@outerlayer/cli 0.14.0 → 0.15.0

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @outerlayer/cli
 
+## 0.15.0
+
+### Minor Changes
+
+- 9f42028: `outerlayer work status` now shows the acceptance criteria recorded for an item, in a Criteria section marked "drafted by the build" when the build wrote them, and as `criteria` in `--json`. The `get_work_item` MCP tool returns the same field.
+
+### Patch Changes
+
+- e5b5713: A runner with `runner.update.maxWaitHours` set to 0 now claims nothing while a build runs and an update is pending. A clock tick between two reads in the same pass could leave the wait looking one millisecond short and let that pass claim work.
+- 8d3eacb: Update the runner protocol contract to match the gateway's repository governance answer.
+
+## 0.14.1
+
+### Patch Changes
+
+- f47136a: The starter `/build` skill now links each criterion to the tests that cite it, so the work item's Criteria tab lists them instead of "No tests found". A new script, `criterion-citations.mjs`, runs on the criteria judge's report before it is emitted. It finds tests that name a criterion's id in a title or a comment, whatever the id's form. `outerlayer init --update` adds the script to repositories set up earlier.
+
 ## 0.14.0
 
 ### Minor Changes

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-08T21:15:36.925Z+415a9ac","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-09T12:01:54.751Z+00e38ff","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{check-SRGR36KI.js → check-2JSSXCKJ.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-NHDVD7DU.js';
-import './chunk-4OGPT6I2.js';
+import { probeCredentials } from './chunk-NXUH742G.js';
+import './chunk-ASOSIKA4.js';
 import './chunk-O765JR4W.js';
 import './chunk-UGP76IZ5.js';
 import './chunk-3JVYMD4G.js';
@@ -9,24 +9,24 @@ import './chunk-YETTWTAY.js';
 import './chunk-RMWLBUCJ.js';
 import './chunk-I2UOAV7X.js';
 import './chunk-HYZRY4KZ.js';
-import './chunk-FI5UYJMQ.js';
+import './chunk-ADJRGVZC.js';
 import './chunk-KFRM23WD.js';
 import './chunk-MSASO5O4.js';
 import './chunk-HHJDN6AU.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem } from './chunk-SMHOCDCI.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem } from './chunk-F7GBYX2P.js';
 import './chunk-YYYRBYWG.js';
 import './chunk-TI7B7UEO.js';
 import './chunk-TBT347UY.js';
-import './chunk-Q2UK3C4P.js';
-import './chunk-JYIEHQIF.js';
-import './chunk-RBKIH5ST.js';
+import './chunk-HXLMZOKU.js';
+import './chunk-Z3NOIFDR.js';
+import './chunk-UUDDPNRJ.js';
 import './chunk-KMDLFI4P.js';
 import './chunk-QKFB4K7X.js';
 import './chunk-RSNSZ2LJ.js';
 import './chunk-T5VPP6H7.js';
 import './chunk-RLYZLUQ7.js';
 import { parseRunnerEnv } from './chunk-6MZSX4M7.js';
-import './chunk-SWHQ4LUM.js';
+import './chunk-JR6ERP3M.js';
 import './chunk-NPQWKGUA.js';
 import './chunk-IP7BIBXJ.js';
 import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-22RMZBGW.js';

package/dist/{chunk-FI5UYJMQ.js → chunk-ADJRGVZC.js}

@@ -4,6 +4,6 @@ import { createRequire } from 'node:module';
 createRequire(import.meta.url);
 
 // src/runner/protocol.ts
-var RUNNER_PROTOCOL = 16;
+var RUNNER_PROTOCOL = 17;
 
 export { RUNNER_PROTOCOL };

package/dist/{chunk-4OGPT6I2.js → chunk-ASOSIKA4.js}

@@ -4,11 +4,11 @@ import { writeJobFile, readJobFile } from './chunk-RMWLBUCJ.js';
 import { DOCKERD_LOG } from './chunk-HYZRY4KZ.js';
 import { senderPidfile } from './chunk-KFRM23WD.js';
 import { installScrubContext } from './chunk-MSASO5O4.js';
-import { AssetError, describeCallFailure, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, refusalCode, resolveAgentUser, AgentUserError, runBuildSteps, removeStagedContext, stageGovernedContext, shellQuote, createRunnerLog, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, formatDuration, retrySend, formatClock, containerSenderCommand, syncInContainer, copyTranscriptsFromContainer, GH_CONFIG_YML, ghHostsYml, ADDED_USER, isLiteralAddress, signalInContainer, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript } from './chunk-RBKIH5ST.js';
+import { AssetError, describeCallFailure, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, refusalCode, resolveAgentUser, AgentUserError, runBuildSteps, removeStagedContext, stageGovernedContext, shellQuote, createRunnerLog, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, formatDuration, retrySend, formatClock, containerSenderCommand, syncInContainer, copyTranscriptsFromContainer, GH_CONFIG_YML, ghHostsYml, ADDED_USER, isLiteralAddress, signalInContainer, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript } from './chunk-UUDDPNRJ.js';
 import { childEnvironment } from './chunk-KMDLFI4P.js';
 import { waitForAgent, vmExecArgs } from './chunk-QKFB4K7X.js';
 import { socketPathProblem, vsockLinks, linkVsockSockets } from './chunk-RSNSZ2LJ.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-SWHQ4LUM.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-JR6ERP3M.js';
 import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-22RMZBGW.js';
 import { readBranchHead, diffBetween, fetchCommit } from './chunk-R7PF5OOU.js';
 import { isSameProcess, startTimeOf } from './chunk-N5FOE5PS.js';

package/dist/{chunk-SMHOCDCI.js → chunk-F7GBYX2P.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-Q2UK3C4P.js';
-import { describeCallFailure } from './chunk-RBKIH5ST.js';
-import { WorkCommandError, getJson } from './chunk-SWHQ4LUM.js';
+import { isPlaceholderCommand } from './chunk-HXLMZOKU.js';
+import { describeCallFailure } from './chunk-UUDDPNRJ.js';
+import { WorkCommandError, getJson } from './chunk-JR6ERP3M.js';
 import { builtinKind } from './chunk-22RMZBGW.js';
 import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential } from './chunk-4Q7OMKAT.js';
 import { sanitizeTerminal } from './chunk-WUYTWNMA.js';

package/dist/{chunk-Q2UK3C4P.js → chunk-HXLMZOKU.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-JYIEHQIF.js';
-import { MIN_ENGINE_MAJOR } from './chunk-RBKIH5ST.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-Z3NOIFDR.js';
+import { MIN_ENGINE_MAJOR } from './chunk-UUDDPNRJ.js';
 import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-T5VPP6H7.js';
 import { runnerCredentialProblem } from './chunk-22RMZBGW.js';
 import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';

