readFileSync } from 'fs';
+import { existsSync, writeFileSync, readFileSync, mkdirSync } from 'fs';
 import { join, dirname } from 'path';
 
 createRequire(import.meta.url);
@@ -62,13 +62,23 @@ function addMcpEntryIfAbsent(repoRoot, name, entry) {
 `);
   return { path: relPath, added: true };
 }
+function setMcpEntry(repoRoot, name, entry) {
+  const relPath = mcpTargetPath(repoRoot);
+  const absPath = join(repoRoot, relPath);
+  const doc = readMcpDoc(absPath, relPath);
+  const servers = doc.mcpServers ?? {};
+  writeFileSync(absPath, `${JSON.stringify({ ...doc, mcpServers: { ...servers, [name]: entry } }, null, 2)}
+`);
+}
+var INIT_STDIO_ENTRY = { type: "stdio", command: "npx", args: ["-y", "@outerlayer/cli", "mcp", "serve"] };
 function addStdioMcpEntryIfAbsent(repoRoot, name = "outerlayer") {
-  return addMcpEntryIfAbsent(repoRoot, name, buildStdioServerEntry(DEFAULT_MCP_COMMAND, void 0, void 0));
+  return addMcpEntryIfAbsent(repoRoot, name, { ...INIT_STDIO_ENTRY, args: [...INIT_STDIO_ENTRY.args] });
 }
 var DOCS_MCP_SERVER_NAME = "outerlayer-docs";
 var DOCS_MCP_URL = "https://docs.outerlayer.ai/mcp";
+var INIT_DOCS_ENTRY = { type: "http", url: DOCS_MCP_URL };
 function addDocsMcpEntryIfAbsent(repoRoot) {
-  return addMcpEntryIfAbsent(repoRoot, DOCS_MCP_SERVER_NAME, { type: "http", url: DOCS_MCP_URL });
+  return addMcpEntryIfAbsent(repoRoot, DOCS_MCP_SERVER_NAME, { ...INIT_DOCS_ENTRY });
 }
 function runMcpInstall(opts = {}) {
   const cwd = opts.cwd ?? process.cwd();
@@ -99,4 +109,4 @@ function handleMcpInstallError(err) {
   process.exitCode = 1;
 }
 
-export { DEFAULT_MCP_COMMAND, DOCS_MCP_SERVER_NAME, McpInstallError, addDocsMcpEntryIfAbsent, addStdioMcpEntryIfAbsent, buildServerEntry, buildStdioServerEntry, defaultMcpUrl, handleMcpInstallError, runMcpInstall };
+export { DEFAULT_MCP_COMMAND, DOCS_MCP_SERVER_NAME, INIT_DOCS_ENTRY, INIT_STDIO_ENTRY, McpInstallError, addDocsMcpEntryIfAbsent, addStdioMcpEntryIfAbsent, buildServerEntry, buildStdioServerEntry, defaultMcpUrl, handleMcpInstallError, mcpTargetPath, runMcpInstall, setMcpEntry };

package/dist/{chunk-C7N4TDHW.js → chunk-YDSMROTB.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { sanitizeTerminal } from './chunk-JOXYKGUV.js';
-import { remoteLookupFailed } from './chunk-3ZPYPFNM.js';
-import { DEFAULT_DASHBOARD } from './chunk-USO2DKBD.js';
+import { sanitizeTerminal } from './chunk-WUYTWNMA.js';
+import { remoteLookupFailed } from './chunk-JXYVA45C.js';
+import { DEFAULT_DASHBOARD } from './chunk-4KSQKQXE.js';
 import { resolveGatewayCredentials } from './chunk-PLMTLGYH.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
 import { writeRepoConnection, findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
@@ -181,7 +181,7 @@ function saveFactoryConnection(gitCommonDir, saved, factory, now) {
   });
 }
 function connectedLine(repository, factory, reason) {
-  return `Connected ${repository} to factory "${factory.displayName}" in ${factory.organization.displayName} (${REASON_TEXT[reason]}).`;
+  return `Connected ${repository} to factory "${factory.displayName}" (${slug(factory)}) in ${factory.organization.displayName} (${REASON_TEXT[reason]}).`;
 }
 function autoConnectedLine(repository, factory, reason) {
   return `Using factory "${factory.displayName}" in ${factory.organization.displayName} for ${repository} (${REASON_TEXT[reason]}); saved for this checkout.`;
@@ -310,4 +310,4 @@ ${COMMIT_LINE}
   return r.code;
 }
 
-export { COMMIT_LINE, autoConnectedLine, fetchFactories, isLinkedRepository, promptOnTerminal, realConnectDeps, runConnect, runConnectCommand, saveFactoryConnection, selectFactory };
+export { COMMIT_LINE, autoConnectedLine, fetchFactories, isLinkedRepository, promptOnTerminal, realConnectDeps, runConnect, runConnectCommand, saveFactoryConnection, selectFactory, workPageUrl };

package/dist/{chunk-FO7KKPYG.js → chunk-ZA5CHAFY.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { splitRawFile } from './chunk-AHZQBGD2.js';
+import { splitRawFile } from './chunk-2M63GG56.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, readdirSync } from 'fs';
 import { join, dirname } from 'path';
 import { fileURLToPath } from 'url';
 
 createRequire(import.meta.url);
-var TEMPLATE_SKILLS = ["spec", "writing-specs", "build"];
+var TEMPLATE_SKILLS = ["spec", "writing-specs", "writing-tests", "build"];
 var MAINTAINED_SKILLS = ["emitting-evidence", "amend", "reporting-findings", "outerlayer"];
 var TEMPLATE_CLASS_LINE = "<!-- yours to edit. Copied once from the default template by outerlayer init; never overwritten. -->";
 function maintainedClassLine(version) {