@outerlayer/cli 0.15.0 → 0.17.0

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # @outerlayer/cli
 
+## 0.17.0
+
+### Minor Changes
+
+- 420b0db: `outerlayer runner init` takes `--factory <org>/<factory>`, the same name `outerlayer init --factory` takes, so a runner host no longer needs the Factory Id copied from the dashboard. With no factory named, a login that can use exactly one factory uses it and says which. A login that can use several is refused with each `--factory` value listed. `--app-id` still works, and a `--factory` and `--app-id` that name different factories are refused.
+
+### Patch Changes
+
+- a3ac4ae: Count a test title such as `WC-01: counts words` as citing criterion WC-01. The starter `/build` skill's `criterion-citations.mjs` linked no test whose title put a colon straight after the id, so a build could report 0 of 4 criteria linked. A longer id such as `WC-010`, `WC-01a` or `WC-01:b` still does not cite WC-01.
+- a897c68: The README says to install the CLI globally with `npm install -g @outerlayer/cli`, because `/build` and the other skills run the `outerlayer` command.
+- 2a59794: Fix review results never being recorded on a new factory. The starter code-review and acceptance-criteria checks and the starter `/build` skill told agents to copy each report's link from the pull request's evidence comment, which a factory never posts until comments are turned on. They now take the link from the line `outerlayer sync` prints. A new `outerlayer sync --link <artifact id>` prints the link of an artifact an earlier sync already uploaded.
+- 8196dc9: `outerlayer runner init` names the factory once when it picks the only one the login can use. A refused pasted key no longer repeats the gateway's "Mint a fresh key" advice beside its own step to create a new key with the Runner preset.
+- 8196dc9: `outerlayer runner init` no longer tries to create the runner key with your login, which the gateway never allows. With no key in the config file, it prints the link to the factory's API keys page, asks you to paste a key made with the Runner preset (nothing is shown as you paste), checks it, and goes on. With no terminal it stops and prints the link and the config-file lines to use. `--key-name` is removed. Its output now marks warnings with `!` instead of a tick, no longer doubles ticks for lines from the VM, drops the PATH note about the VM's shell, and says whether capture on the Mac is affected when the runner key moves into the VM.
+- 3ba60cd: No change in behaviour: the runner's wait for a stopped session sender's exit is simplified, and its tests check that the wait ends when the exit is logged.
+- 0b7e87c: The starter skills run the CLI through `npx @outerlayer/cli` when `outerlayer` is not on PATH.
+- f7553df: `outerlayer context materialize` and a container build now fetch the control plane and commit that OuterLayer stores for a repository, and read no `governs` list for it. `outerlayer doctor` reports which control plane governs the repository, its ref and the stored commit. `outerlayer connect` picks the factory that owns a repository linked to two factories, the one with the oldest connection, without asking.
+
+## 0.16.1
+
+### Patch Changes
+
+- 8f583f5: A build's log now always says the session sender exited before it says sync started. The runner waited only until the sender's process was gone, and Node can report the exit a moment later, so the two lines could swap.
+
+## 0.16.0
+
+### Minor Changes
+
+- 87c8154: `outerlayer emit finding` and `emit findings` now record the time every finding cost. The start is `--started-at`, else the first tool output that contains the finding's `--error` text. The end is `--ended-at`, else the newest event. When the session has events and no start is found, nothing is stored, and the command lists the recent events with their ids. Events now include the session's subagents, with ids such as `a4962c00:e23`. `--find <text>` searches every event and records nothing. `--untimed` records a finding with no time on purpose. A session with no transcript on the machine records findings as before. The starter `/build` skill now tells its agents to record the factory problems they hit; `outerlayer init --update` brings it to repositories set up earlier.
+- a076be0: The maintained skills now start with `outerlayer-`, so none can land on a skill of your own: `amend` is `outerlayer-amend`, `emitting-evidence` is `outerlayer-evidence`, `reporting-findings` is `outerlayer-findings`, and `outerlayer` is `outerlayer-cli`. `outerlayer context emit` writes each under its new name and deletes the old copies, so run it and commit. `--check` reports old copies as `retired`. A skill of your own with an earlier name is left alone. Governed checkouts show each skill once, under its new name, before the control plane is updated. The runner runs `/outerlayer-amend` for a command that still says `/amend`, and says so; change `runner.commands.amend` to match. `outerlayer doctor` lists skill files that still use an earlier name. See https://docs.outerlayer.ai/upgrade.
+
+### Patch Changes
+
+- 7b425ca: A runner build now gives the gateway 10 seconds, and one retry, to say which control plane governs the item's repository. When the lookup still fails, `context_unavailable` says whether it timed out, what status the gateway answered, or what network error occurred. Session starts keep their 2-second limit.
+
 ## 0.15.0
 