package/dist/{chunk-SWHQ4LUM.js → chunk-JR6ERP3M.js}

@@ -450,6 +450,24 @@ async function runWorkRemove(opts) {
   if (!opts.quiet) process.stdout.write(output + "\n");
   return { data, output };
 }
+function statusOutput(data, json) {
+  if (json) return JSON.stringify(data);
+  const document = JSON.stringify(data, null, 2);
+  const criteria = data.criteria;
+  if (criteria === void 0) return document;
+  if (criteria === null || !Array.isArray(criteria.items)) return `${document}
+
+Criteria: none recorded`;
+  const mark = criteria.drafted === true ? ` ${C.dim}(drafted by the build)${C.reset}` : "";
+  const lines = criteria.items.map((item) => {
+    const proof = typeof item.proof === "string" ? ` ${C.dim}[proof: ${sanitizeTerminal(item.proof)}]${C.reset}` : "";
+    return `  ${sanitizeTerminal(String(item.id))}  ${sanitizeTerminal(String(item.text))}${proof}`;
+  });
+  return `${document}
+
+Criteria${mark}
+${lines.join("\n")}`;
+}
 async function runWorkStatus(opts) {
   const cwd = opts.cwd ?? process.cwd();
   await connectIfOneFits(opts);
@@ -463,7 +481,7 @@ async function runWorkStatus(opts) {
       creds.appId,
       opts.fetchImpl ?? defaultFetch
     );
-    const body = opts.json ? JSON.stringify(data2) : JSON.stringify(data2, null, 2);
+    const body = statusOutput(data2, opts.json === true);
     if (!opts.quiet) process.stdout.write(body + "\n");
     return { data: data2, output: body };
   }
@@ -476,7 +494,7 @@ async function runWorkStatus(opts) {
     throw new WorkCommandError(`no live item for ${repository}#${number}`);
   }
   const { data } = await getJson(creds.url, `/v1/work-items/${item.id}`, creds.apiKey, creds.appId, fetchImpl);
-  const output = opts.json ? JSON.stringify(data) : `${JSON.stringify(data, null, 2)}`;
+  const output = statusOutput(data, opts.json === true);
   if (!opts.quiet) process.stdout.write(output + "\n");
   return { data, output };
 }

package/dist/{chunk-NHDVD7DU.js → chunk-NXUH742G.js}

@@ -1,21 +1,21 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LEASE_SECONDS, releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, ALREADY_RELEASED } from './chunk-4OGPT6I2.js';
+import { LEASE_SECONDS, releaseLease, isUnfinished, setStage, jobEnv, runHook, describeHookEnd, provisionMicroVm, deliverCommitHooks, provisionProcess, provisionEnvironment, readProvisionOut, resolveHostBuild, workdirProblem, listenOnBroker, hostEnvironment, hostCommandEnvironment, execArgv, microVmCommandLine, runCommand, execCommandLine, startSender, startHostServices, finishJob, isGroupAlive, outcomeFromExitCode, isTimedOut, readCpuUsec, isIdle, stopOrphanedMicroVms, unfinishedJobs, listAdoptableJobs, retryFailedReleases, recoverLostJobs, hookLimitsFor, needsRenew, renewLease, RENEW_INTERVAL_SECONDS, ALREADY_RELEASED } from './chunk-ASOSIKA4.js';
 import { writePendingUpdate } from './chunk-O765JR4W.js';
 import { readHousekeepingRecord, writeHousekeepingRecord } from './chunk-UGP76IZ5.js';
 import { decideInstalledSwitch } from './chunk-3JVYMD4G.js';
 import { fetchVersionMeta, npmVersion, npmSupportsProvenance, fetchTarballDigest, fetchProvenance, installVersion, auditSignatures } from './chunk-YETTWTAY.js';
 import { writeJobFile, readJobFile, readJobFileChecked } from './chunk-RMWLBUCJ.js';
 import { compareVersions, satisfiesRange } from './chunk-I2UOAV7X.js';
-import { RUNNER_PROTOCOL } from './chunk-FI5UYJMQ.js';
-import { placeholderQueues, placeholderProblem } from './chunk-SMHOCDCI.js';
+import { RUNNER_PROTOCOL } from './chunk-ADJRGVZC.js';
+import { placeholderQueues, placeholderProblem } from './chunk-F7GBYX2P.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import { writeMarker, readMarker, currentVersion, removeMarker, entryIn, versionDir, startedThroughCurrent, switchCurrent, cleanVersions, isInLayout, stagingDir } from './chunk-TI7B7UEO.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, BuildTokens, classifyRefusal, refusalCode, measureDisk, createRunnerLog, setUpRunnerCgroup, parseCpuList, ensureTunnel, keepGhConfigCurrent, createContainerRuntime, formatClock } from './chunk-RBKIH5ST.js';
+import { describeCallFailure, retrySend, shortClaim, relativeToRunner, formatDuration, provisionContainer, lifecycleSteps, lifecycleFailureReason, prepareBranch, containerCommandLine, BuildTokens, classifyRefusal, refusalCode, measureDisk, createRunnerLog, setUpRunnerCgroup, parseCpuList, ensureTunnel, keepGhConfigCurrent, createContainerRuntime, formatClock } from './chunk-UUDDPNRJ.js';
 import { spawnRun } from './chunk-KMDLFI4P.js';
 import { checkFit } from './chunk-RLYZLUQ7.js';
-import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-SWHQ4LUM.js';
+import { isSignatureRefusal, WorkCommandError, getJson, postJson } from './chunk-JR6ERP3M.js';
 import { isBuiltinContainer, isBuiltinVm, isBuiltinProcess, loadRunnerConfig, checkHooks, builtinKind, DEFAULT_UPDATE_MAX_WAIT_HOURS } from './chunk-22RMZBGW.js';
 import { startTimeOf, claimPidFile, readPidFile, isSameProcess, releasePidFile } from './chunk-N5FOE5PS.js';
 import { builderName, runnerLabelValue, ensureFailureCount, builderSpec, ensureBuilder, BUILD_LABEL, RUNNER_LABEL } from './chunk-4NPZVMJU.js';
@@ -958,9 +958,9 @@ function considerNamedVersion(state, named) {
     logOf(state).line(`this runner cannot update itself to ${named}: ${blocker}`);
   }
 }
-function adoptUpdateWait(state, version) {
+function adoptUpdateWait(state, version, nowMs) {
   const previous = state.updateWait;
-  const wait = { version, sinceMs: previous?.sinceMs ?? nowOf(state).getTime(), holdSinceMs: previous?.holdSinceMs };
+  const wait = { version, sinceMs: previous?.sinceMs ?? nowMs, holdSinceMs: previous?.holdSinceMs };
   state.updateWait = wait;
   return wait;
 }
@@ -1012,7 +1012,7 @@ function runningItems(state) {
 function holdForUpdate(state, version, mayHold = true) {
   const log = logOf(state);
   const nowMs = nowOf(state).getTime();
-  const wait = adoptUpdateWait(state, version);
+  const wait = adoptUpdateWait(state, version, nowMs);
   const failed2 = readLastUpdate(state.config.configPath);
   const failedAtMs = failed2?.to === version && failed2.outcome === "retrying" ? new Date(failed2.at ?? Number.NaN).getTime() : Number.NaN;
   if (failedAtMs < wait.sinceMs) wait.sinceMs = failedAtMs;
@@ -1315,7 +1315,7 @@ var CLAIM_REFUSAL_CODES = new Set(
   "pull_request_from_fork pull_request_on_default_branch pull_request_ambiguous pull_request_repository_not_connected branch_claimed_elsewhere".split(" ")
 );
 async function tryClaimAndStart(state, item, queue) {
-  const { postJson: postJson2 } = await import('./work-cmd-RVRQ32EH.js');
+  const { postJson: postJson2 } = await import('./work-cmd-EQSW5DTD.js');
   const log = logOf(state);
   const hostKey = await loadHostKey(state.config.configPath);
   const claim = await retrySend(
@@ -2072,7 +2072,7 @@ async function start(configPath, deps = { fetchImpl: fetch }) {
     const outcome = await onStartUnderMarker({
       configPath,
       own: ownVersionOf(deps),
-      check: update.check ? () => update.check(configPath) : async () => (await import('./check-SRGR36KI.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
+      check: update.check ? () => update.check(configPath) : async () => (await import('./check-2JSSXCKJ.js')).runRunnerCheck(configPath, { fetchImpl: deps.fetchImpl }),
       now: () => (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime(),
       log
     });

