@outerlayer/cli 0.17.0 → 0.18.0

package/dist/{chunk-HGECYFEI.js → chunk-Y5GE76XC.js}

@@ -1,21 +1,23 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { checkStarterFiles, contextIsGoverned } from './chunk-NBGDBTO2.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-S3NYLI2P.js';
-import { readStatuslineState, STATE_FRESH_MS } from './chunk-F47JBIAW.js';
-import { isLinkedRepository } from './chunk-3NSNIIBE.js';
-import { sanitizeTerminal } from './chunk-WUYTWNMA.js';
-import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-JXYVA45C.js';
-import { C } from './chunk-YRYMNBGQ.js';
+import { checkStarterFiles, contextIsGoverned } from './chunk-ESC6UR76.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-KK4VBOH6.js';
+import { isLinkedRepository } from './chunk-S76AYB4M.js';
+import { sanitizeTerminal } from './chunk-MQJSXHV7.js';
+import { readStatuslineState, STATE_FRESH_MS } from './chunk-DSF2FWAZ.js';
+import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-BMYGAGBJ.js';
+import { C } from './chunk-ANPNT6PM.js';
 import { readSettings, settingsPath, isOurStatuslineSlot, statuslineWrappedOriginal, REGISTERED_EVENTS, isOurHookCommand, ourCommandBins, cliBinResolvable, ourDirectScriptBins, wrappedOriginalCommand } from './chunk-5QRP3MVS.js';
-import { readPin, readContextManifest, readDegraded, readSourceCache } from './chunk-WTE3MQML.js';
-import { checkFormerSkillNames } from './chunk-C5Y5ZJJZ.js';
-import { defaultFetch } from './chunk-YO4PSLVB.js';
-import { resolveGatewayCredentials } from './chunk-PLMTLGYH.js';
+import { readPin, readContextManifest, readDegraded, readSourceCache } from './chunk-LXAY4A2G.js';
+import { checkFormerSkillNames } from './chunk-T4Y6SCG3.js';
+import { defaultFetch } from './chunk-ZRL6HKBY.js';
+import { resolveGatewayCredentials } from './chunk-52NC2FIU.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
-import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-BWQ66M6N.js';
+import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-ULSIJGLS.js';
+import { hookCommandEscapesControlPlane, CONTROL_PLANE_DIR_VARIABLE } from './chunk-G2YNJIGF.js';
 import { deadHooksState, preparePackageManagerCommand, contextExcludesPresent } from './chunk-XCCLFVXM.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
+import { cliInvocation } from './chunk-CRB3POP4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync, existsSync, accessSync, constants, statSync, readdirSync, realpathSync } from 'fs';
 import { join, dirname, resolve, delimiter } from 'path';
@@ -193,6 +195,8 @@ function runDoctor(env = {}) {
     ...laptop ? checkRenamedSkills(env.cwd) : [],
     ...starter !== void 0 && !starter.mcpOutdated ? checkMcpCommand(env.cwd, env.processEnv) : [],
     ...checkContextSource(home, env.cwd),
+    ...checkGovernsList(env.cwd),
+    ...checkControlPlaneHooks(env.cwd),
     ...checkInstalledCli(home, env.cwd ?? process.cwd())
   ];
 }
@@ -275,11 +279,11 @@ function checkStatusline(home, now, cwd) {
         name,
         status: "warn",
         detail: `the OuterLayer segment was installed (recorded ${record.updatedAt}) but the slot no longer holds it \u2014 settings were rewritten or reset${record.original !== void 0 ? `; it wrapped: ${record.original}` : ""}`,
-        fix: "Run `outerlayer init` to reinstall the segment."
