@outerlayer/cli 0.15.0 → 0.17.0

package/dist/{cli-RGGXQTWI.js → cli-A76AXELQ.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-QLTYTPYU.js';
-import './chunk-MTF3PHVZ.js';
-import './chunk-JR6ERP3M.js';
-import './chunk-NPQWKGUA.js';
+import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-HGECYFEI.js';
+import './chunk-NBGDBTO2.js';
+import './chunk-S3NYLI2P.js';
+import './chunk-6Y5RUTHO.js';
 import './chunk-IP7BIBXJ.js';
 import './chunk-F47JBIAW.js';
 import './chunk-BKO6JEZI.js';
 import './chunk-XCK2YAY5.js';
-import './chunk-FOJGZYFC.js';
-import './chunk-YDSMROTB.js';
+import './chunk-42ZI52JW.js';
+import './chunk-3NSNIIBE.js';
 import './chunk-WUYTWNMA.js';
 import './chunk-JXYVA45C.js';
 import './chunk-4KSQKQXE.js';
@@ -17,17 +17,18 @@ import './chunk-N6LURUEF.js';
 import { C, NO_COLOR_FLAG, warnDeprecated, stripNoColor, API_KEY_FLAG_DEPRECATION } from './chunk-YRYMNBGQ.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { settingsPath, readSettings, SettingsParseError, listHookCandidates, wrapHooks, writeSettings, unwrapHooks, REGISTERED_EVENTS, cliCommand, removeHooks, removeStatusline, cliBinResolvable, mergeHooks, repointWrappedHooks, AUTO_WRAP_EVENTS, mergeStatusline } from './chunk-5QRP3MVS.js';
-import { pinExists } from './chunk-LCEXHCHD.js';
+import { pinExists } from './chunk-WTE3MQML.js';
+import './chunk-C5Y5ZJJZ.js';
 import './chunk-YO4PSLVB.js';
-import './chunk-ZA5CHAFY.js';
-import './chunk-2M63GG56.js';
+import './chunk-POJMEEJJ.js';
+import './chunk-OHVJA253.js';
 import './chunk-PLMTLGYH.js';
 import './chunk-J5M7BSJQ.js';
 import './chunk-EABW6AJQ.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
 import './chunk-V7NIVOFD.js';
 import './chunk-ZM2IMMYN.js';
-import { hookFiredMarkerPath, installedCliDistDir } from './chunk-PQUM37BK.js';
+import { hookFiredMarkerPath, installedCliDistDir } from './chunk-BWQ66M6N.js';
 import { managedHookScripts, removeJournalHooks, installPreCommitGuardHook, removePreCommitGuardHook } from './chunk-XCCLFVXM.js';
 import './chunk-BJ3KTMDH.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
@@ -3631,7 +3632,7 @@ function printLauncher(result, summary) {
   const line = summary(result.launcher);
   if (line !== void 0) process.stdout.write(`${C.green}\u2713${C.reset} ${line}
 `);
-  for (const note of result.launcher.notes) process.stdout.write(`${C.yellow}${note}${C.reset}
+  for (const note of result.launcher.notes) process.stdout.write(`${C.yellow}!${C.reset} ${note}
 `);
 }
 function writeJson(value) {
@@ -3645,7 +3646,7 @@ function warnIfApiKeyFlag(opts) {
   if (opts.apiKey !== void 0) warnDeprecated(API_KEY_FLAG_DEPRECATION);
 }
 async function installStarterPackInRepo() {
-  const { installStarterPack, formatStarterPackOutput } = await import('./starter-pack-IB4UUIX3.js');
+  const { installStarterPack, formatStarterPackOutput } = await import('./starter-pack-KF66HGZR.js');
   const cwd = process.cwd();
   let repoRoot = cwd;
   try {
@@ -3805,7 +3806,7 @@ ${starter.output}`),
   }
 }
 async function realConnectDepsForCwd() {
-  const { realConnectDeps } = await import('./connect-cmd-JUAW6MU4.js');
+  const { realConnectDeps } = await import('./connect-cmd-JBKAQNSF.js');
   const { resolveRepoIdentity } = await import('./dist-LKDWQWZ7.js');
   return {
     ...realConnectDeps(),
@@ -3827,7 +3828,7 @@ function buildProgram(argv = process.argv) {
     "\nIn a repository, init runs four steps: connect the repository to a\nfactory (`outerlayer connect`), install the hooks, set up the coding agent,\nand run `outerlayer doctor`. It never signs in and asks nothing. With no\nlogin it skips the connect step and says to run `outerlayer login`. With\n--json it prints one document naming the outcome of each step: done,\nskipped or failed. The exit code is 1 when a step failed.\n\nThe agent setup step installs the starter skills and the `outerlayer` skill\ninto .outerlayer/skills/, writes .outerlayer/config.json for Claude Code when\nthere is none, runs `outerlayer context emit` so the skills appear in\n.claude/skills/, and adds the outerlayer and outerlayer-docs MCP servers to\n.mcp.json. Nothing you wrote is changed: an existing config, policy, edited\nskill, MCP entry or root CLAUDE.md and AGENTS.md is left as it is, and a\nhand-written file the emit would replace is kept and listed. The files are\nleft uncommitted.\nThe step is skipped outside a git repository and in a repository whose\ncontext comes from a control plane, where it arrives at session start.\n\n--local installs only the hooks: no connect step, no agent setup and no\nnetwork call. Add `--template default` to also write the starter skills and\na policy file into .outerlayer/ without compiling them; `outerlayer context\nemit` does that.\n\nIdempotent: settings are backed up before any write, and a second run\nchanges nothing. Wrapping adds one spawn per hook firing; undo it with\n`outerlayer hooks unwrap`. An occupied status-line slot is wrapped, never\nreplaced.\n\nThree of the starter skills are copied once and are yours to edit. The\nothers are rewritten from this CLI on every `context emit`.\n\n--update brings the files init wrote once up to this CLI's version: the\ntemplate skills, the policy, the two starter checks and the two MCP\nentries. A file still equal to a version an earlier release wrote is\nreplaced, and a missing one is written. A file you edited is never\ntouched. It then runs `outerlayer context emit` and leaves the changes\nuncommitted. --dry-run prints the plan, with a command to compare each\nedited file, and writes nothing. `outerlayer doctor` reports the same\nstates under Starter files.\n"
   ).action(async (opts) => {
     if (opts.update || opts.dryRun) {
-      const { runInitUpdate, formatInitUpdate, updateFlagProblem } = await import('./init-update-O5YYFGF4.js');
+      const { runInitUpdate, formatInitUpdate, updateFlagProblem } = await import('./init-update-CVCWD6VS.js');
       const problem = updateFlagProblem(opts);
       if (problem !== void 0) {
         fail(problem);
@@ -3841,7 +3842,7 @@ function buildProgram(argv = process.argv) {
     }
     let starterTemplate;
     if (opts.template !== void 0) {
-      const { assertKnownTemplate, StarterPackError } = await import('./starter-pack-IB4UUIX3.js');
+      const { assertKnownTemplate, StarterPackError } = await import('./starter-pack-KF66HGZR.js');
       try {
         assertKnownTemplate(opts.template);
       } catch (err) {
@@ -3872,7 +3873,7 @@ function buildProgram(argv = process.argv) {
       else process.stdout.write(outcome.text);
       return;
     }
-    const { runInitCommand } = await import('./init-cmd-JR3RKNFB.js');
+    const { runInitCommand } = await import('./init-cmd-XAVO7HYZ.js');
     const code = await runInitCommand(