package/dist/{chunk-HFKQIZXL.js → chunk-QLTYTPYU.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { checkStarterFiles } from './chunk-MTF3PHVZ.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-SWHQ4LUM.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-JR6ERP3M.js';
 import { readStatuslineState, STATE_FRESH_MS } from './chunk-F47JBIAW.js';
 import { isLinkedRepository } from './chunk-YDSMROTB.js';
 import { sanitizeTerminal } from './chunk-WUYTWNMA.js';
@@ -1095,7 +1095,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-H7REBSLQ.js');
+    const { runnerHostChecks } = await import('./doctor-CORFPYY6.js');
     const hooks = (() => {
       try {
         return loadRunnerConfig(configPath).hooks;

package/dist/{chunk-RBKIH5ST.js → chunk-UUDDPNRJ.js}

@@ -3,7 +3,7 @@ import { createRequire } from 'node:module';
 import { createDockerHost, childEnvironment, spawnRun } from './chunk-KMDLFI4P.js';
 import { execCapture } from './chunk-QKFB4K7X.js';
 import { GUEST_CID } from './chunk-RSNSZ2LJ.js';
-import { WorkCommandError, postJson } from './chunk-SWHQ4LUM.js';
+import { WorkCommandError, postJson } from './chunk-JR6ERP3M.js';
 import { hostAllowed } from './chunk-UXYLWVTQ.js';
 import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-R7PF5OOU.js';
 import { RecipeError } from './chunk-QOZKPLVJ.js';

package/dist/{chunk-JYIEHQIF.js → chunk-Z3NOIFDR.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-RBKIH5ST.js';
+import { MIN_ENGINE_MAJOR } from './chunk-UUDDPNRJ.js';
 import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-CX22S5BA.js';
 import { spawnSync } from 'child_process';
 import { existsSync, accessSync, constants, statSync, readFileSync } from 'fs';