 ### Minor Changes

package/README.md

@@ -13,12 +13,13 @@ network, and when, is below.
 Launch a session naming the work it's for, then sync:
 
 ```
-npx @outerlayer/cli login                         # sign in, once per machine
-npx @outerlayer/cli init                          # connect this repository to a factory, install the capture hooks
-npx @outerlayer/cli work build --issue 42 --local # create the work item; prints its number
-OUTERLAYER_WORK=7 claude                     # launch a session naming that number
-npx @outerlayer/cli sync --dry-run                # see exactly what would leave your machine
-npx @outerlayer/cli sync                          # upload sessions launched that way
+npm install -g @outerlayer/cli                   # puts `outerlayer` on your PATH, once per machine
+outerlayer login                                 # sign in, once per machine
+outerlayer init                                  # connect this repository to a factory, install the capture hooks
+outerlayer work build --issue 42 --local         # create the work item; prints its number
+OUTERLAYER_WORK=7 claude                         # launch a session naming that number
+outerlayer sync --dry-run                        # see exactly what would leave your machine
+outerlayer sync                                  # upload sessions launched that way
 ```
 
 ## Privacy, stated plainly
@@ -144,10 +145,9 @@ content:
   to it.
 - **`outerlayer runner init`** makes no network call when the config file
   already holds a runner key. With no key there and a saved login, it
-  creates one: `POST /v1/api-keys` with your login's token, sending the key's
-  name (this machine's name, or `--key-name`), the Runner preset's
-  permissions and the factory id. It then checks the new key, unsigned, with
-  `GET /v1/runner/host-key`. `runner init --vm` on a Mac also runs `limactl`,
+  asks the gateway which factories the login can use (`GET /v1/me/factories`)
+  and prints the factory's API keys page. You create the key there and paste
+  it. It checks the pasted key, unsigned, with `GET /v1/runner/host-key`. `runner init --vm` on a Mac also runs `limactl`,
   and Lima downloads a Linux VM image. Inside the VM, `apt` downloads Node and
   `npm` downloads this CLI. Your runner key goes to the VM on the standard
   input of a `limactl shell` command and is never a file or an argument on the
@@ -391,7 +391,7 @@ before it gives up.
 | `outerlayer work claim --item <n>\|--issue <n> --kind implement\|amend [--repo] [--host] [--seconds]` | Records a lease for this host (default: its own hostname), so two hosts never build the same item at once. The lease belongs to the runner key that claimed it: a live lease held by a different key is refused, even under the same host name, and claiming again with the same key extends it. The first claim creates the host key (`host-key.pem` beside the config file) and binds the runner key to it; from then on every request made with that key is signed. Lease length defaults to 900 seconds, the server's own cap. |
 | `outerlayer work renew --item <n>\|--issue <n> [--repo] [--host] [--seconds]` | Extends this host's own live lease. Refused if the lease has expired, or if a different runner key holds it (403 `claim_not_held`). |
 | `outerlayer work release --item <n>\|--issue <n> [--repo] [--host] [--session-id] [--outcome]` | Marks the lease this API key holds released, optionally recording how the attempt ended. Releasing an already-released lease is a no-op that returns the recorded release time and outcome. Run inside a session with no `--host`, it releases that session's own lease instead (`--session-id` names the session when it cannot be detected), so the item's review opens without ending the session. |
-| `outerlayer runner init [--vm\|--no-vm] [--app-id <id>] [--key-name <name>] [--config <path>]` | Writes a `runner` block with defaults, keeping every key the config already had. With no `apiKey` in the config and a saved login, it first creates a runner key from the login with the Runner preset, named after the machine or `--key-name`, on the factory `--app-id` names, and checks it before anything else changes. It names `builtin:vm` on a Linux machine where the user can use `/dev/kvm` and Docker Engine can build images once the guest kernel and helper are published (not yet), `builtin:container` on that machine until then, `builtin:container` on any other machine with Docker Engine, and `builtin:process` on one without, and writes no hook script. Refuses rather than overwriting an existing block. On macOS it asks whether to create a Linux VM with Lima, installs Docker Engine and the runner in it, and starts both at login; `--vm` answers yes and `--no-vm` answers no, and a run with no terminal answers no. The runner key and the host key then live only in the VM: the Mac's config loses `apiKey` and `runner` and gains a `runnerVm` note, which `outerlayer doctor` reads. |
+| `outerlayer runner init [--vm\|--no-vm] [--factory <org>/<factory>] [--app-id <id>] [--config <path>]` | Writes a `runner` block with defaults, keeping every key the config already had. With no `apiKey` in the config and a saved login, it prints the API keys page of the factory `--factory` or `--app-id` names (the only factory the login can use, when neither is given), asks you to paste a runner key made with the Runner preset, and checks it before anything else changes. With no terminal it stops and says what to put in the config. It names `builtin:vm` on a Linux machine where the user can use `/dev/kvm` and Docker Engine can build images once the guest kernel and helper are published (not yet), `builtin:container` on that machine until then, `builtin:container` on any other machine with Docker Engine, and `builtin:process` on one without, and writes no hook script. Refuses rather than overwriting an existing block. On macOS it asks whether to create a Linux VM with Lima, installs Docker Engine and the runner in it, and starts both at login; `--vm` answers yes and `--no-vm` answers no, and a run with no terminal answers no. The runner key and the host key then live only in the VM: the Mac's config loses `apiKey` and `runner` and gains a `runnerVm` note, which `outerlayer doctor` reads. |
 | `outerlayer runner check [--config <path>]` | Validates the config, the hooks and the key, prints the settings the runner would use, and exits non-zero on a problem. Takes no work and writes no pid file. |
 | `outerlayer runner start [--config <path>]` | Runs the loop: claim work, run it, sync, clean up, report, release with an outcome. Repeat. Reads the `runner` block from the config file (default `~/.outerlayer/config.json`). Refuses to start on a bad config, an unrunnable hook, or a refused key. |
 | `outerlayer runner image --repository <owner/name> [--remote <url>] [--config <path>] [--json]` | Builds the image a repository's builds run in. Fetches the head of the default branch into the runner's cache, builds its `.devcontainer/devcontainer.json` with the devcontainer CLI, ignores every setting that reaches the host or widens the container's privileges, and adds this CLI and a pinned Claude Code. Reuses the image until the recipe or the tools change, keeps the newest three, and writes `recipe.json` beside the image record. Refuses a Compose recipe (`recipe_needs_docker`) and a repository with only named configurations (`recipe_ambiguous`). |