       { json: opts.json, factory: opts.factory },
       {
@@ -3884,7 +3885,7 @@ function buildProgram(argv = process.argv) {
           return { ok, text, detail };
         },
         runAgentSetup: async () => {
-          const { runAgentSetup } = await import('./agent-setup-CN2HUBEJ.js');
+          const { runAgentSetup } = await import('./agent-setup-T624CWPD.js');
           return runAgentSetup({ cwd: process.cwd() });
         },
         runDoctorChecks: gatherDoctorChecks
@@ -3896,7 +3897,7 @@ function buildProgram(argv = process.argv) {
     "after",
     "\nRun it in a repository, after `outerlayer login`. With a login, connect lists\nthe factories you can use and takes the first rule that leaves one answer:\n  1. --factory <org>/<factory>, or a factory id\n  2. the factory this repository is already connected to\n  3. the one factory this repository is linked to\n  4. the one factory you can use\n  5. on a terminal, ask; with no terminal, exit 1 and list each --factory value\n\nIt says what it chose and why. The choice is saved in this repository's git\ndirectory (outerlayer/connection.json), shared by every worktree of the\nclone and never committed. A factory key already belongs to one factory, so\nconnect changes nothing for it. Connect never links a repository.\n\nAfter it saves the choice, connect checks that this repository is linked to\nthe factory. If it is not, connect says so, prints the factory's Work page\nlink where you link it, and exits 2. The choice is saved either way. Run\nconnect again once the repository is linked. With --json, the document has\nlinked (true, false, or null when it could not be checked) and, when false,\nlinkUrl.\n"
   ).action(async (opts) => {
-    const { runConnectCommand } = await import('./connect-cmd-JUAW6MU4.js');
+    const { runConnectCommand } = await import('./connect-cmd-JBKAQNSF.js');
     const code = await runConnectCommand({ factory: opts.factory, json: opts.json }, await realConnectDepsForCwd(), {
       stdout: process.stdout,
       stderr: process.stderr
@@ -3939,12 +3940,19 @@ function buildProgram(argv = process.argv) {
     const code = await runLogoutCommand(realLogoutDeps());
     if (code !== 0) process.exitCode = code;
   });
-  program2.command("sync").description("Send local coding-agent sessions to OuterLayer cloud").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").option("--tier <tier>", "capture tier: metrics | redacted | full (default: full)").option("--dry-run", "print what would leave this machine, send nothing").option("--all", "ignore the sync checkpoint and re-send everything").option("--limit <n>", "only the N most recent sessions", (v) => parseInt(v, 10)).option("--json", "machine-readable JSON output").option("--quiet", "no output; exit code only").option("--root <dir>", "Claude Code transcript root (default ~/.claude/projects)").option("--codex-root <dir>", "Codex sessions root (default ~/.codex/sessions)").option("--cursor-root <dir>", "Cursor chats root (default ~/.cursor/chats)").addHelpText(
+  program2.command("sync").description("Send local coding-agent sessions to OuterLayer cloud").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").option("--tier <tier>", "capture tier: metrics | redacted | full (default: full)").option("--dry-run", "print what would leave this machine, send nothing").option("--all", "ignore the sync checkpoint and re-send everything").option("--limit <n>", "only the N most recent sessions", (v) => parseInt(v, 10)).option("--json", "machine-readable JSON output").option("--quiet", "no output; exit code only").option("--link <artifactId>", "print the dashboard link of an artifact already uploaded; sends nothing").option("--root <dir>", "Claude Code transcript root (default ~/.claude/projects)").option("--codex-root <dir>", "Codex sessions root (default ~/.codex/sessions)").option("--cursor-root <dir>", "Cursor chats root (default ~/.cursor/chats)").addHelpText(
     "after",
     "\nIncremental: only sessions newer than the last checkpoint ship. The tier\nis applied on this machine before anything leaves it; `--dry-run` prints\nexactly what would. The hook-triggered background sync runs `--quiet`.\nExit 2 means the server rejected at least one session.\n"
   ).action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runSync, SyncConfigError, SyncTransportError } = await import('./sync-cmd-UWD5JOFU.js');
+    if (opts.link !== void 0) {
+      const { lookupArtifactLink } = await import('./artifact-link-cmd-2F47LT7F.js');
+      const found = lookupArtifactLink(opts.link);
+      if (found.ok) process.stdout.write(found.url + "\n");
+      else fail(found.reason);
+      return;
+    }
+    const { runSync, SyncConfigError, SyncTransportError } = await import('./sync-cmd-GVPPFZ3G.js');
     try {
       const result = await runSync({
         url: opts.url,
@@ -3973,7 +3981,7 @@ function buildProgram(argv = process.argv) {
     if (invokedCommandToken(argv) === "watch") {
       warnDeprecated("`outerlayer watch` is now `outerlayer daemon`; the old name will be removed in a future release.");
     }
-    const { runWatch } = await import('./watch-DBNB7R6X.js');
+    const { runWatch } = await import('./watch-23HSAEI6.js');
     await runWatch({ once: opts.once });
   });
   program2.command("hook <event>", { hidden: true }).description("capture-hook fast path, installed by `init`").action(() => {
@@ -4027,7 +4035,7 @@ function buildProgram(argv = process.argv) {
     }
   });
   program2.command("session-sender", { hidden: true }).description("stream a runner build's sessions to its work item while the build runs").action(async () => {
-    const { runSessionSender } = await import('./session-sender-4M247XSV.js');
+    const { runSessionSender } = await import('./session-sender-FO3LCREV.js');
     try {
       await runSessionSender();
     } catch (err) {
@@ -4062,7 +4070,7 @@ async function runCli(processArgv) {
   await buildProgram(argv).parseAsync(argv);
 }
 async function compileContext(opts) {
-  const { runEmit, EmitError } = await import('./emit-cmd-ZEYWLC2C.js');
+  const { runEmit, EmitError } = await import('./emit-cmd-IJ3GVRFD.js');
   try {
     const result = runEmit({ cwd: opts.dir, check: opts.check, json: opts.json });
     if (result.exitCode !== 0) process.exitCode = result.exitCode;
@@ -4085,7 +4093,7 @@ function registerEmitCommands(program2) {
       return;
     }
     warnIfApiKeyFlag(opts);
-    const { runEmitResult, EmitResultError } = await import('./emit-result-cmd-MUSL7GQA.js');
+    const { runEmitResult, EmitResultError } = await import('./emit-result-cmd-I4OADKMD.js');
     try {
       const result = await runEmitResult({
         name,
@@ -4136,7 +4144,7 @@ locally so it never uploads. One correction can retire several duplicates.