package/dist/{cli-UW2H3UUW.js → cli-RGGXQTWI.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-HFKQIZXL.js';
+import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-QLTYTPYU.js';
 import './chunk-MTF3PHVZ.js';
-import './chunk-SWHQ4LUM.js';
+import './chunk-JR6ERP3M.js';
 import './chunk-NPQWKGUA.js';
 import './chunk-IP7BIBXJ.js';
 import './chunk-F47JBIAW.js';
@@ -3872,7 +3872,7 @@ function buildProgram(argv = process.argv) {
       else process.stdout.write(outcome.text);
       return;
     }
-    const { runInitCommand } = await import('./init-cmd-NARDUPIG.js');
+    const { runInitCommand } = await import('./init-cmd-JR3RKNFB.js');
     const code = await runInitCommand(
       { json: opts.json, factory: opts.factory },
       {
@@ -4289,7 +4289,7 @@ function registerWorkCommands(program2) {
     "\n  outerlayer work build --issue 42                       # a host builds it\n  outerlayer work build --item 7                         # retry an item already on Work\n  outerlayer work build --issue 42 --local               # you build it\n  outerlayer work build --issue ENG-123 --tracker linear # a Linear issue\n\nWithout --local, records a build request: a host takes the item when it\nhas a free slot. It never links the calling session and never takes a\nlease, even run from inside one.\n\nWith --local, puts the item on Work with no build request, so no host\ntakes it, and prints the line that starts your session on it. That\nsession links itself and holds the item's lease while it works.\n"
   ).action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkBuild, WorkCommandError } = await import('./work-cmd-RVRQ32EH.js');
+    const { runWorkBuild, WorkCommandError } = await import('./work-cmd-EQSW5DTD.js');
     try {
       await runWorkBuild(opts);
     } catch (err) {
@@ -4305,7 +4305,7 @@ function registerWorkCommands(program2) {
     "\n  outerlayer work link-session 42\n\nNames an item that already exists on the calling session \u2014 it never\ncreates one. Create one with `outerlayer work build --local`. Linking\nthe same session to the same item twice is a no-op. Also takes or\nrenews that session's own 20-minute lease, unless --no-lease or\n--ended is given, or another worker already holds a live one.\n"
   ).action(async (number, opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkLinkSession, WorkCommandError } = await import('./work-cmd-RVRQ32EH.js');
+    const { runWorkLinkSession, WorkCommandError } = await import('./work-cmd-EQSW5DTD.js');
     try {
       await runWorkLinkSession({ ...opts, number, noLease: opts.lease === false, logFailures: opts.logFailures === true });
     } catch (err) {
@@ -4330,8 +4330,8 @@ most one action flag may be given.
 `
   ).action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkComment, WorkCommentCommandError } = await import('./work-comment-cmd-FFUM4TJU.js');
-    const { WorkCommandError } = await import('./work-cmd-RVRQ32EH.js');
+    const { runWorkComment, WorkCommentCommandError } = await import('./work-comment-cmd-7VLKI7FN.js');
+    const { WorkCommandError } = await import('./work-cmd-EQSW5DTD.js');
     try {
       await runWorkComment(opts);
     } catch (err) {
@@ -4347,8 +4347,8 @@ most one action flag may be given.
     "\n  outerlayer work threads --item 7\n\nPrints the item's general thread, then one thread per acceptance\ncriterion that carries proof or a comment, each with who is waiting\non whom next.\n"
   ).action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkThreads, WorkCommentCommandError } = await import('./work-comment-cmd-FFUM4TJU.js');
-    const { WorkCommandError } = await import('./work-cmd-RVRQ32EH.js');
+    const { runWorkThreads, WorkCommentCommandError } = await import('./work-comment-cmd-7VLKI7FN.js');
+    const { WorkCommandError } = await import('./work-cmd-EQSW5DTD.js');
     try {
       await runWorkThreads(opts);
     } catch (err) {
@@ -4370,7 +4370,7 @@ live addition remains on it.
 `
   ).action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkRemove, WorkCommandError } = await import('./work-cmd-RVRQ32EH.js');
+    const { runWorkRemove, WorkCommandError } = await import('./work-cmd-EQSW5DTD.js');
     try {
       await runWorkRemove(opts);
     } catch (err) {
@@ -4383,7 +4383,7 @@ live addition remains on it.
   });
   workCmd.command("status").description("Show one item's stage, gate ledger, and additions").option("--item <number>", "the item's number inside this factory").option("--issue <number>", "issue number").option("--repo <owner/name>", "repository (default: the current checkout's remote)").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkStatus, WorkCommandError } = await import('./work-cmd-RVRQ32EH.js');
+    const { runWorkStatus, WorkCommandError } = await import('./work-cmd-EQSW5DTD.js');
     try {
       await runWorkStatus(opts);
     } catch (err) {
@@ -4396,7 +4396,7 @@ live addition remains on it.
   });
   workCmd.command("list").description("List live work items for this factory").option("--stage <spec|build|review>", "filter by stage").option("--section <attention|waiting|flowing>", "filter by Queue section").option("--repo <owner/name>", "repository (default: the current checkout's remote)").option("--unclaimed", "only items with no live lease").option("--claimed", "only items with a live lease, held by a host or a local session").option("--startable", "only items a host can start: a build request, no open PR, no live lease").option("--needs <amend>", "only items with a thread waiting on an agent").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkList, WorkCommandError } = await import('./work-cmd-RVRQ32EH.js');
+    const { runWorkList, WorkCommandError } = await import('./work-cmd-EQSW5DTD.js');
     try {
       await runWorkList(opts);
     } catch (err) {
@@ -4412,7 +4412,7 @@ live addition remains on it.
     "\n  outerlayer work claim --item 42 --kind implement\n\nRecords a lease held by the API key that sends it. A live lease held\nby a different key is refused; claiming again with the same key extends\nit. --host is a label only.\n"
   ).action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkClaim, WorkCommandError } = await import('./work-claim-cmd-LY4U6QHN.js');
+    const { runWorkClaim, WorkCommandError } = await import('./work-claim-cmd-A6IS6CQ7.js');
     try {
       await runWorkClaim(opts);
     } catch (err) {
@@ -4428,7 +4428,7 @@ live addition remains on it.
     "\n  outerlayer work renew --item 42\n\nExtends the live lease this API key holds. Refused with a 410 if the\nlease has expired, or a 403 if a different key holds it.\n"
   ).action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkRenew, WorkCommandError } = await import('./work-claim-cmd-LY4U6QHN.js');
+    const { runWorkRenew, WorkCommandError } = await import('./work-claim-cmd-A6IS6CQ7.js');
     try {
       await runWorkRenew(opts);
     } catch (err) {
@@ -4447,7 +4447,7 @@ live addition remains on it.
     "\n  outerlayer work release --item 42 --outcome ok\n  outerlayer work release --item 42\n\nMarks the lease this API key holds released, optionally with an\noutcome. A lease held by a different key is refused. Releasing an\nalready-released lease is a no-op that returns the recorded release\ntime and outcome.\n\nRun inside a session with no --host, it releases that session's own\nlease instead, so the item's review opens without ending the\nsession. It never releases another session's lease. --outcome\napplies to a host's lease only. A later tool call in the session\ntakes the lease again.\n"
   ).action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkRelease, WorkCommandError } = await import('./work-claim-cmd-LY4U6QHN.js');
+    const { runWorkRelease, WorkCommandError } = await import('./work-claim-cmd-A6IS6CQ7.js');
     try {
       await runWorkRelease(opts);
     } catch (err) {
@@ -4479,8 +4479,8 @@ live addition remains on it.
     '\n  outerlayer work open-pr --title "Add the thing" --body-file pr.md\n  outerlayer work open-pr --repository acme/web --title "Add the thing" --body-file pr.md\n\nIn a host build, which holds an item key, the gateway opens the pull\nrequest as the factory\'s GitHub App, from the branch the claim named,\nor edits the one already open on that branch. No gh command runs.\nIn your own session it runs `gh pr create` (or `gh pr edit`) under your\nlogin, then declares the pull request on the item, as `work pr` does.\nRun it again after a change to the title or description.\n'
   ).action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkOpenPr, WorkOpenPrCommandError } = await import('./work-open-pr-cmd-HLDWP4T2.js');
-    const { WorkCommandError } = await import('./work-cmd-RVRQ32EH.js');
+    const { runWorkOpenPr, WorkOpenPrCommandError } = await import('./work-open-pr-cmd-JEVD4HMQ.js');
+    const { WorkCommandError } = await import('./work-cmd-EQSW5DTD.js');
     try {
       await runWorkOpenPr(opts);
     } catch (err) {
@@ -4497,7 +4497,7 @@ function registerRunnerCommands(program2) {
   const configOption = "the cloud config file to run against (default: ~/.outerlayer/config.json)";
   runnerCmd.command("start").description("Run the loop: claim work, run it, report, clean up, repeat").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-N3C6DFQA.js');
-    const { start, RunnerStartError } = await import('./loop-SW2M5VDD.js');
+    const { start, RunnerStartError } = await import('./loop-QNSM5GXS.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-UZRH774M.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     try {
@@ -4513,7 +4513,7 @@ function registerRunnerCommands(program2) {
   });
   runnerCmd.command("check").description("Validate the config, the hooks and the key, and print the effective settings").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-N3C6DFQA.js');
-    const { runRunnerCheck } = await import('./check-SRGR36KI.js');
+    const { runRunnerCheck } = await import('./check-2JSSXCKJ.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const result = await runRunnerCheck(configPath);
     if (!result.ok) {
@@ -4542,7 +4542,7 @@ function registerRunnerCommands(program2) {
     }
     try {
       if (opts.service === true) {
-        const { installServiceCommand } = await import('./command-5LD7G2QQ.js');
+        const { installServiceCommand } = await import('./command-ETUAEXP2.js');
         const result2 = await installServiceCommand({
           configPath,
           print: opts.print,
@@ -4598,7 +4598,7 @@ To keep it running, run ${C.yellow}outerlayer runner install --service${C.reset}
       return;
     }
     const { defaultRunnerConfigPath } = await import('./config-N3C6DFQA.js');
-    const { uninstallServiceCommand } = await import('./command-5LD7G2QQ.js');
+    const { uninstallServiceCommand } = await import('./command-ETUAEXP2.js');
     const result = await uninstallServiceCommand({ configPath: opts.config ?? defaultRunnerConfigPath(), unitName: opts.unitName, home: homeFromEnv() });
     if (result.ok) for (const line of result.lines) process.stdout.write(`${C.green}\u2713${C.reset} ${line}
 `);
@@ -4609,10 +4609,10 @@ To keep it running, run ${C.yellow}outerlayer runner install --service${C.reset}
     "\nWith no apiKey in the config file, and a login saved by `outerlayer login`,\nrunner init creates the runner key itself, with the Runner preset, on the\nfactory --app-id names (or OUTERLAYER_APP_ID, or this repository's\nconnection). Your login needs factory_keys.insert on that factory.\n\nWith --agent claude, the queue commands start Claude Code instead of the\nplaceholder, and Claude's credential is read from stdin: a token from\n`claude setup-token` (sk-ant-oat...) or an API key (sk-ant-api...). It is\nnever printed, and is stored in the runner.env beside the config with mode\n600. Other lines in the file are kept. With nothing piped, a credential\nalready in runner.env is used.\n\n  printf '%s' \"$CLAUDE_CODE_OAUTH_TOKEN\" | outerlayer runner init --agent claude\n"
   ).action(async (opts) => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-N3C6DFQA.js');
-    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-NTXA3SN7.js');
-    const { createRunnerKey, runnerKeyLogin } = await import('./runner-key-3JSMDRJA.js');
-    const { detectMachine } = await import('./machine-U66FKVDP.js');
-    const { chooseVm, runVmInit, VmInitError } = await import('./init-UBXK6MF7.js');
+    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-OPB7HHXO.js');
+    const { createRunnerKey, runnerKeyLogin } = await import('./runner-key-7SSNMUBQ.js');
+    const { detectMachine } = await import('./machine-IT6GG7FF.js');
+    const { chooseVm, runVmInit, VmInitError } = await import('./init-MIC37V6J.js');
     const { AGENT_COMMANDS, credentialFromStdin, isAgentName, restartForCredential, RunnerEnvError } = await import('./runner-env-XTC53CHN.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     if (opts.agent !== void 0 && !isAgentName(opts.agent)) {
@@ -4762,7 +4762,7 @@ ${C.yellow}The runner will not update itself: ${installErr.message}${C.reset}
       let serviceUp = false;
       let restart;
       if (installedLayout) {
-        const { installServiceCommand } = await import('./command-5LD7G2QQ.js');
+        const { installServiceCommand } = await import('./command-ETUAEXP2.js');
         const service = await installServiceCommand({
           configPath,
           entryPath: process.argv[1] ?? "",
@@ -4873,15 +4873,15 @@ Next:
   });
   runnerCmd.command("stop").description("Take no more work; wait for running jobs to finish, then exit").option("--config <path>", "the cloud config file naming the runner to stop").option("--now", "end running jobs immediately, with outcome stopped").action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-N3C6DFQA.js');
-    const { requestStop } = await import('./loop-SW2M5VDD.js');
+    const { requestStop } = await import('./loop-QNSM5GXS.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     await requestStop(configPath, Boolean(opts.now));
   });
   runnerCmd.command("status").description("List running jobs; with --recent, finished ones too").option("--config <path>", "the cloud config file naming the runner to inspect").option("--recent", "also list finished jobs, newest first, capped at 20").option("--json", "machine-readable JSON output").action(async (opts) => {
     const { defaultRunnerConfigPath, loadRunnerConfig } = await import('./config-N3C6DFQA.js');
     const { jobsDir, runnerDir } = await import('./paths-OYKMVYJP.js');
-    const { listJobFiles, runnerProcessState } = await import('./loop-SW2M5VDD.js');
-    const { renderStatus } = await import('./status-STZYPU3W.js');
+    const { listJobFiles, runnerProcessState } = await import('./loop-QNSM5GXS.js');
+    const { renderStatus } = await import('./status-7ZX57OFJ.js');
     const { readHousekeepingRecord } = await import('./record-C43U4PKS.js');
     const path2 = await import('path');
     const configPath = opts.config ?? defaultRunnerConfigPath();
@@ -4937,7 +4937,7 @@ Next:
   });
   runnerCmd.command("logs").argument("<item>", "the work item's number in the factory").description("Print the newest attempt's log for one item").option("--config <path>", "the cloud config file naming the runner to inspect").option("-f, --follow", "keep printing as the log grows").action(async (itemArg, opts) => {
     const { defaultRunnerConfigPath } = await import('./config-N3C6DFQA.js');
-    const { listJobFiles } = await import('./loop-SW2M5VDD.js');
+    const { listJobFiles } = await import('./loop-QNSM5GXS.js');
     const { newestAttempt, logPathFor, tail, RunnerLogsError } = await import('./logs-H55NWW4H.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const item = parseTrackerNumber(itemArg);