package/dist/{agent-setup-CN2HUBEJ.js → agent-setup-T624CWPD.js}

@@ -1,17 +1,18 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { keepHandWritten, runAgentSetup } from './chunk-SXWS25JC.js';
-import './chunk-HFKKFTXU.js';
+export { keepHandWritten, runAgentSetup } from './chunk-KG5ECZGJ.js';
+import './chunk-2MNPHL23.js';
 import './chunk-XCK2YAY5.js';
-import './chunk-FOJGZYFC.js';
+import './chunk-42ZI52JW.js';
 import './chunk-YRYMNBGQ.js';
-import './chunk-3NLOVYJQ.js';
-import './chunk-LCEXHCHD.js';
+import './chunk-YZ5F4PIS.js';
+import './chunk-WTE3MQML.js';
+import './chunk-C5Y5ZJJZ.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-YO4PSLVB.js';
 import './chunk-BYT5O5RV.js';
-import './chunk-ZA5CHAFY.js';
-import './chunk-2M63GG56.js';
+import './chunk-POJMEEJJ.js';
+import './chunk-OHVJA253.js';
 import './chunk-PLMTLGYH.js';
 import './chunk-J5M7BSJQ.js';
 import './chunk-EABW6AJQ.js';

package/dist/artifact-link-cmd-2F47LT7F.js

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { sanitizeTerminal, readEffectiveArtifactSpoolState } from './chunk-WUYTWNMA.js';
+import './chunk-J5M7BSJQ.js';
+import { homeFromEnv } from './chunk-VNVZDWO3.js';
+import './chunk-Z5GEFMRW.js';
+
+createRequire(import.meta.url);
+
+// src/artifact-link-cmd.ts
+function lookupArtifactLink(artifactId, home = homeFromEnv()) {
+  const shown = sanitizeTerminal(artifactId);
+  const entry = readEffectiveArtifactSpoolState(home).state.get(artifactId);
+  if (entry === void 0) return { ok: false, reason: `no artifact ${shown} is queued or uploaded on this machine` };
+  if (entry.state !== "uploaded") {
+    return { ok: false, reason: `artifact ${shown} is ${entry.state}, not uploaded yet \u2014 run \`outerlayer sync\` first` };
+  }
+  if (entry.url === void 0) {
+    return { ok: false, reason: `artifact ${shown} uploaded, but the gateway returned no link for it` };
+  }
+  return { ok: true, url: entry.url };
+}
+
+export { lookupArtifactLink };

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-09T12:01:54.751Z+00e38ff","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-09T21:24:47.045Z+8773e8e","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{check-2JSSXCKJ.js → check-5XE7XMC4.js}