 `
   ).action(async (file, opts) => {
     warnIfApiKeyFlag(opts);
-    const { runEmitArtifact, EmitArtifactError } = await import('./emit-artifact-cmd-FOGNJXVR.js');
+    const { runEmitArtifact, EmitArtifactError } = await import('./emit-artifact-cmd-MPZVR56N.js');
     let pr;
     if (opts.pr !== void 0) {
       pr = parseTrackerNumber(opts.pr);
@@ -4166,12 +4174,12 @@ locally so it never uploads. One correction can retire several duplicates.
       throw err;
     }
   });
-  emitCmd.command("finding").description("Record one finding: a problem you hit in the factory").requiredOption("--id <id>", "client id \u2014 re-emitting the same id replaces it").option("--category <context|flaky-test|tooling|environment|defect|other>", "what kind of problem this is").requiredOption("--title <text>", "one sentence").requiredOption("--file <path>", "the file the problem is in, or the instruction's own path").option("--line <number>", "line number in --file").option("--rule-path <path>", "the instruction's own path \u2014 required for a context finding").option("--rule-line <number>", "line number in --rule-path").option("--rule-quote <text>", "the instruction's quoted sentence \u2014 required unless --rule-relation is missing").option("--rule-relation <wrong|broken|missing>", "how the instruction fails \u2014 required for a context finding").requiredOption("--where <label>", 'where this was recorded, e.g. "build session"').option("--detail <text>", "what happened, a few paragraphs").option("--cause <text>", 'what is actually wrong, or "unknown"').option("--suggestion <text>", "what would help").option("--command <text>", "the command that misbehaved").option("--error <text>", "the first error line").option("--test <name>", "the test name, for a flaky test").option("--symbol <name>", "the function the problem is in, for a defect").option("--started-at <event>", "event id where you first hit the problem (ids are listed when you omit this)").option("--ended-at <event>", "event id where you got past it").option("--problem <id>", "a problem this finding reports; repeat for each one (needs --link-reason)", (value, previous = []) => [...previous, value]).option("--link-reason <text>", "why the finding reports each --problem").option("--new", "record a new problem instead of linking an existing one").option("--trace-id <id>", "the session's trace id, when there is one").option("--turn <number>", "turn index within the session").option("--round <number>", "round number, when there is one").addOption(new Option("--subject <value>").hideHelp()).addOption(new Option("--kind <value>").hideHelp()).addOption(new Option("--severity <value>").hideHelp()).addOption(new Option("--verdict <value>").hideHelp()).addOption(new Option("--fixed").hideHelp()).addOption(new Option("--source <value>").hideHelp()).option("--head-sha <sha>", "the commit this batch was recorded against").option("--context-source-sha <sha>", "the context-source commit this batch was recorded against").option("--item <number>", "work item to record on directly, by its number in this factory").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
+  emitCmd.command("finding").description("Record one finding: a problem you hit in the factory").requiredOption("--id <id>", "client id \u2014 re-emitting the same id replaces it").option("--category <context|flaky-test|tooling|environment|defect|other>", "what kind of problem this is").requiredOption("--title <text>", "one sentence").requiredOption("--file <path>", "the file the problem is in, or the instruction's own path").option("--line <number>", "line number in --file").option("--rule-path <path>", "the instruction's own path \u2014 required for a context finding").option("--rule-line <number>", "line number in --rule-path").option("--rule-quote <text>", "the instruction's quoted sentence \u2014 required unless --rule-relation is missing").option("--rule-relation <wrong|broken|missing>", "how the instruction fails \u2014 required for a context finding").requiredOption("--where <label>", 'where this was recorded, e.g. "build session"').option("--detail <text>", "what happened, a few paragraphs").option("--cause <text>", 'what is actually wrong, or "unknown"').option("--suggestion <text>", "what would help").option("--command <text>", "the command that misbehaved").option("--error <text>", "the first error line").option("--test <name>", "the test name, for a flaky test").option("--symbol <name>", "the function the problem is in, for a defect").option("--started-at <event>", "event id where you hit the problem (default: first output showing --error)").option("--ended-at <event>", "event id where you got past it (default: the newest event)").option("--untimed", "record no time, only when the problem cost none in this session").option("--find <text>", "list this session's events that contain the text, and record nothing").option("--problem <id>", "a problem this finding reports; repeat for each one (needs --link-reason)", (value, previous = []) => [...previous, value]).option("--link-reason <text>", "why the finding reports each --problem").option("--new", "record a new problem instead of linking an existing one").option("--trace-id <id>", "the session's trace id, when there is one").option("--turn <number>", "turn index within the session").option("--round <number>", "round number, when there is one").addOption(new Option("--subject <value>").hideHelp()).addOption(new Option("--kind <value>").hideHelp()).addOption(new Option("--severity <value>").hideHelp()).addOption(new Option("--verdict <value>").hideHelp()).addOption(new Option("--fixed").hideHelp()).addOption(new Option("--source <value>").hideHelp()).option("--head-sha <sha>", "the commit this batch was recorded against").option("--context-source-sha <sha>", "the context-source commit this batch was recorded against").option("--item <number>", "work item to record on directly, by its number in this factory").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
     "after",
-    '\n  outerlayer emit finding --id gate-skip --category tooling \\\n    --title "The pre-push gate prints green when a step was skipped" \\\n    --file scripts/git/pre-push-checks.mjs --where "build session"\n\nRecords one problem you hit in the factory: an instruction that is wrong or\nmissing (context), a flaky test, a misbehaving script (tooling), a local\nsetup trap (environment), a bug outside your own change (defect), or\nanything else. A problem in your own change is fixed, not recorded.\nA context finding needs --rule-path and --rule-relation, and --rule-quote\nunless the relation is missing. Add --cause, --detail and --suggestion, and\n--command, --error (first error line), --test or --symbol when there is one.\n\nEvery finding joins a factory-level problem. When one of its keys matches a\nknown problem it joins that problem. Otherwise nothing is stored: the command\nprints the closest problems and exits with code 3. Run it again with\n--problem <id> --link-reason <why> (repeat --problem for each problem the\nfinding reports), or with --new if none of them is the same problem.\nWithout --started-at and --ended-at it lists your recent session events with\nids and times; name the event where you hit the problem and the one where\nyou got past it to record the time it cost.\n--item names the work item; without it, inside a recorded session, the\nitem that session was launched for is used automatically.\n'
+    '\n  outerlayer emit finding --id gate-skip --category tooling \\\n    --title "The pre-push gate prints green when a step was skipped" \\\n    --file scripts/git/pre-push-checks.mjs --where "build session"\n\nRecords one problem you hit in the factory: an instruction that is wrong or\nmissing (context), a flaky test, a misbehaving script (tooling), a local\nsetup trap (environment), a bug outside your own change (defect), or\nanything else. A problem in your own change is fixed, not recorded.\nA context finding needs --rule-path and --rule-relation, and --rule-quote\nunless the relation is missing. Add --cause, --detail and --suggestion, and\n--command, --error (first error line), --test or --symbol when there is one.\n\nEvery finding joins a factory-level problem. When one of its keys matches a\nknown problem it joins that problem. Otherwise nothing is stored: the command\nprints the closest problems and exits with code 3. Run it again with\n--problem <id> --link-reason <why> (repeat --problem for each problem the\nfinding reports), or with --new if none of them is the same problem.\nA finding records the time it cost, read from two events of your session or\nits subagents. The start is --started-at, else the first tool output that\nshows --error. The end is --ended-at, else the newest event. When the session\nhas events and no start is found, nothing is stored: the command lists the\nrecent events with their ids. --find <text> searches all of them.\n--item names the work item; without it, inside a recorded session, the\nitem that session was launched for is used automatically.\n'
   ).action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runEmitFinding, refuseRemovedFindingFlags, EmitFindingError } = await import('./emit-finding-cmd-DLI4MKMN.js');
+    const { runEmitFinding, refuseRemovedFindingFlags, EmitFindingError } = await import('./emit-finding-cmd-5GF3V4LR.js');
     try {
       refuseRemovedFindingFlags(opts);
       const result = await runEmitFinding({
@@ -4194,6 +4202,8 @@ locally so it never uploads. One correction can retire several duplicates.