+        fix: `Run \`${cliInvocation()} init\` to reinstall the segment.`
       }];
     }
     return [
-      foreign !== void 0 ? { name, status: "warn", detail: `slot occupied by: ${foreign}`, fix: "Run `outerlayer init` to add the OuterLayer segment (wraps the existing command, never replaces it)." } : { name, status: "warn", detail: "not installed", fix: "Run `outerlayer init`." }
+      foreign !== void 0 ? { name, status: "warn", detail: `slot occupied by: ${foreign}`, fix: `Run \`${cliInvocation()} init\` to add the OuterLayer segment (wraps the existing command, never replaces it).` } : { name, status: "warn", detail: "not installed", fix: `Run \`${cliInvocation()} init\`.` }
     ];
   }
   const checks = [
@@ -288,12 +292,12 @@ function checkStatusline(home, now, cwd) {
   const stateName = "Status-line state";
   const state = readStatuslineState(home);
   if (!state) {
-    checks.push({ name: stateName, status: "warn", detail: "no state file \u2014 line runs degraded (session cost only)", fix: "Start `outerlayer daemon` (it maintains this file)." });
+    checks.push({ name: stateName, status: "warn", detail: "no state file \u2014 line runs degraded (session cost only)", fix: `Start \`${cliInvocation()} daemon\` (it maintains this file).` });
     return checks;
   }
   const age = now() - Date.parse(state.generatedAt);
   if (!Number.isFinite(age) || age > STATE_FRESH_MS) {
-    checks.push({ name: stateName, status: "warn", detail: `state ${formatAgo(age)} \u2014 line runs degraded`, fix: "Restart `outerlayer daemon`." });
+    checks.push({ name: stateName, status: "warn", detail: `state ${formatAgo(age)} \u2014 line runs degraded`, fix: `Restart \`${cliInvocation()} daemon\`.` });
     return checks;
   }
   checks.push({ name: stateName, status: "pass", detail: `fresh (${formatAgo(age)})` });
@@ -339,7 +343,7 @@ function checkTranscripts(transcripts, now) {
     return { name: "Transcripts", status: "warn", detail: "no projects directory yet", fix: "Run a Claude Code session, then re-check." };
   }
   if (transcripts.count === 0) {
-    return { name: "Transcripts", status: "warn", detail: "0 transcripts found", fix: "Run a Claude Code session, then run `outerlayer doctor` again." };
+    return { name: "Transcripts", status: "warn", detail: "0 transcripts found", fix: `Run a Claude Code session, then run \`${cliInvocation()} doctor\` again.` };
   }
   const age = formatAgeH(now() - transcripts.newest);
   return { name: "Transcripts", status: "pass", detail: `${transcripts.count} transcripts, newest ${age}` };
@@ -402,7 +406,7 @@ function checkHooksInstalled(home, cwd, firingFresh) {
           name,
           status: "fail",
           detail: `hooks in ${path} run ${missing.join(", ")}, which no longer exists \u2014 no session is being captured`,
-          fix: "Run `outerlayer init` to reinstall."
+          fix: `Run \`${cliInvocation()} init\` to reinstall.`
         };
       }
       const unexecutable = ourDirectScriptBins(settings).filter((bin) => !isExecutable(bin));
@@ -411,13 +415,13 @@ function checkHooksInstalled(home, cwd, firingFresh) {
           name,
           status: "fail",
           detail: `hooks in ${path} run ${unexecutable.join(", ")} directly, and it is not executable \u2014 every hook fails with "Permission denied" and no session is linked to its work item`,
-          fix: "Run `outerlayer init` to rewrite the hooks so they run through node."
+          fix: `Run \`${cliInvocation()} init\` to rewrite the hooks so they run through node.`
         };
       }
       return { name, status: "pass", detail: `${installed.join(", ")} (${scope})` };
     }
     if (installed.length > 0) {
-      return { name, status: "warn", detail: `only ${installed.join(", ")} installed`, fix: "Run `outerlayer init` to (re)install all lifecycle hooks." };
+      return { name, status: "warn", detail: `only ${installed.join(", ")} installed`, fix: `Run \`${cliInvocation()} init\` to (re)install all lifecycle hooks.` };
     }
   }
   const manifest = readManifest(home);
@@ -428,13 +432,13 @@ function checkHooksInstalled(home, cwd, firingFresh) {
       name,
       status: "fail",
       detail: `hooks were installed into ${recorded} (recorded ${record.updatedAt}) but the settings file no longer contains them \u2014 it was rewritten or reset`,
-      fix: "Run `outerlayer init` to reinstall."