@@ -1,33 +1,33 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-NXUH742G.js';
-import './chunk-ASOSIKA4.js';
+import { probeCredentials } from './chunk-WVUIRTWA.js';
+import './chunk-G5NPRL2K.js';
+import './chunk-RMWLBUCJ.js';
 import './chunk-O765JR4W.js';
 import './chunk-UGP76IZ5.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-YETTWTAY.js';
-import './chunk-RMWLBUCJ.js';
 import './chunk-I2UOAV7X.js';
+import './chunk-NNRTPG7X.js';
 import './chunk-HYZRY4KZ.js';
 import './chunk-ADJRGVZC.js';
-import './chunk-KFRM23WD.js';
-import './chunk-MSASO5O4.js';
+import './chunk-NWQTTSBB.js';
 import './chunk-HHJDN6AU.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem } from './chunk-F7GBYX2P.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-LWSJQJC6.js';
 import './chunk-YYYRBYWG.js';
 import './chunk-TI7B7UEO.js';
 import './chunk-TBT347UY.js';
-import './chunk-HXLMZOKU.js';
-import './chunk-Z3NOIFDR.js';
-import './chunk-UUDDPNRJ.js';
+import './chunk-VQYBXPI7.js';
+import './chunk-ONKJUM6R.js';
+import './chunk-MAK5LYRF.js';
 import './chunk-KMDLFI4P.js';
 import './chunk-QKFB4K7X.js';
 import './chunk-RSNSZ2LJ.js';
-import './chunk-T5VPP6H7.js';
+import './chunk-OZGHL5Y5.js';
 import './chunk-RLYZLUQ7.js';
 import { parseRunnerEnv } from './chunk-6MZSX4M7.js';
-import './chunk-JR6ERP3M.js';
-import './chunk-NPQWKGUA.js';
+import './chunk-S3NYLI2P.js';
+import './chunk-6Y5RUTHO.js';
 import './chunk-IP7BIBXJ.js';
 import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-22RMZBGW.js';
 import './chunk-UXYLWVTQ.js';
@@ -41,7 +41,7 @@ import './chunk-4Q7OMKAT.js';
 import './chunk-CX22S5BA.js';
 import './chunk-F7CU5ABH.js';
 import './chunk-BKO6JEZI.js';
-import './chunk-YDSMROTB.js';
+import './chunk-3NSNIIBE.js';
 import './chunk-WUYTWNMA.js';
 import './chunk-JXYVA45C.js';
 import './chunk-4KSQKQXE.js';
@@ -50,20 +50,21 @@ import './chunk-YRYMNBGQ.js';
 import './chunk-GQD22KKN.js';
 import './chunk-WZBHBH3J.js';
 import './chunk-5QRP3MVS.js';
-import './chunk-3NLOVYJQ.js';
-import './chunk-LCEXHCHD.js';
+import './chunk-YZ5F4PIS.js';
+import './chunk-WTE3MQML.js';
+import './chunk-C5Y5ZJJZ.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-YO4PSLVB.js';
 import './chunk-BYT5O5RV.js';
-import './chunk-ZA5CHAFY.js';
-import './chunk-2M63GG56.js';
+import './chunk-POJMEEJJ.js';
+import './chunk-OHVJA253.js';
 import './chunk-PLMTLGYH.js';
 import './chunk-J5M7BSJQ.js';
 import './chunk-EABW6AJQ.js';
 import './chunk-RA3O54FC.js';
 import './chunk-V7NIVOFD.js';
 import './chunk-ZM2IMMYN.js';
-import './chunk-PQUM37BK.js';
+import './chunk-BWQ66M6N.js';
 import './chunk-XCCLFVXM.js';
 import './chunk-BJ3KTMDH.js';
 import './chunk-VNVZDWO3.js';
@@ -130,6 +131,7 @@ async function runRunnerCheck(configPath, deps = {}) {
     return { ok: false, check: "claim permission", message: `${configPath}: ${claimProblem.problem}` };
   }
   const unverifiedReason = probe.ok ? claimProblem.reason : probe.reason;
+  const formerSkill = formerSkillQueues(config);
   const lines = [
     `config              ${configPath}`,
     `host                ${config.host}`,
@@ -145,7 +147,8 @@ async function runRunnerCheck(configPath, deps = {}) {
     `hook cleanup        ${config.hooks.cleanup}`,
     `hook report         ${config.hooks.report ?? "(none)"}`,
     `repos include       ${config.repos?.include?.join(", ") ?? "(all)"}`,
-    `repos exclude       ${config.repos?.exclude?.join(", ") ?? "(none)"}`
+    `repos exclude       ${config.repos?.exclude?.join(", ") ?? "(none)"}`,
+    ...formerSkill.length > 0 ? [`note                ${formerSkillProblem(formerSkill)}`] : []
   ];
   return { ok: true, lines, unverifiedReason, summary: `${config.url} \xB7 app ${config.appId}` };
 }

package/dist/{chunk-HFKKFTXU.js → chunk-2MNPHL23.js}

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { C } from './chunk-YRYMNBGQ.js';
-import { maintainedFilesForExistingSkills, loadMaintainedFiles, writeMaintainedFiles } from './chunk-ZA5CHAFY.js';
-import { emitTree, parseOuterlayerConfig, classifyTree, generatedHeaderSource, CONTEXT_PIN_FILENAME, normalizePath } from './chunk-2M63GG56.js';
+import { retiredSkillPaths, removeRetiredSkills } from './chunk-C5Y5ZJJZ.js';
+import { maintainedFilesForExistingSkills, loadMaintainedFiles, writeMaintainedFiles } from './chunk-POJMEEJJ.js';
+import { emitTree, parseOuterlayerConfig, classifyTree, generatedHeaderSource, CONTEXT_PIN_FILENAME, normalizePath } from './chunk-OHVJA253.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, copyFileSync, readdirSync } from 'fs';
 import { join, dirname, relative, sep } from 'path';
 