package/dist/{command-5LD7G2QQ.js → command-ETUAEXP2.js}

@@ -5,13 +5,13 @@ import { runRunnerInstall, launcherSummary, restartNote } from './chunk-ERI5GBNI
 import './chunk-I2UOAV7X.js';
 import './chunk-PTW6W5NR.js';
 import { currentLink, execStartCommand } from './chunk-TI7B7UEO.js';
-import { detectMachine } from './chunk-JYIEHQIF.js';
-import './chunk-RBKIH5ST.js';
+import { detectMachine } from './chunk-Z3NOIFDR.js';
+import './chunk-UUDDPNRJ.js';
 import './chunk-KMDLFI4P.js';
 import './chunk-QKFB4K7X.js';
 import './chunk-RSNSZ2LJ.js';
 import { installService, uninstallService, realTaskScheduler } from './chunk-RLYZLUQ7.js';
-import './chunk-SWHQ4LUM.js';
+import './chunk-JR6ERP3M.js';
 import './chunk-NPQWKGUA.js';
 import './chunk-IP7BIBXJ.js';
 import { runnerVmOf, loadRunnerConfig } from './chunk-22RMZBGW.js';

package/dist/{doctor-H7REBSLQ.js → doctor-CORFPYY6.js}

@@ -1,20 +1,20 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { needsClaudeCredential, claudeCredentialCheck, missingPermissionOf, missingPermissionFix } from './chunk-SMHOCDCI.js';
+import { needsClaudeCredential, claudeCredentialCheck, missingPermissionOf, missingPermissionFix } from './chunk-F7GBYX2P.js';
 import { freeBytes, formatBytes } from './chunk-YYYRBYWG.js';
 import { launcherCheck } from './chunk-PTW6W5NR.js';
 import './chunk-TI7B7UEO.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
-import './chunk-Q2UK3C4P.js';
-import { detectMachine, supportsContainerBuilds, describeMachineDocker, reachDockerStep, supportsMicroVmBuilds, microVmArchSupported, microVmAssetsPinned } from './chunk-JYIEHQIF.js';
-import { MIN_ENGINE_MAJOR } from './chunk-RBKIH5ST.js';
+import './chunk-HXLMZOKU.js';
+import { detectMachine, supportsContainerBuilds, describeMachineDocker, reachDockerStep, supportsMicroVmBuilds, microVmArchSupported, microVmAssetsPinned } from './chunk-Z3NOIFDR.js';
+import { MIN_ENGINE_MAJOR } from './chunk-UUDDPNRJ.js';
 import { resolveDevcontainerCli, spawnRun } from './chunk-KMDLFI4P.js';
 import './chunk-QKFB4K7X.js';
 import './chunk-RSNSZ2LJ.js';
 import './chunk-T5VPP6H7.js';
 import './chunk-RLYZLUQ7.js';
 import './chunk-6MZSX4M7.js';
-import { getJson, WorkCommandError, signatureRefusalMessage } from './chunk-SWHQ4LUM.js';
+import { getJson, WorkCommandError, signatureRefusalMessage } from './chunk-JR6ERP3M.js';
 import './chunk-NPQWKGUA.js';
 import './chunk-IP7BIBXJ.js';
 import { builtinKind } from './chunk-22RMZBGW.js';

package/dist/index.js

@@ -22,5 +22,5 @@ if (argv[0] === "statusline") {
   process.exit(0);
 }
 (await import('./hook-fast-WYQD6D7T.js')).recordLinkExitFailure(argv);
-var { runCli } = await import('./cli-UW2H3UUW.js');
+var { runCli } = await import('./cli-RGGXQTWI.js');
 await runCli(process.argv);

package/dist/{init-UBXK6MF7.js → init-MIC37V6J.js}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { npmSupportsProvenance } from './chunk-YETTWTAY.js';
-import { RunnerInitError, readConfigObject } from './chunk-Q2UK3C4P.js';
-import './chunk-JYIEHQIF.js';
-import './chunk-RBKIH5ST.js';
+import { RunnerInitError, readConfigObject } from './chunk-HXLMZOKU.js';
+import './chunk-Z3NOIFDR.js';
+import './chunk-UUDDPNRJ.js';
 import './chunk-KMDLFI4P.js';
 import './chunk-QKFB4K7X.js';
 import './chunk-RSNSZ2LJ.js';
 import './chunk-T5VPP6H7.js';
 import { checkFit, VM_SERVICE_NAME, RUNNER_RESERVE_BYTES } from './chunk-RLYZLUQ7.js';
 import './chunk-6MZSX4M7.js';
-import './chunk-SWHQ4LUM.js';
+import './chunk-JR6ERP3M.js';
 import './chunk-NPQWKGUA.js';
 import './chunk-IP7BIBXJ.js';
 import { runnerCredentialProblem, resolveBuild, resolveHousekeeping } from './chunk-22RMZBGW.js';