         symbol: opts.symbol,
         startedAt: opts.startedAt,
         endedAt: opts.endedAt,
+        untimed: opts.untimed,
+        find: opts.find,
         problem: opts.problem,
         linkReason: opts.linkReason,
         new: opts.new,
@@ -4219,10 +4229,10 @@ locally so it never uploads. One correction can retire several duplicates.
   });
   emitCmd.command("findings <file>").description("Record a batch of findings from a FindingBatch JSON file (- for standard input)").option("--item <number>", "work item to record on directly, by its number in this factory").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
     "after",
-    "\n  outerlayer emit findings review.json --item 412\n\nRecords a whole batch at once \u2014 a FindingBatch JSON file (schemaVersion 3,\noptional headSha / contextSourceSha, and 1-500 findings), validated against\nthe same contract `emit finding` uses before anything is sent. Re-emitting\nan id already on the item replaces that row rather than adding a second one.\nFindings that need a choice between candidate problems are listed and not\nstored; the rest are stored, and the exit code is 3.\n--item names the work item; without it, inside a recorded session, the item\nthat session was launched for is used automatically.\n"
+    '\n  outerlayer emit findings review.json --item 412\n\nRecords a whole batch at once \u2014 a FindingBatch JSON file (schemaVersion 3,\noptional headSha / contextSourceSha, and 1-500 findings), validated against\nthe same contract `emit finding` uses before anything is sent. Re-emitting\nan id already on the item replaces that row rather than adding a second one.\nFindings that need a choice between candidate problems are listed and not\nstored; the rest are stored, and the exit code is 3.\nEach finding records its time as `emit finding` does: "startedAt" is an event\nid, else the first tool output that shows its "error"; "endedAt" defaults to\nthe newest event. A finding with neither, in a session that has events, stops\nthe whole batch. "untimed": true records one with no time on purpose.\n--item names the work item; without it, inside a recorded session, the item\nthat session was launched for is used automatically.\n'
   ).action(async (file, opts) => {
     warnIfApiKeyFlag(opts);
-    const { runEmitFindings, EmitFindingError } = await import('./emit-finding-cmd-DLI4MKMN.js');
+    const { runEmitFindings, EmitFindingError } = await import('./emit-finding-cmd-5GF3V4LR.js');
     try {
       const result = await runEmitFindings({
         file,
@@ -4262,7 +4272,7 @@ session was launched for is used automatically.
 `
   ).action(async (file, opts) => {
     warnIfApiKeyFlag(opts);
-    const { runEmitCriteria, EmitCriteriaError } = await import('./emit-criteria-cmd-HBP6XS5C.js');
+    const { runEmitCriteria, EmitCriteriaError } = await import('./emit-criteria-cmd-EFGYI23V.js');
     try {
       const result = await runEmitCriteria({
         file,
@@ -4289,7 +4299,7 @@ function registerWorkCommands(program2) {
     "\n  outerlayer work build --issue 42                       # a host builds it\n  outerlayer work build --item 7                         # retry an item already on Work\n  outerlayer work build --issue 42 --local               # you build it\n  outerlayer work build --issue ENG-123 --tracker linear # a Linear issue\n\nWithout --local, records a build request: a host takes the item when it\nhas a free slot. It never links the calling session and never takes a\nlease, even run from inside one.\n\nWith --local, puts the item on Work with no build request, so no host\ntakes it, and prints the line that starts your session on it. That\nsession links itself and holds the item's lease while it works.\n"
   ).action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkBuild, WorkCommandError } = await import('./work-cmd-EQSW5DTD.js');
+    const { runWorkBuild, WorkCommandError } = await import('./work-cmd-Z2WXLZPH.js');
     try {
       await runWorkBuild(opts);
     } catch (err) {
@@ -4305,7 +4315,7 @@ function registerWorkCommands(program2) {
     "\n  outerlayer work link-session 42\n\nNames an item that already exists on the calling session \u2014 it never\ncreates one. Create one with `outerlayer work build --local`. Linking\nthe same session to the same item twice is a no-op. Also takes or\nrenews that session's own 20-minute lease, unless --no-lease or\n--ended is given, or another worker already holds a live one.\n"
   ).action(async (number, opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkLinkSession, WorkCommandError } = await import('./work-cmd-EQSW5DTD.js');
+    const { runWorkLinkSession, WorkCommandError } = await import('./work-cmd-Z2WXLZPH.js');
     try {
       await runWorkLinkSession({ ...opts, number, noLease: opts.lease === false, logFailures: opts.logFailures === true });
     } catch (err) {
@@ -4330,8 +4340,8 @@ most one action flag may be given.
 `
   ).action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkComment, WorkCommentCommandError } = await import('./work-comment-cmd-7VLKI7FN.js');
-    const { WorkCommandError } = await import('./work-cmd-EQSW5DTD.js');
+    const { runWorkComment, WorkCommentCommandError } = await import('./work-comment-cmd-AWHP56M2.js');
+    const { WorkCommandError } = await import('./work-cmd-Z2WXLZPH.js');
     try {
       await runWorkComment(opts);
     } catch (err) {
@@ -4347,8 +4357,8 @@ most one action flag may be given.