@@ -49,9 +50,9 @@ function walk(dir, repoRoot, insideOuterlayer, out) {
     }
   }
 }
-function buildEmitInput(repoRoot, targets, maintained) {
+function buildEmitInput(repoRoot, targets, maintained, excluded = /* @__PURE__ */ new Set()) {
   const bundled = new Map(maintained.map((f) => [f.path, f.content]));
-  const discovered = [.../* @__PURE__ */ new Set([...discoverOuterlayerPaths(repoRoot), ...bundled.keys()])].sort();
+  const discovered = [.../* @__PURE__ */ new Set([...discoverOuterlayerPaths(repoRoot).filter((p) => !excluded.has(p)), ...bundled.keys()])].sort();
   const { entries } = classifyTree(discovered);
   const classified = new Set(entries.map((e) => e.path));
   const contents = /* @__PURE__ */ new Map();
@@ -80,12 +81,13 @@ function writeOutputs(repoRoot, result, maintained) {
   }
   return { files, copies, maintained: [...changedMaintained.created, ...changedMaintained.rewritten] };
 }
-function renderSuccess(targets, files, copies, maintained) {
+function renderSuccess(targets, files, copies, maintained, retired) {
   const copySuffix = copies.length > 0 ? `, ${copies.length} ${copies.length === 1 ? "copy" : "copies"}` : "";
   const lines = [
     `${C.green}\u2713${C.reset} emitted ${files.length} file${files.length === 1 ? "" : "s"}${copySuffix} for ${C.dim}${targets.join(", ")}${C.reset}`
   ];
   for (const path of maintained) lines.push(`  ${C.dim}updated ${path} to this CLI's version${C.reset}`);
+  for (const path of retired) lines.push(`  ${C.dim}removed ${path}: this skill has a new name${C.reset}`);
   return lines.join("\n");
 }
 function renderFailure(errors) {
@@ -179,21 +181,24 @@ function runEmit(opts = {}) {
   if (!existsSync(cwd)) throw new EmitError(`no such directory: ${cwd}`);
   const targets = resolveTargetsFromConfig(cwd);
   const maintained = maintainedFilesForExistingSkills(cwd, loadMaintainedFiles());
-  const built = buildEmitInput(cwd, targets, maintained);
+  const retired = retiredSkillPaths(cwd);
+  const built = buildEmitInput(cwd, targets, maintained, new Set(retired));
   const emitted = emitTree(built.input);
   const { result, kept } = withholdKept(cwd, emitted, opts.keep);
   const hasErrors = result.errors.length > 0;
-  if (opts.check) return runCheck(cwd, opts, targets, result, hasErrors, built.sourcePaths, maintained, kept);
+  if (opts.check) return runCheck(cwd, opts, targets, result, hasErrors, built.sourcePaths, maintained, kept, retired);
   const written = hasErrors ? { files: [], copies: [], maintained: [] } : writeOutputs(cwd, result, maintained);
+  const removed = hasErrors ? [] : removeRetiredSkills(cwd);
   const exitCode = hasErrors ? 1 : 0;
   const output = opts.json ? JSON.stringify({
     targets,
     files: written.files,
     copies: written.copies,
     maintained: written.maintained,
+    retired: removed,
     warnings: result.warnings,
     errors: result.errors
-  }) : hasErrors ? renderFailure(result.errors) : renderSuccess(targets, written.files, written.copies, written.maintained);
+  }) : hasErrors ? renderFailure(result.errors) : renderSuccess(targets, written.files, written.copies, written.maintained, removed);
   if (!opts.quiet) {
     if (opts.json) {
       process.stdout.write(output + "\n");
@@ -211,15 +216,17 @@ function runEmit(opts = {}) {
     copies: written.copies,
     maintained: written.maintained,
     kept,
+    retired: removed,
     warnings: result.warnings,
     errors: result.errors,
     output,
     exitCode
   };
 }
-function runCheck(cwd, opts, targets, result, hasErrors, sourcePaths, maintained, kept) {
+function runCheck(cwd, opts, targets, result, hasErrors, sourcePaths, maintained, kept, retired) {
   const drift = [];
   if (!hasErrors) {
+    for (const path of retired) drift.push({ kind: "retired", path });
     for (const file of maintained) {
       const d = compareFile(cwd, file.path, file.content);
       if (d) drift.push(d);
@@ -233,7 +240,8 @@ function runCheck(cwd, opts, targets, result, hasErrors, sourcePaths, maintained
       const d = compareCopy(cwd, copy);
       if (d) drift.push(d);
     }
-    drift.push(...findOrphans(cwd, computedFiles, sourcePaths));
+    const retiredPaths = new Set(retired);
+    drift.push(...findOrphans(cwd, computedFiles, sourcePaths).filter((d) => !retiredPaths.has(d.path)));
     drift.sort((a, b) => a.path.localeCompare(b.path) || a.kind.localeCompare(b.kind));
   }
   const exitCode = hasErrors || drift.length > 0 ? 1 : 0;
@@ -249,7 +257,7 @@ function runCheck(cwd, opts, targets, result, hasErrors, sourcePaths, maintained
 `);
     }
   }
-  return { targets, files: [], copies: [], maintained: [], kept, warnings: result.warnings, errors: result.errors, drift, output, exitCode };
+  return { targets, files: [], copies: [], maintained: [], kept, retired: [], warnings: result.warnings, errors: result.errors, drift, output, exitCode };
 }
 