package/dist/{init-NTXA3SN7.js → init-OPB7HHXO.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { PLACEHOLDER_MARKER, RunnerInitError, isPlaceholderCommand, prepareRunnerInit, readConfigObject, runRunnerInit, writeRunnerInit } from './chunk-Q2UK3C4P.js';
-import './chunk-JYIEHQIF.js';
-import './chunk-RBKIH5ST.js';
+export { PLACEHOLDER_MARKER, RunnerInitError, isPlaceholderCommand, prepareRunnerInit, readConfigObject, runRunnerInit, writeRunnerInit } from './chunk-HXLMZOKU.js';
+import './chunk-Z3NOIFDR.js';
+import './chunk-UUDDPNRJ.js';
 import './chunk-KMDLFI4P.js';
 import './chunk-QKFB4K7X.js';
 import './chunk-RSNSZ2LJ.js';
 import './chunk-T5VPP6H7.js';
 import './chunk-RLYZLUQ7.js';
 import './chunk-6MZSX4M7.js';
-import './chunk-SWHQ4LUM.js';
+import './chunk-JR6ERP3M.js';
 import './chunk-NPQWKGUA.js';
 import './chunk-IP7BIBXJ.js';
 import './chunk-22RMZBGW.js';

package/dist/{init-cmd-NARDUPIG.js → init-cmd-JR3RKNFB.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { summarizeChecks, summaryText, renderDoctorText } from './chunk-HFKQIZXL.js';
+import { summarizeChecks, summaryText, renderDoctorText } from './chunk-QLTYTPYU.js';
 import './chunk-MTF3PHVZ.js';
-import './chunk-SWHQ4LUM.js';
+import './chunk-JR6ERP3M.js';
 import './chunk-NPQWKGUA.js';
 import './chunk-IP7BIBXJ.js';
 import './chunk-F47JBIAW.js';

package/dist/{loop-SW2M5VDD.js → loop-QNSM5GXS.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { RunnerStartError, listJobFiles, probeCredentials, requestStop, runnerProcessState, start, tick, watchTick } from './chunk-NHDVD7DU.js';
-import './chunk-4OGPT6I2.js';
+export { RunnerStartError, listJobFiles, probeCredentials, requestStop, runnerProcessState, start, tick, watchTick } from './chunk-NXUH742G.js';
+import './chunk-ASOSIKA4.js';
 import './chunk-O765JR4W.js';
 import './chunk-UGP76IZ5.js';
 import './chunk-3JVYMD4G.js';
@@ -9,24 +9,24 @@ import './chunk-YETTWTAY.js';
 import './chunk-RMWLBUCJ.js';
 import './chunk-I2UOAV7X.js';
 import './chunk-HYZRY4KZ.js';
-import './chunk-FI5UYJMQ.js';
+import './chunk-ADJRGVZC.js';
 import './chunk-KFRM23WD.js';
 import './chunk-MSASO5O4.js';
 import './chunk-HHJDN6AU.js';
-import './chunk-SMHOCDCI.js';
+import './chunk-F7GBYX2P.js';
 import './chunk-YYYRBYWG.js';
 import './chunk-TI7B7UEO.js';
 import './chunk-TBT347UY.js';
-import './chunk-Q2UK3C4P.js';
-import './chunk-JYIEHQIF.js';
-import './chunk-RBKIH5ST.js';
+import './chunk-HXLMZOKU.js';
+import './chunk-Z3NOIFDR.js';
+import './chunk-UUDDPNRJ.js';
 import './chunk-KMDLFI4P.js';
 import './chunk-QKFB4K7X.js';
 import './chunk-RSNSZ2LJ.js';
 import './chunk-T5VPP6H7.js';
 import './chunk-RLYZLUQ7.js';
 import './chunk-6MZSX4M7.js';
-import './chunk-SWHQ4LUM.js';
+import './chunk-JR6ERP3M.js';
 import './chunk-NPQWKGUA.js';
 import './chunk-IP7BIBXJ.js';
 import './chunk-22RMZBGW.js';

package/dist/{machine-U66FKVDP.js → machine-IT6GG7FF.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { describeMachineDocker, detectMachine, microVmArchSupported, microVmAssetsPinned, reachDockerStep, supportsContainerBuilds, supportsMicroVmBuilds } from './chunk-JYIEHQIF.js';
-import './chunk-RBKIH5ST.js';
+export { describeMachineDocker, detectMachine, microVmArchSupported, microVmAssetsPinned, reachDockerStep, supportsContainerBuilds, supportsMicroVmBuilds } from './chunk-Z3NOIFDR.js';
+import './chunk-UUDDPNRJ.js';
 import './chunk-KMDLFI4P.js';
 import './chunk-QKFB4K7X.js';
 import './chunk-RSNSZ2LJ.js';
-import './chunk-SWHQ4LUM.js';
+import './chunk-JR6ERP3M.js';
 import './chunk-NPQWKGUA.js';
 import './chunk-IP7BIBXJ.js';
 import './chunk-UXYLWVTQ.js';

package/dist/{runner-key-3JSMDRJA.js → runner-key-7SSNMUBQ.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { readConfigObject, RunnerInitError } from './chunk-Q2UK3C4P.js';
-import './chunk-JYIEHQIF.js';
-import './chunk-RBKIH5ST.js';
+import { readConfigObject, RunnerInitError } from './chunk-HXLMZOKU.js';
+import './chunk-Z3NOIFDR.js';
+import './chunk-UUDDPNRJ.js';
 import './chunk-KMDLFI4P.js';
 import './chunk-QKFB4K7X.js';
 import './chunk-RSNSZ2LJ.js';
 import './chunk-T5VPP6H7.js';
 import './chunk-RLYZLUQ7.js';
 import './chunk-6MZSX4M7.js';
-import { postJson, WorkCommandError, getJson } from './chunk-SWHQ4LUM.js';
+import { postJson, WorkCommandError, getJson } from './chunk-JR6ERP3M.js';
 import './chunk-NPQWKGUA.js';
 import './chunk-IP7BIBXJ.js';
 import { runnerCredentialProblem } from './chunk-22RMZBGW.js';

package/dist/{status-STZYPU3W.js → status-7ZX57OFJ.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LEASE_SECONDS, ALREADY_RELEASED, RENEW_INTERVAL_SECONDS } from './chunk-4OGPT6I2.js';
+import { LEASE_SECONDS, ALREADY_RELEASED, RENEW_INTERVAL_SECONDS } from './chunk-ASOSIKA4.js';
 import './chunk-RMWLBUCJ.js';
 import './chunk-HYZRY4KZ.js';
 import './chunk-KFRM23WD.js';
@@ -8,11 +8,11 @@ import './chunk-MSASO5O4.js';
 import './chunk-HHJDN6AU.js';
 import { formatBytes } from './chunk-YYYRBYWG.js';
 import './chunk-TBT347UY.js';
-import { formatDuration, formatClock, relativeToRunner } from './chunk-RBKIH5ST.js';
+import { formatDuration, formatClock, relativeToRunner } from './chunk-UUDDPNRJ.js';
 import './chunk-KMDLFI4P.js';
 import './chunk-QKFB4K7X.js';
 import './chunk-RSNSZ2LJ.js';
-import './chunk-SWHQ4LUM.js';
+import './chunk-JR6ERP3M.js';
 import './chunk-NPQWKGUA.js';
 import './chunk-IP7BIBXJ.js';
 import './chunk-22RMZBGW.js';

package/dist/{work-claim-cmd-LY4U6QHN.js → work-claim-cmd-A6IS6CQ7.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_PROTOCOL } from './chunk-FI5UYJMQ.js';
-import { resolveCredentials, WorkCommandError, parsePositiveInt, postJson, environmentFacts, resolveRepository, findLiveItem } from './chunk-SWHQ4LUM.js';
-export { WorkCommandError } from './chunk-SWHQ4LUM.js';
+import { RUNNER_PROTOCOL } from './chunk-ADJRGVZC.js';
+import { resolveCredentials, WorkCommandError, parsePositiveInt, postJson, environmentFacts, resolveRepository, findLiveItem } from './chunk-JR6ERP3M.js';
+export { WorkCommandError } from './chunk-JR6ERP3M.js';
 import './chunk-NPQWKGUA.js';
 import './chunk-IP7BIBXJ.js';
 import { defaultRunnerConfigPath } from './chunk-22RMZBGW.js';