     "\n  outerlayer work threads --item 7\n\nPrints the item's general thread, then one thread per acceptance\ncriterion that carries proof or a comment, each with who is waiting\non whom next.\n"
   ).action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkThreads, WorkCommentCommandError } = await import('./work-comment-cmd-7VLKI7FN.js');
-    const { WorkCommandError } = await import('./work-cmd-EQSW5DTD.js');
+    const { runWorkThreads, WorkCommentCommandError } = await import('./work-comment-cmd-AWHP56M2.js');
+    const { WorkCommandError } = await import('./work-cmd-Z2WXLZPH.js');
     try {
       await runWorkThreads(opts);
     } catch (err) {
@@ -4370,7 +4380,7 @@ live addition remains on it.
 `
   ).action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkRemove, WorkCommandError } = await import('./work-cmd-EQSW5DTD.js');
+    const { runWorkRemove, WorkCommandError } = await import('./work-cmd-Z2WXLZPH.js');
     try {
       await runWorkRemove(opts);
     } catch (err) {
@@ -4383,7 +4393,7 @@ live addition remains on it.
   });
   workCmd.command("status").description("Show one item's stage, gate ledger, and additions").option("--item <number>", "the item's number inside this factory").option("--issue <number>", "issue number").option("--repo <owner/name>", "repository (default: the current checkout's remote)").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkStatus, WorkCommandError } = await import('./work-cmd-EQSW5DTD.js');
+    const { runWorkStatus, WorkCommandError } = await import('./work-cmd-Z2WXLZPH.js');
     try {
       await runWorkStatus(opts);
     } catch (err) {
@@ -4396,7 +4406,7 @@ live addition remains on it.
   });
   workCmd.command("list").description("List live work items for this factory").option("--stage <spec|build|review>", "filter by stage").option("--section <attention|waiting|flowing>", "filter by Queue section").option("--repo <owner/name>", "repository (default: the current checkout's remote)").option("--unclaimed", "only items with no live lease").option("--claimed", "only items with a live lease, held by a host or a local session").option("--startable", "only items a host can start: a build request, no open PR, no live lease").option("--needs <amend>", "only items with a thread waiting on an agent").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkList, WorkCommandError } = await import('./work-cmd-EQSW5DTD.js');
+    const { runWorkList, WorkCommandError } = await import('./work-cmd-Z2WXLZPH.js');
     try {
       await runWorkList(opts);
     } catch (err) {
@@ -4412,7 +4422,7 @@ live addition remains on it.
     "\n  outerlayer work claim --item 42 --kind implement\n\nRecords a lease held by the API key that sends it. A live lease held\nby a different key is refused; claiming again with the same key extends\nit. --host is a label only.\n"
   ).action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkClaim, WorkCommandError } = await import('./work-claim-cmd-A6IS6CQ7.js');
+    const { runWorkClaim, WorkCommandError } = await import('./work-claim-cmd-LKL3GHFQ.js');
     try {
       await runWorkClaim(opts);
     } catch (err) {
@@ -4428,7 +4438,7 @@ live addition remains on it.
     "\n  outerlayer work renew --item 42\n\nExtends the live lease this API key holds. Refused with a 410 if the\nlease has expired, or a 403 if a different key holds it.\n"
   ).action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkRenew, WorkCommandError } = await import('./work-claim-cmd-A6IS6CQ7.js');
+    const { runWorkRenew, WorkCommandError } = await import('./work-claim-cmd-LKL3GHFQ.js');
     try {
       await runWorkRenew(opts);
     } catch (err) {
@@ -4447,7 +4457,7 @@ live addition remains on it.
     "\n  outerlayer work release --item 42 --outcome ok\n  outerlayer work release --item 42\n\nMarks the lease this API key holds released, optionally with an\noutcome. A lease held by a different key is refused. Releasing an\nalready-released lease is a no-op that returns the recorded release\ntime and outcome.\n\nRun inside a session with no --host, it releases that session's own\nlease instead, so the item's review opens without ending the\nsession. It never releases another session's lease. --outcome\napplies to a host's lease only. A later tool call in the session\ntakes the lease again.\n"
   ).action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkRelease, WorkCommandError } = await import('./work-claim-cmd-A6IS6CQ7.js');
+    const { runWorkRelease, WorkCommandError } = await import('./work-claim-cmd-LKL3GHFQ.js');
     try {
       await runWorkRelease(opts);
     } catch (err) {
@@ -4463,7 +4473,7 @@ live addition remains on it.
     "\n  outerlayer work pr 481\n  outerlayer work pr 481 --withdraw --item 250\n\nRun inside a session already on a work item. Records that pull\nrequest 481 in the checkout's repository belongs to the item named by\nOUTERLAYER_WORK, or refuses when the session is not on it. The same\nfact a `pr-link` in the session's own transcript records on sync.\nIdempotent: declaring the same pull request twice is a no-op.\n\n--withdraw removes one item's declaration of the pull request. It\nneeds your own login; an agent session or a factory key is refused.\n"
   ).action(async (number, opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkPr, WorkPrCommandError } = await import('./work-pr-cmd-L77K32WK.js');
+    const { runWorkPr, WorkPrCommandError } = await import('./work-pr-cmd-HNEUIEN7.js');
     try {
       await runWorkPr({ ...opts, number });
     } catch (err) {
@@ -4479,8 +4489,8 @@ live addition remains on it.