 export { EmitError, runEmit };

package/dist/{chunk-YDSMROTB.js → chunk-3NSNIIBE.js}

@@ -78,6 +78,7 @@ var REASON_TEXT = {
   flag: "you passed --factory",
   saved: "already connected",
   linked: "the repository is linked to it",
+  owner: "it owns this repository",
   only: "the only factory you can use",
   prompt: "you chose it"
 };
@@ -128,18 +129,19 @@ function parseFactories(body) {
         name: sanitizeTerminal(org.name),
         displayName: sanitizeTerminal(typeof org.displayName === "string" ? org.displayName : org.name)
       },
-      linked: typeof row.linked === "boolean" ? row.linked : null
+      linked: typeof row.linked === "boolean" ? row.linked : null,
+      owner: row.owner === true
     });
   }
   return out;
 }
 function listText(factories, repository) {
-  return factories.map((f) => `  ${slug(f)}  ${f.displayName}${f.linked === true ? ` (linked to ${repository})` : ""}`).join("\n");
+  return factories.map((f) => `  ${slug(f)}  ${f.displayName}${f.linked === true && repository !== void 0 ? ` (linked to ${repository})` : ""}`).join("\n");
 }
 async function fetchFactories(fetchImpl, url, token, repository) {
   let res;
   try {
-    res = await fetchImpl(`${url.replace(/\/+$/, "")}/v1/me/factories?${new URLSearchParams({ repository }).toString()}`, {
+    res = await fetchImpl(`${url.replace(/\/+$/, "")}/v1/me/factories${repository === void 0 ? "" : `?${new URLSearchParams({ repository }).toString()}`}`, {
       method: "GET",
       headers: { authorization: `Bearer ${token}` },
       signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
@@ -168,6 +170,8 @@ function selectFactory(factories, saved, repository) {
   if (remembered) return { factory: remembered, reason: "saved" };
   const linked = factories.filter((f) => f.linked === true);
   if (linked.length === 1) return { factory: linked[0], reason: "linked" };
+  const owners = factories.filter((f) => f.owner);
+  if (owners.length === 1) return { factory: owners[0], reason: "owner" };
   if (factories.length === 1) return { factory: factories[0], reason: "only" };
   return { factory: void 0, values: factories.map(slug), text: listText(factories, repository) };
 }
@@ -310,4 +314,4 @@ ${COMMIT_LINE}
   return r.code;
 }
 
-export { COMMIT_LINE, autoConnectedLine, fetchFactories, isLinkedRepository, promptOnTerminal, realConnectDeps, runConnect, runConnectCommand, saveFactoryConnection, selectFactory, workPageUrl };
+export { COMMIT_LINE, autoConnectedLine, dashboardBase, fetchFactories, isLinkedRepository, listText, promptOnTerminal, realConnectDeps, runConnect, runConnectCommand, saveFactoryConnection, selectFactory, slug, workPageUrl };

package/dist/{chunk-FOJGZYFC.js → chunk-42ZI52JW.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { C } from './chunk-YRYMNBGQ.js';
-import { resolvePackRoot, loadTemplateFiles, loadMaintainedFiles, TEMPLATE_SKILLS, skillDir, writeMaintainedFiles, MAINTAINED_SKILLS } from './chunk-ZA5CHAFY.js';
+import { resolvePackRoot, loadTemplateFiles, loadMaintainedFiles, TEMPLATE_SKILLS, skillDir, writeMaintainedFiles, MAINTAINED_SKILLS } from './chunk-POJMEEJJ.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
 import { readFileSync, existsSync, mkdirSync, writeFileSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-NPQWKGUA.js → chunk-6Y5RUTHO.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-YDSMROTB.js';
+import { fetchFactories, selectFactory, saveFactoryConnection, autoConnectedLine } from './chunk-3NSNIIBE.js';
 import { resolveRepoIdentity } from './chunk-JXYVA45C.js';
 import { resolveGatewayCredentials } from './chunk-PLMTLGYH.js';
 import { findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';

package/dist/{chunk-PQUM37BK.js → chunk-BWQ66M6N.js}

@@ -634,7 +634,7 @@ async function runHookFast(event, home = homeFromEnv(), read = readStdin, env =
       recordHookErrorsSeen(home, hookErrorsBytes);
       if (contextPossiblyGoverned(sessionCwd, home)) {
         try {
-          const { materializeContext: materialize } = await import('./context-materialize-FDHYKNDT.js');
+          const { materializeContext: materialize } = await import('./context-materialize-IV2TUUFO.js');
           const sessionId = typeof payload.session_id === "string" ? payload.session_id : "unknown";
           const result = await materialize({ cwd: sessionCwd, sessionId, home });
           materializeMessage = result.message;