package/dist/{work-cmd-RVRQ32EH.js → work-cmd-EQSW5DTD.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { WorkCommandError, environmentFacts, findLiveItem, getJson, parsePositiveInt, postJson, resolveCredentials, resolveRepository, runWorkBuild, runWorkLinkSession, runWorkList, runWorkRemove, runWorkStatus } from './chunk-SWHQ4LUM.js';
+export { WorkCommandError, environmentFacts, findLiveItem, getJson, parsePositiveInt, postJson, resolveCredentials, resolveRepository, runWorkBuild, runWorkLinkSession, runWorkList, runWorkRemove, runWorkStatus } from './chunk-JR6ERP3M.js';
 import './chunk-NPQWKGUA.js';
 import './chunk-IP7BIBXJ.js';
 import './chunk-YDSMROTB.js';

package/dist/{work-comment-cmd-FFUM4TJU.js → work-comment-cmd-7VLKI7FN.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { resolveCredentials, postJson, getJson } from './chunk-SWHQ4LUM.js';
+import { resolveCredentials, postJson, getJson } from './chunk-JR6ERP3M.js';
 import './chunk-NPQWKGUA.js';
 import { detectActiveSession } from './chunk-IP7BIBXJ.js';
 import './chunk-YDSMROTB.js';

package/dist/{work-open-pr-cmd-HLDWP4T2.js → work-open-pr-cmd-JEVD4HMQ.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { itemLabel, runWorkPr, WorkPrCommandError } from './chunk-JJEGKEFV.js';
-import { resolveCredentials } from './chunk-SWHQ4LUM.js';
+import { resolveCredentials } from './chunk-JR6ERP3M.js';
 import './chunk-NPQWKGUA.js';
 import './chunk-IP7BIBXJ.js';
 import './chunk-YDSMROTB.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@outerlayer/cli",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "OuterLayer CLI — commands: init, connect, doctor, login, logout, sync, daemon (alias: watch), emit, work, runner, hooks, mcp, import, context. Capture and sync coding-agent sessions, and record proof of factory work.",
   "license": "Apache-2.0",
   "author": "Magu Studios, Inc.",

package/skill-pack/shipped.json

@@ -9,6 +9,7 @@
       "5cf9bd75fb1f984f6e6b470d1f1581dc06168abf062448e6f43711fed8f6632a",
       "6177ea457be0d238659640e6d29807708d60d68533ae3ff93af10fb513139ced",
       "77cab8b446fb1aa865710f7cb8356c5334301a942f58f9243766bf1acf1377ad",
+      "93953397c31d47a6f1c06edb8ae2190e1d8a3fca20c616deb33991311cee39a8",
       "a6743050c5c387e962ad4264526d9a3c10edf36823e4b6829f200bf79a4e45e7",
       "b0aa9b6962675f772b67a4390c15b6b0100390983d958c656a826a066399f3d0",
       "f4e1661c6f87d7ff6d23c6182530fa0a9cb87c4dc3f31e48f2be11f32ebb2c00"
@@ -27,6 +28,7 @@
     ".outerlayer/skills/build/references/release.md": [
       "0b0af40c82473cf192f697537ed5a84801a14e79bb11790d72226d7f7f49cca0",
       "1113259bdf7d8c28edcbdb9b4c83c2f2bd4c5eaf817cf30bf428478ff91694e9",
+      "1f4fe97ca8f11d6681db5734f3103af5ea175a9472ff1d38b10cb463f4956a6a",
       "4687f56bcec766f1926d58a208418f800a1727c073b5e6047b40e3aaac2bd6c9",
       "81a764eb317fcb4672bedd35e7b9aa68d1c0b73f82fc2dfa03e5a78758db8f14",
       "985e02b98105b00c356014e003b2d60e9c458c3dcbeef7378274ccb84af031fc"
@@ -40,6 +42,9 @@
       "6f93e2ae74d3c02a0d4c14a6b2c805f523d234a8c56789f40a7c7c59700ef277",
       "9d4d2e5e0307ea8c38cf885cd67d06a939b7fc2bed65f5080ca9610178949d74"
     ],
+    ".outerlayer/skills/build/scripts/criterion-citations.mjs": [
+      "0902118ec216182f9d0ba0f6c7966306ad6891d8e846022123d3f86aaf175fce"
+    ],
     ".outerlayer/skills/build/scripts/record-criteria.mjs": [
       "36f19e730bc220fa21622b3bb0a306999f038b8220a0a07a1efe21ec0f748729",
       "596e9a78e62cbea040a3bf428cd54bf59687e9e89001fad719304f88d03ca2ea",

package/skill-pack/template/build/SKILL.md

@@ -215,8 +215,9 @@ Run them in order.
    which links it, and a local session with `gh pr create` and then
    `outerlayer work pr <number>`. When the build recorded criteria, from the issue or drafted, a fresh agent judges them with
    [references/criteria-judge.md](references/criteria-judge.md), and the
-   judge's HTML report is emitted:
+   judge's HTML report is linked to its tests and emitted:
 
+       node .outerlayer/skills/build/scripts/criterion-citations.mjs --report <judge-report>.html
        outerlayer emit artifact <judge-report>.html --for acceptance-criteria --caption "Each criterion judged against its test"
 
    Its verdict is recorded on the `acceptance-criteria` check, as release.md

package/skill-pack/template/build/references/release.md

@@ -68,8 +68,11 @@ and a report path under `build-reports/`. Above forty criteria, spawn one
 judge per group of about forty in the same wave, each with its own report
 path, and merge their results by concatenation into one report.
 
-The judge writes an HTML report with one verdict per criterion. Emit it:
+The judge writes an HTML report with one verdict per criterion. Link each
+criterion to the tests that cite it, which the Criteria tab lists. With several
+judges, run it on the merged report. Then emit it:
 
+    node .outerlayer/skills/build/scripts/criterion-citations.mjs --report <judge-report>.html
     outerlayer emit artifact <judge-report>.html --for acceptance-criteria --caption "Each criterion judged against the test that cites it"
 