     '\n  outerlayer work open-pr --title "Add the thing" --body-file pr.md\n  outerlayer work open-pr --repository acme/web --title "Add the thing" --body-file pr.md\n\nIn a host build, which holds an item key, the gateway opens the pull\nrequest as the factory\'s GitHub App, from the branch the claim named,\nor edits the one already open on that branch. No gh command runs.\nIn your own session it runs `gh pr create` (or `gh pr edit`) under your\nlogin, then declares the pull request on the item, as `work pr` does.\nRun it again after a change to the title or description.\n'
   ).action(async (opts) => {
     warnIfApiKeyFlag(opts);
-    const { runWorkOpenPr, WorkOpenPrCommandError } = await import('./work-open-pr-cmd-JEVD4HMQ.js');
-    const { WorkCommandError } = await import('./work-cmd-EQSW5DTD.js');
+    const { runWorkOpenPr, WorkOpenPrCommandError } = await import('./work-open-pr-cmd-IOM4AVQQ.js');
+    const { WorkCommandError } = await import('./work-cmd-Z2WXLZPH.js');
     try {
       await runWorkOpenPr(opts);
     } catch (err) {
@@ -4497,7 +4507,7 @@ function registerRunnerCommands(program2) {
   const configOption = "the cloud config file to run against (default: ~/.outerlayer/config.json)";
   runnerCmd.command("start").description("Run the loop: claim work, run it, report, clean up, repeat").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-N3C6DFQA.js');
-    const { start, RunnerStartError } = await import('./loop-QNSM5GXS.js');
+    const { start, RunnerStartError } = await import('./loop-FK3LPMMZ.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-UZRH774M.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     try {
@@ -4513,7 +4523,7 @@ function registerRunnerCommands(program2) {
   });
   runnerCmd.command("check").description("Validate the config, the hooks and the key, and print the effective settings").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-N3C6DFQA.js');
-    const { runRunnerCheck } = await import('./check-2JSSXCKJ.js');
+    const { runRunnerCheck } = await import('./check-5XE7XMC4.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const result = await runRunnerCheck(configPath);
     if (!result.ok) {
@@ -4542,7 +4552,7 @@ function registerRunnerCommands(program2) {
     }
     try {
       if (opts.service === true) {
-        const { installServiceCommand } = await import('./command-ETUAEXP2.js');
+        const { installServiceCommand } = await import('./command-R2QCVX55.js');
         const result2 = await installServiceCommand({
           configPath,
           print: opts.print,
@@ -4598,22 +4608,22 @@ To keep it running, run ${C.yellow}outerlayer runner install --service${C.reset}
       return;
     }
     const { defaultRunnerConfigPath } = await import('./config-N3C6DFQA.js');
-    const { uninstallServiceCommand } = await import('./command-ETUAEXP2.js');
+    const { uninstallServiceCommand } = await import('./command-R2QCVX55.js');
     const result = await uninstallServiceCommand({ configPath: opts.config ?? defaultRunnerConfigPath(), unitName: opts.unitName, home: homeFromEnv() });
     if (result.ok) for (const line of result.lines) process.stdout.write(`${C.green}\u2713${C.reset} ${line}
 `);
     else fail(result.lines.length > 0 ? result.lines.join("\n  ") : "the service was not removed");
   });
-  runnerCmd.command("init").description("Write a runner block that fits this machine; on macOS, offers a Linux VM").option("--config <path>", configOption).option("--vm", "on macOS, run the runner in a Linux VM (Lima), with container builds").option("--no-vm", "on macOS, skip the VM and run builds as unisolated processes").option("--allow-process-builds", "where builds cannot be isolated, run them as processes anyway").addOption(new Option("--config-stdin", "the VM-side hand-off: read the whole config as JSON on stdin").hideHelp()).option("--vm-cli-package <path>", "with --vm, install this packed CLI tarball in the VM").option("--unit-name <name>", "the service unit's name, to run a second runner beside the first").option("--agent <name>", "write commands that start this agent (claude); its credential comes on stdin").option("--app-id <id>", "factory id to create the runner key on, when it comes from your login").option("--key-name <name>", "name of the runner key created from your login (default: machine name)").addHelpText(
+  runnerCmd.command("init").description("Write a runner block that fits this machine; on macOS, offers a Linux VM").option("--config <path>", configOption).option("--vm", "on macOS, run the runner in a Linux VM (Lima), with container builds").option("--no-vm", "on macOS, skip the VM and run builds as unisolated processes").option("--allow-process-builds", "where builds cannot be isolated, run them as processes anyway").addOption(new Option("--config-stdin", "the VM-side hand-off: read the whole config as JSON on stdin").hideHelp()).option("--vm-cli-package <path>", "with --vm, install this packed CLI tarball in the VM").option("--unit-name <name>", "the service unit's name, to run a second runner beside the first").option("--agent <name>", "write commands that start this agent (claude); its credential comes on stdin").option("--factory <org/factory>", "factory to create the runner key on, as <org>/<factory>").option("--app-id <id>", "factory id, instead of --factory (Settings \u2192 General)").addHelpText(
     "after",
-    "\nWith no apiKey in the config file, and a login saved by `outerlayer login`,\nrunner init creates the runner key itself, with the Runner preset, on the\nfactory --app-id names (or OUTERLAYER_APP_ID, or this repository's\nconnection). Your login needs factory_keys.insert on that factory.\n\nWith --agent claude, the queue commands start Claude Code instead of the\nplaceholder, and Claude's credential is read from stdin: a token from\n`claude setup-token` (sk-ant-oat...) or an API key (sk-ant-api...). It is\nnever printed, and is stored in the runner.env beside the config with mode\n600. Other lines in the file are kept. With nothing piped, a credential\nalready in runner.env is used.\n\n  printf '%s' \"$CLAUDE_CODE_OAUTH_TOKEN\" | outerlayer runner init --agent claude\n"
+    "\nWith no apiKey in the config file, and a login saved by `outerlayer login`,\nrunner init names the factory the runner is for: --factory, then --app-id,\nOUTERLAYER_APP_ID, or this repository's connection. With none of those, a\nlogin that can use one factory uses it, and one that can use several lists\nthem. It then prints the factory's API keys page, where you create a key with\nthe Runner preset, and asks you to paste it. Nothing is shown as you paste.\nWith no terminal to ask on, it stops and says what to put in the config file.\n\nWith --agent claude, the queue commands start Claude Code instead of the\nplaceholder, and Claude's credential is read from stdin: a token from\n`claude setup-token` (sk-ant-oat...) or an API key (sk-ant-api...). It is\nnever printed, and is stored in the runner.env beside the config with mode\n600. Other lines in the file are kept. With nothing piped, a credential\nalready in runner.env is used.\n\n  printf '%s' \"$CLAUDE_CODE_OAUTH_TOKEN\" | outerlayer runner init --agent claude --factory <org>/<factory>\n"