package/dist/chunk-C5Y5ZJJZ.js

@@ -0,0 +1,88 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { skillDir, FORMER_MAINTAINED_NAMES, isMaintainedCopy } from './chunk-POJMEEJJ.js';
+import { emitTree, ALL_TARGET_IDS, classifyTree } from './chunk-OHVJA253.js';
+import { readFileSync, existsSync, unlinkSync, rmdirSync, readdirSync } from 'fs';
+import { join, dirname, relative, sep } from 'path';
+
+createRequire(import.meta.url);
+function filesUnder(repoRoot, rel) {
+  try {
+    return readdirSync(join(repoRoot, rel), { recursive: true, withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => relative(repoRoot, join(entry.parentPath, entry.name)).split(sep).join("/"));
+  } catch {
+    return [];
+  }
+}
+function retiredSkillsPresent(repoRoot) {
+  return Object.keys(FORMER_MAINTAINED_NAMES).filter((former) => isMaintainedCopy(repoRoot, former));
+}
+function retiredSkillPaths(repoRoot, retired = retiredSkillsPresent(repoRoot)) {
+  const paths = /* @__PURE__ */ new Set();
+  for (const former of retired) {
+    const sources = filesUnder(repoRoot, skillDir(former));
+    const compiled = emitTree({
+      entries: classifyTree(sources).entries,
+      contents: new Map(sources.map((path) => [path, readFileSync(join(repoRoot, path), "utf8")])),
+      // A superset is safe: targets ignore a path that is not a skill asset.
+      assetPaths: sources,
+      targets: [...ALL_TARGET_IDS]
+    });
+    for (const path of [...sources, ...compiled.files.map((f) => f.path), ...compiled.copies.map((c) => c.toPath)]) paths.add(path);
+  }
+  return [...paths].filter((path) => existsSync(join(repoRoot, path))).sort();
+}
+function removeRetiredSkills(repoRoot, unsafe) {
+  const removed = retiredSkillPaths(repoRoot).filter((path) => !unsafe?.(path));
+  for (const path of removed) {
+    unlinkSync(join(repoRoot, path));
+    for (let dir = dirname(path); dir !== "."; dir = dirname(dir)) {
+      try {
+        rmdirSync(join(repoRoot, dir));
+      } catch {
+        break;
+      }
+    }
+  }
+  return removed;
+}
+function filesNamingFormerSkills(repoRoot) {
+  const patterns = [
+    ["emitting-evidence", /\bemitting-evidence\b/],
+    ["reporting-findings", /\breporting-findings\b/],
+    ["amend", /`amend` skill|(^|[\s"'`(])\/amend(?![\w-])/m],
+    ["outerlayer", /`outerlayer` skill|skills\/outerlayer\//]
+  ];
+  const retired = retiredSkillsPresent(repoRoot).map((former) => `${skillDir(former)}/`);
+  const hits = [];
+  for (const path of filesUnder(repoRoot, ".outerlayer/skills").sort()) {
+    if (retired.some((dir) => path.startsWith(dir))) continue;
+    const text = readFileSync(join(repoRoot, path), "utf8");
+    const formers = patterns.filter(([, pattern]) => pattern.test(text)).map(([former]) => former);
+    if (formers.length > 0) hits.push({ path, formers });
+  }
+  return hits;
+}
+function checkFormerSkillNames(repoRoot) {
+  const checks = [];
+  const retired = retiredSkillsPresent(repoRoot);
+  if (retired.length > 0) {
+    checks.push({
+      name: "Renamed skills",
+      status: "warn",
+      detail: `copies under earlier names: ${retired.map(skillDir).join(", ")}`,
+      fix: "Run `outerlayer context emit` to replace them with the current names, then commit."
+    });
+  }
+  const hits = filesNamingFormerSkills(repoRoot);
+  if (hits.length > 0) {
+    checks.push({
+      name: "Skill names",
+      status: "warn",
+      detail: `${hits.map((h) => `${h.path} (${h.formers.join(", ")})`).join("; ")} still ${hits.length === 1 ? "names" : "name"} a skill by an earlier name`,
+      fix: `Replace each earlier name with the current one: ${Object.entries(FORMER_MAINTAINED_NAMES).map(([former, current]) => `${former} \u2192 ${current}`).join(", ")}. \`outerlayer init --update\` does this for a file you have not edited.`
+    });
+  }
+  return checks;
+}
+
+export { checkFormerSkillNames, removeRetiredSkills, retiredSkillPaths };