 Then run `outerlayer sync`. List every unsatisfied criterion in the final

package/skill-pack/template/build/scripts/criterion-citations.mjs

@@ -0,0 +1,184 @@
+#!/usr/bin/env node
+// Links each recorded criterion to the tests that cite it, by writing a
+// `criterion-citations` JSON block into the criteria judge's HTML report. The
+// work item's Criteria tab reads that block to list a criterion's tests. Run
+// it on the report just before emitting it. Needs only Node and git.
+//
+//   node criterion-citations.mjs --report <path> [--criteria-file <path>]
+//
+// The criteria come from the file `record-criteria.mjs` wrote, by default
+// `<git dir>/build-reports/criteria.json`. A test cites a criterion when the
+// criterion's id appears as a whole token in a test's title or in a comment
+// above it. Only git-tracked test files are scanned, so every link names code
+// that a commit contains. The link names the HEAD commit and is written only
+// when the origin remote is on GitHub; otherwise the test is listed unlinked.
+// A criterion no test cites gets an empty list. An existing block in the
+// report is replaced.
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+
+/** A tracked file that holds tests: JS and TS `.test`/`.spec`, Python `test_*.py`/`*_test.py`, Go `*_test.go`, Ruby `*_spec.rb`. */
+export const TEST_FILE = /(?:\.(?:test|spec)\.[cm]?[jt]sx?|(?:^|\/)test_[^/]*\.py|_test\.(?:py|go)|_spec\.rb)$/;
+/** A line that is only a comment: `//`, `#`, `*`, `/*`, `--` or `<!--` first. */
+const COMMENT_LINE = /^\s*(?:\/\/|#|\*|\/\*|--|<!--)/;
+const BLOCK_ID = /<script type="application\/json" id="criterion-citations">[\s\S]*?<\/script>/;
+
+/** A criteria file the agent must fix before anything is written. */
+export class CitationInputError extends Error {}
+
+function escapeRegExp(text) {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+/** A pattern that finds `id` as a whole token: not inside a longer id such as `WC-10` for `WC-1`, and still found before a sentence's full stop. */
+export function idPattern(id) {
+  return new RegExp(`(?<![A-Za-z0-9_:-])${escapeRegExp(id)}(?![A-Za-z0-9_:-]|\\.[A-Za-z0-9])`);
+}
+
+/** The ids of a criteria file shaped `{ "criteria": [{ "id" }] }`. */
+export function criterionIds(input) {
+  if (typeof input !== "object" || input === null || !Array.isArray(input.criteria)) {
+    throw new CitationInputError('the criteria file must be { "criteria": [ ... ] }');
+  }
+  return input.criteria.map((entry, n) => {
+    if (typeof entry !== "object" || entry === null || typeof entry.id !== "string" || entry.id === "") {
+      throw new CitationInputError(`criteria[${n}] has no id`);
+    }
+    return entry.id;
+  });
+}
+
+/**
+ * The 1-based lines of one file's tests that cite `id`. A citation in a
+ * comment belongs to the first line after the comment that is not blank or
+ * another comment line (the test call); a citation anywhere else, such as a
+ * title, belongs to its own line. A comment with nothing after it keeps its
+ * own line.
+ */
+export function citingLines(contents, id) {
+  const pattern = idPattern(id);
+  const lines = contents.split("\n");
+  const found = new Set();
+  lines.forEach((text, index) => {
+    if (!pattern.test(text)) return;
+    if (!COMMENT_LINE.test(text)) {
+      found.add(index + 1);
+      return;
+    }
+    let next = index + 1;
+    while (next < lines.length && (lines[next].trim() === "" || COMMENT_LINE.test(lines[next]))) next += 1;
+    found.add(next < lines.length ? next + 1 : index + 1);
+  });
+  return [...found];
+}
+
+/** `owner/repo` for a github.com remote in ssh or https form, else `null`. */
+export function parseGithubRemote(remoteUrl) {
+  const trimmed = (remoteUrl ?? "").trim();
+  const match =
+    /^git@github\.com:([^/]+)\/(.+?)(?:\.git)?\/?$/.exec(trimmed) ??
+    /^(?:https?|ssh):\/\/(?:[^@/]+@)?(?:www\.)?github\.com(?::\d+)?\/([^/]+)\/(.+?)(?:\.git)?\/?$/.exec(trimmed);
+  return match ? `${match[1]}/${match[2]}` : null;
+}
+
+/** A link to `path` at line `line` of commit `sha`, or `null` when there is no GitHub repository to link to. */
+export function testHref(repository, sha, path, line) {
+  if (!repository || !sha) return null;
+  const encoded = path.split("/").map(encodeURIComponent).join("/");
+  return `https://github.com/${repository}/blob/${sha}/${encoded}#L${line}`;
+}
+
+/**
+ * Each criterion's citing tests, as `{ [id]: [{ path, line, href }] }` in
+ * the order the ids are given. `files` is `[{ path, contents }]` for the
+ * tracked test files; tests sort by path then line.
+ */
+export function buildCitations({ ids, files, repository = null, sha = null }) {
+  const sorted = [...files].sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+  const result = {};
+  for (const id of ids) {
+    result[id] = sorted.flatMap(({ path, contents }) =>
+      citingLines(contents, id).map((line) => ({ path, line, href: testHref(repository, sha, path, line) })),
+    );
+  }
+  return result;
+}
+
+/** The block as HTML. `<` is escaped so no cited path or title can end the script element early. */
+export function renderBlock(citations) {
+  const json = JSON.stringify(citations).replace(/</g, "\\u003c");
+  return `<script type="application/json" id="criterion-citations">${json}</script>`;
+}
+
+/** `html` with the block set: an existing one replaced, else added before `</body>`, else appended. */
+export function withBlock(html, citations) {
+  const block = renderBlock(citations);
+  if (BLOCK_ID.test(html)) return html.replace(BLOCK_ID, () => block);
+  const at = html.lastIndexOf("</body>");
+  return at === -1 ? `${html}\n${block}\n` : `${html.slice(0, at)}${block}\n${html.slice(at)}`;
+}
+
+function git(cwd, args) {
+  const run = spawnSync("git", args, { cwd, encoding: "utf8", maxBuffer: 64 * 1024 * 1024 });
+  return run.status === 0 ? run.stdout : null;
+}
+
+/** Reads the repository's tracked test files and its GitHub identity. `null` outside a git checkout. */
+function readRepository(cwd) {
+  const top = git(cwd, ["rev-parse", "--show-toplevel"])?.trim();
+  const tracked = top ? git(top, ["ls-files", "-z"]) : null;
+  if (!top || tracked === null) return null;
+  const files = [];
+  for (const path of tracked.split("\0").filter((p) => p !== "" && TEST_FILE.test(p))) {
+    try {
+      files.push({ path, contents: readFileSync(join(top, path), "utf8") });
+    } catch {
+      // A tracked file deleted from the working tree has no tests to read.
+    }
+  }
+  const sha = git(top, ["rev-parse", "HEAD"])?.trim() || null;
+  const repository = parseGithubRemote(git(top, ["remote", "get-url", "origin"]) ?? "");
+  return { files, sha, repository };
+}
+
+function main(argv) {
+  const arg = (name) => {
+    const at = argv.indexOf(name);
+    return at === -1 ? undefined : argv[at + 1];
+  };
+  const report = arg("--report");
+  if (!report) {
+    process.stderr.write("usage: criterion-citations.mjs --report <path> [--criteria-file <path>]\n");
+    return 2;
+  }
+  const repo = readRepository(process.cwd());
+  if (!repo) {
+    process.stderr.write("not inside a git repository\n");
+    return 2;
+  }
+  let criteriaFile = arg("--criteria-file");
+  if (!criteriaFile) {
+    const gitDir = git(process.cwd(), ["rev-parse", "--absolute-git-dir"])?.trim();
+    criteriaFile = join(gitDir ?? "", "build-reports", "criteria.json");
+  }
+  let ids;
+  try {
+    ids = criterionIds(JSON.parse(readFileSync(criteriaFile, "utf8")));
+  } catch (err) {
+    process.stderr.write(`cannot read the criteria from "${criteriaFile}": ${err.message}\n`);
+    return 2;
+  }
+  if (!existsSync(report)) {
+    process.stderr.write(`the report "${report}" does not exist\n`);
+    return 2;
+  }
+  const citations = buildCitations({ ids, files: repo.files, repository: repo.repository, sha: repo.sha });
+  writeFileSync(report, withBlock(readFileSync(report, "utf8"), citations));
+  const cited = ids.filter((id) => citations[id].length > 0).length;
+  process.stdout.write(`linked ${cited} of ${ids.length} criteria to the tests that cite them in ${report}\n`);
+  return 0;
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) process.exitCode = main(process.argv.slice(2));