   ).action(async (opts) => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-N3C6DFQA.js');
-    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-OPB7HHXO.js');
-    const { createRunnerKey, runnerKeyLogin } = await import('./runner-key-7SSNMUBQ.js');
-    const { detectMachine } = await import('./machine-IT6GG7FF.js');
-    const { chooseVm, runVmInit, VmInitError } = await import('./init-MIC37V6J.js');
-    const { AGENT_COMMANDS, credentialFromStdin, isAgentName, restartForCredential, RunnerEnvError } = await import('./runner-env-XTC53CHN.js');
+    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-6XPDRDTC.js');
+    const { obtainRunnerKey, runnerKeyLogin } = await import('./runner-key-6SLBI7PP.js');
+    const { detectMachine } = await import('./machine-SQXEBAM2.js');
+    const { chooseVm, runVmInit, VmInitError } = await import('./init-PWU5YVL7.js');
+    const { AGENT_COMMANDS, credentialFromStdin, isAgentName, restartForCredential, RunnerEnvError } = await import('./runner-env-EN7YE7QX.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     if (opts.agent !== void 0 && !isAgentName(opts.agent)) {
       fail(`--agent ${opts.agent}: runner init writes commands for ${Object.keys(AGENT_COMMANDS).join(", ")}. For another agent, leave --agent out and edit runner.commands.`);
@@ -4637,8 +4647,8 @@ To keep it running, run ${C.yellow}outerlayer runner install --service${C.reset}
       }
       const machine = detectMachine();
       if (opts.configStdin === true) {
-        if (opts.appId !== void 0 || opts.keyName !== void 0) {
-          fail("the VM-side hand-off carries its runner key in its config on stdin; pass no --app-id or --key-name with it.");
+        if (opts.appId !== void 0 || opts.factory !== void 0) {
+          fail("the VM-side hand-off carries its runner key in its config on stdin; pass no --app-id or --factory with it.");
           return;
         }
         const chunks = [];
@@ -4653,14 +4663,13 @@ hooks: ${result2.hooks}
 `);
         return;
       }
-      const login = runnerKeyLogin(configPath, { appId: opts.appId });
-      if (login === void 0 && opts.keyName !== void 0) {
-        fail(
-          `--key-name names the runner key runner init creates from your login, and it creates none here: ${configPath} already has an apiKey, or no login is saved. Run \`outerlayer login\` first, or leave --key-name out.`
-        );
-        return;
-      }
-      const makeKey = login === void 0 ? void 0 : () => createRunnerKey(login, { name: opts.keyName });
+      const login = await runnerKeyLogin(configPath, { appId: opts.appId, factory: opts.factory });
+      if (login?.note !== void 0) process.stdout.write(`${login.note}
+`);
+      const { terminalPrompt } = await import('./hidden-prompt-UXBFMQC5.js');
+      const readKey = login === void 0 ? void 0 : terminalPrompt();
+      if (login !== void 0 && readKey === void 0) await obtainRunnerKey(login, { configPath, readKey });
+      const makeKey = login === void 0 ? void 0 : () => obtainRunnerKey(login, { configPath, readKey });
       let declinedVm = opts.vm === false;
       const useVm = await chooseVm({
         platform: machine.platform,
@@ -4695,6 +4704,8 @@ hooks: ${result2.hooks}
 `)
         });
         for (const line of result2.lines) process.stdout.write(`${C.green}\u2713${C.reset} ${line}
+`);
+        for (const line of result2.warnings) process.stdout.write(`${C.yellow}!${C.reset} ${line}
 `);
         return;
       }
@@ -4705,7 +4716,7 @@ hooks: ${result2.hooks}
       const { ensureHostKey } = await import('./host-key-YMLXY6QB.js');
       const hostKey = await ensureHostKey(configPath);
       if (created !== void 0) {
-        process.stdout.write(`${C.green}\u2713${C.reset} created the runner key ${created.name} from your login, with the Runner preset, and saved it in ${result.configPath}
+        process.stdout.write(`${C.green}\u2713${C.reset} saved the runner key in ${result.configPath}
 `);
       }
       process.stdout.write(`${C.green}\u2713${C.reset} wrote a runner block into ${result.configPath}
@@ -4762,7 +4773,7 @@ ${C.yellow}The runner will not update itself: ${installErr.message}${C.reset}
       let serviceUp = false;
       let restart;
       if (installedLayout) {
-        const { installServiceCommand } = await import('./command-ETUAEXP2.js');
+        const { installServiceCommand } = await import('./command-R2QCVX55.js');
         const service = await installServiceCommand({
           configPath,
           entryPath: process.argv[1] ?? "",
@@ -4873,15 +4884,15 @@ Next:
   });
   runnerCmd.command("stop").description("Take no more work; wait for running jobs to finish, then exit").option("--config <path>", "the cloud config file naming the runner to stop").option("--now", "end running jobs immediately, with outcome stopped").action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-N3C6DFQA.js');
-    const { requestStop } = await import('./loop-QNSM5GXS.js');
+    const { requestStop } = await import('./loop-FK3LPMMZ.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     await requestStop(configPath, Boolean(opts.now));
   });
   runnerCmd.command("status").description("List running jobs; with --recent, finished ones too").option("--config <path>", "the cloud config file naming the runner to inspect").option("--recent", "also list finished jobs, newest first, capped at 20").option("--json", "machine-readable JSON output").action(async (opts) => {
     const { defaultRunnerConfigPath, loadRunnerConfig } = await import('./config-N3C6DFQA.js');
     const { jobsDir, runnerDir } = await import('./paths-OYKMVYJP.js');
-    const { listJobFiles, runnerProcessState } = await import('./loop-QNSM5GXS.js');
-    const { renderStatus } = await import('./status-7ZX57OFJ.js');
+    const { listJobFiles, runnerProcessState } = await import('./loop-FK3LPMMZ.js');
+    const { renderStatus } = await import('./status-7VNQN5PW.js');
     const { readHousekeepingRecord } = await import('./record-C43U4PKS.js');
     const path2 = await import('path');
     const configPath = opts.config ?? defaultRunnerConfigPath();
@@ -4937,7 +4948,7 @@ Next:
   });
   runnerCmd.command("logs").argument("<item>", "the work item's number in the factory").description("Print the newest attempt's log for one item").option("--config <path>", "the cloud config file naming the runner to inspect").option("-f, --follow", "keep printing as the log grows").action(async (itemArg, opts) => {
     const { defaultRunnerConfigPath } = await import('./config-N3C6DFQA.js');
-    const { listJobFiles } = await import('./loop-QNSM5GXS.js');
+    const { listJobFiles } = await import('./loop-FK3LPMMZ.js');
     const { newestAttempt, logPathFor, tail, RunnerLogsError } = await import('./logs-H55NWW4H.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const item = parseTrackerNumber(itemArg);
@@ -5194,7 +5205,7 @@ function registerMcpCommands(program2) {
 function registerImportCommands(program2) {
   const importCmd = program2.command("import").description("Import an existing config format into .outerlayer/");