package/dist/{chunk-ASOSIKA4.js → chunk-G5NPRL2K.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { writeJobFile, readJobFile } from './chunk-RMWLBUCJ.js';
+import { senderPidfile } from './chunk-NNRTPG7X.js';
 import { DOCKERD_LOG } from './chunk-HYZRY4KZ.js';
-import { senderPidfile } from './chunk-KFRM23WD.js';
-import { installScrubContext } from './chunk-MSASO5O4.js';
-import { AssetError, describeCallFailure, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, refusalCode, resolveAgentUser, AgentUserError, runBuildSteps, removeStagedContext, stageGovernedContext, shellQuote, createRunnerLog, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, formatDuration, retrySend, formatClock, containerSenderCommand, syncInContainer, copyTranscriptsFromContainer, GH_CONFIG_YML, ghHostsYml, ADDED_USER, isLiteralAddress, signalInContainer, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript } from './chunk-UUDDPNRJ.js';
+import { installScrubContext } from './chunk-NWQTTSBB.js';
+import { AssetError, describeCallFailure, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, refusalCode, resolveAgentUser, AgentUserError, runBuildSteps, removeStagedContext, stageGovernedContext, shellQuote, createRunnerLog, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, formatDuration, retrySend, formatClock, containerSenderCommand, syncInContainer, copyTranscriptsFromContainer, GH_CONFIG_YML, ghHostsYml, ADDED_USER, isLiteralAddress, signalInContainer, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, writeEvalInput, EVAL_INPUT_NAME, copyTranscripts, senderSignalScript } from './chunk-MAK5LYRF.js';
 import { childEnvironment } from './chunk-KMDLFI4P.js';
 import { waitForAgent, vmExecArgs } from './chunk-QKFB4K7X.js';
 import { socketPathProblem, vsockLinks, linkVsockSockets } from './chunk-RSNSZ2LJ.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-JR6ERP3M.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-S3NYLI2P.js';
 import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-22RMZBGW.js';
 import { readBranchHead, diffBetween, fetchCommit } from './chunk-R7PF5OOU.js';
 import { isSameProcess, startTimeOf } from './chunk-N5FOE5PS.js';
@@ -18,7 +18,7 @@ import { CLAUDE_CODE_VERSION } from './chunk-CX22S5BA.js';
 import { planArtifactUpload } from './chunk-WUYTWNMA.js';
 import { scrubText } from './chunk-JXYVA45C.js';
 import { withHooksPath, authorEnvironment, commitIdentityRecord } from './chunk-BYT5O5RV.js';
-import { parsePolicy } from './chunk-2M63GG56.js';
+import { parsePolicy } from './chunk-OHVJA253.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
 import { signerFor } from './chunk-V7NIVOFD.js';
@@ -2062,6 +2062,8 @@ async function recoverLostJobs(jobsDirPath, config, deps) {
 // src/runner/sender.ts
 var STOP_WAIT_MS = 3e4;
 var POLL_MS = 200;
+var EXIT_REPORT_WAIT_MS = 2e3;
+var exitsLogged = /* @__PURE__ */ new Map();
 var BUILD_HOME = "/build/home";
 async function startSender(input) {
   const { config, job, jobDir, deps } = input;
@@ -2072,10 +2074,16 @@ async function startSender(input) {
     const launch = launchFor(config, job, jobDir, deps);
     const fd = openSync(join(jobDir, "sender.log"), "a", RUNNER_FILE_MODE);
     let pid;
+    let exitLogged;
     try {
       const child = spawnFn(launch.command, launch.args, { env: launch.env, cwd: launch.cwd, detached: true, stdio: ["ignore", fd, fd] });
       child.on("error", (err) => deps.log.error(`${tag} session sender failed: ${describeCallFailure(err)}`));
-      child.on("exit", (code, signal) => deps.log.line(`${tag} session sender exited \xB7 ${signal ?? `code ${code}`} \xB7 see sender.log`));
+      exitLogged = new Promise((resolve) => {
+        child.on("exit", (code, signal) => {
+          deps.log.line(`${tag} session sender exited \xB7 ${signal ?? `code ${code}`} \xB7 see sender.log`);
+          resolve();
+        });
+      });
       child.unref?.();
       pid = child.pid;
     } finally {
@@ -2085,6 +2093,7 @@ async function startSender(input) {
       deps.log.line(`${tag} session sender did not start: no pid`);
       return void 0;
     }
+    exitsLogged.set(pid, exitLogged);
     deps.log.line(`${tag} session sender started \xB7 pid ${pid}`);
     return { pid, start: startTimeOf(pid) ?? void 0 };
   } catch (err) {
@@ -2137,6 +2146,17 @@ async function signalInGuest(runtime, state, pidfile, signal) {
     env: { PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" }
   });
 }
+async function exitReported(pid) {
+  const logged = exitsLogged.get(pid);
+  let timer;
+  const bound = new Promise((resolve) => {
+    timer = setTimeout(resolve, EXIT_REPORT_WAIT_MS);
+    timer.unref?.();
+  });
+  await Promise.race([logged, bound]);
+  clearTimeout(timer);
+  exitsLogged.delete(pid);
+}
 async function stopSender(input) {
   const { job, deps } = input;
   const sender = job.sender;
@@ -2159,6 +2179,7 @@ async function stopSender(input) {
       await signalInside("KILL");
       signalHost(sender, "SIGKILL");
     }
+    await exitReported(sender.pid);
   } catch (err) {
     deps.log.error(`${tag} stopping the session sender failed: ${describeCallFailure(err)} \xB7 continuing`);
   }