   importCmd.command("ruler").description("Port a .ruler/ tree into the equivalent .outerlayer/ tree").option("--dir <path>", "repo root to read from (default: cwd)").option("--json", "machine-readable JSON output").addHelpText("after", "\nRuler: https://github.com/intellectronica/ruler. Mostly a rename.\n").action(async (opts) => {
-    const { runImportRuler, ImportRulerError } = await import('./import-ruler-cmd-KLRGRBCP.js');
+    const { runImportRuler, ImportRulerError } = await import('./import-ruler-cmd-BGAZXCQM.js');
     try {
       const result = runImportRuler({ cwd: opts.dir, json: opts.json });
       if (result.exitCode !== 0) process.exitCode = result.exitCode;
@@ -5208,9 +5219,9 @@ function registerImportCommands(program2) {
   });
   importCmd.command("capture").description("Install the maintained skills into .outerlayer/").option("--dir <path>", "repo root to write into (default: cwd)").option("--json", "machine-readable JSON output").addHelpText(
     "after",
-    "\nInstalls the four maintained skills (emitting-evidence, amend,\nreporting-findings, outerlayer) and an AGENTS.md snippet teaching agents to run\n`emit artifact`. A skill that differs from this CLI's bundle is rewritten to it, and the output says so.\n"
+    "\nInstalls the four maintained skills (outerlayer-evidence, outerlayer-amend,\nouterlayer-findings, outerlayer-cli) and an AGENTS.md snippet teaching agents to run\n`emit artifact`. A skill that differs from this CLI's bundle is rewritten to it, and the output says so.\n"
   ).action(async (opts) => {
-    const { runImportCapture, ImportCaptureError } = await import('./import-capture-cmd-6QVCOIHK.js');
+    const { runImportCapture, ImportCaptureError } = await import('./import-capture-cmd-EQ35EARA.js');
     try {
       runImportCapture({ cwd: opts.dir, json: opts.json });
     } catch (err) {
@@ -5248,12 +5259,12 @@ function registerContextCommands(program2) {
   const contextCmd = program2.command("context").description("Compile and materialize agent context");
   contextCmd.command("emit").description("Compile .outerlayer/ into each configured target tool's native files").option("--check", "compare against disk, write nothing, exit 1 on drift (CI mode)").option("--dir <path>", "repo root to read from (default: cwd)").option("--json", "machine-readable JSON output").addHelpText(
     "after",
-    '\nTargets come from .outerlayer/config.json only; there is no --target flag.\nMissing or empty config: {"targets": [...]}, e.g. {"targets": ["claude-code"]}.\nKnown targets: claude-code, cursor, codex, copilot, factory.\n\nThe maintained skills (emitting-evidence, amend, reporting-findings, outerlayer)\nfollow this CLI: emit rewrites one that differs from its bundle, and --check reports it as\ndrift. Templates (spec, writing-specs, writing-tests, build) are never rewritten or reported.\n\nOrphan detection (--check) only covers header-carrying outputs: every markdown\ntarget file gets a generated-by comment, but .mcp.json and .cursor/mcp.json are\nJSON with no comment syntax, so they can never be flagged as orphaned; missing\nand content drift still apply to them.\n'
+    '\nTargets come from .outerlayer/config.json only; there is no --target flag.\nMissing or empty config: {"targets": [...]}, e.g. {"targets": ["claude-code"]}.\nKnown targets: claude-code, cursor, codex, copilot, factory.\n\nThe maintained skills (outerlayer-evidence, outerlayer-amend, outerlayer-findings,\nouterlayer-cli) follow this CLI: emit rewrites one that differs from its bundle, and --check\nreports it as drift. A copy under an earlier name (amend, emitting-evidence,\nreporting-findings, outerlayer) is deleted, and --check reports it as retired.\nTemplates (spec, writing-specs, writing-tests, build) are never rewritten or reported.\n\nOrphan detection (--check) only covers header-carrying outputs: every markdown\ntarget file gets a generated-by comment, but .mcp.json and .cursor/mcp.json are\nJSON with no comment syntax, so they can never be flagged as orphaned; missing\nand content drift still apply to them.\n'
   ).action(async (opts) => {
     await compileContext({ dir: opts.dir, check: opts.check, json: opts.json });
   });
   contextCmd.command("adopt <stagedDir>", { hidden: true }).description("Copy context the runner staged into this checkout (container builds)").option("--json", "machine-readable JSON output").action(async (stagedDir) => {
-    const { runContextAdopt } = await import('./context-adopt-PJUMW2EZ.js');
+    const { runContextAdopt } = await import('./context-adopt-NFHCLVUB.js');
     const { exitCode, stdout } = runContextAdopt(stagedDir, process.cwd());
     process.stdout.write(stdout);
     process.exitCode = exitCode;
@@ -5262,7 +5273,7 @@ function registerContextCommands(program2) {
     "after",
     "\nThe same flow SessionStart runs automatically, exposed for a manual retry or a\nfirst check outside a session. Writes AGENTS.md, .claude/**, and .outerlayer/**.\n"
   ).action(async (opts) => {
-    const { materializeContext } = await import('./context-materialize-FDHYKNDT.js');
+    const { materializeContext } = await import('./context-materialize-IV2TUUFO.js');
     const result = await materializeContext({ cwd: process.cwd(), sessionId: `manual-${Date.now()}` });
     const output = formatContextMaterializeOutput(result);
     if (output.exitCode !== void 0) process.exitCode = output.exitCode;

package/dist/{command-ETUAEXP2.js → command-R2QCVX55.js}

@@ -5,14 +5,14 @@ import { runRunnerInstall, launcherSummary, restartNote } from './chunk-ERI5GBNI
 import './chunk-I2UOAV7X.js';
 import './chunk-PTW6W5NR.js';
 import { currentLink, execStartCommand } from './chunk-TI7B7UEO.js';
-import { detectMachine } from './chunk-Z3NOIFDR.js';
-import './chunk-UUDDPNRJ.js';
+import { detectMachine } from './chunk-ONKJUM6R.js';
+import './chunk-MAK5LYRF.js';
 import './chunk-KMDLFI4P.js';
 import './chunk-QKFB4K7X.js';
 import './chunk-RSNSZ2LJ.js';
 import { installService, uninstallService, realTaskScheduler } from './chunk-RLYZLUQ7.js';
-import './chunk-JR6ERP3M.js';
-import './chunk-NPQWKGUA.js';
+import './chunk-S3NYLI2P.js';
+import './chunk-6Y5RUTHO.js';
 import './chunk-IP7BIBXJ.js';
 import { runnerVmOf, loadRunnerConfig } from './chunk-22RMZBGW.js';
 import './chunk-UXYLWVTQ.js';
@@ -26,20 +26,21 @@ import './chunk-4NPZVMJU.js';
 import './chunk-7RQ73DLO.js';
 import './chunk-4Q7OMKAT.js';
 import './chunk-CX22S5BA.js';
-import './chunk-YDSMROTB.js';
+import './chunk-3NSNIIBE.js';
 import './chunk-WUYTWNMA.js';
 import './chunk-JXYVA45C.js';
 import './chunk-4KSQKQXE.js';
 import './chunk-N6LURUEF.js';
 import './chunk-YRYMNBGQ.js';
 import './chunk-WZBHBH3J.js';
-import './chunk-3NLOVYJQ.js';
-import './chunk-LCEXHCHD.js';
+import './chunk-YZ5F4PIS.js';
+import './chunk-WTE3MQML.js';
+import './chunk-C5Y5ZJJZ.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-YO4PSLVB.js';
 import './chunk-BYT5O5RV.js';
-import './chunk-ZA5CHAFY.js';
-import './chunk-2M63GG56.js';
+import './chunk-POJMEEJJ.js';
+import './chunk-OHVJA253.js';
 import './chunk-PLMTLGYH.js';
 import './chunk-J5M7BSJQ.js';
 import './chunk-EABW6AJQ.js';