+      fix: `Run \`${cliInvocation()} init\` to reinstall.`
     };
   }
   if (firingFresh) {
     return { name, status: "pass", detail: "not in user/project settings, but hooks are firing \u2014 installed in another scope (managed settings?)" };
   }
-  return { name, status: "fail", detail: "no OuterLayer hooks found", fix: "Run `outerlayer init`." };
+  return { name, status: "fail", detail: "no OuterLayer hooks found", fix: `Run \`${cliInvocation()} init\`.` };
 }
 function checkWrappedHooks(home, cwd) {
   const manifest = readManifest(home);
@@ -469,7 +473,7 @@ function checkWrappedHooks(home, cwd) {
     name: "Wrapped hooks",
     status: "warn",
     detail: `recorded as wrapped but the settings no longer carry the wrapped form \u2014 ${missing.join("; ")}`,
-    fix: "Run `outerlayer hooks wrap` to re-wrap, or `outerlayer hooks unwrap` if the wrap is no longer wanted."
+    fix: `Run \`${cliInvocation()} hooks wrap\` to re-wrap, or \`${cliInvocation()} hooks unwrap\` if the wrap is no longer wanted.`
   };
 }
 function checkHooksFiring(transcripts, lastFired, now) {
@@ -488,7 +492,7 @@ function checkHooksFiring(transcripts, lastFired, now) {
       name,
       status: "fail",
       detail: `sessions as recent as ${formatAgeH(now() - transcripts.newest)}, but no lifecycle hook has fired since ${formatAgeH(now() - lastFired)}`,
-      fix: "Hooks are configured but not running \u2014 run `outerlayer init` and check `claude --debug` hook output."
+      fix: `Hooks are configured but not running \u2014 run \`${cliInvocation()} init\` and check \`claude --debug\` hook output.`
     };
   }
   return { name, status: "pass", detail: `last fired ${formatAgeH(now() - lastFired)}` };
@@ -504,7 +508,7 @@ function checkDeadHooksState(cwd) {
         name,
         status: "fail",
         detail: `${sanitizeForContext(state.hooksDir)} could not be read (${state.unreadableError.code ?? state.unreadableError.message}) \u2014 git's hooks status is unknown, not confirmed healthy`,
-        fix: "Fix the directory's permissions so it can be listed, then re-run `outerlayer doctor`."
+        fix: `Fix the directory's permissions so it can be listed, then re-run \`${cliInvocation()} doctor\`.`
       }
     ];
   }
@@ -536,15 +540,15 @@ function checkSpoolWritable(home) {
 function checkLastSync(home, now) {
   const name = "Cloud sync";
   if (!existsSync(join(home, ".outerlayer", "config.json"))) {
-    return { name, status: "warn", detail: "not configured \u2014 sessions stay on this machine", fix: "Run `outerlayer login` to connect." };
+    return { name, status: "warn", detail: "not configured \u2014 sessions stay on this machine", fix: `Run \`${cliInvocation()} login\` to connect.` };
   }
   const health = assessSyncHealth(readSyncStatus(home), now(), SYNC_STALE_AFTER_MS);
   const detail = [health.headline, ...health.details].join("; ");
   if (health.level === "error") {
-    return { name, status: "fail", detail, fix: "Check the destination and API key in ~/.outerlayer/config.json, then run `outerlayer sync` to see the full error." };
+    return { name, status: "fail", detail, fix: `Check the destination and API key in ~/.outerlayer/config.json, then run \`${cliInvocation()} sync\` to see the full error.` };
   }
   if (health.level === "warn" || health.level === "unknown") {
-    return { name, status: "warn", detail, fix: "Run `outerlayer sync` to confirm the connection works." };
+    return { name, status: "warn", detail, fix: `Run \`${cliInvocation()} sync\` to confirm the connection works.` };
   }
   return { name, status: "pass", detail };
 }
@@ -552,17 +556,17 @@ function checkDaemon(home) {
   const pidfile = join(home, ".outerlayer", "daemon.pid");
   const heartbeat = join(home, ".outerlayer", "daemon.heartbeat");
   if (!existsSync(pidfile)) {
-    return { name: "Daemon running", status: "warn", detail: "not running", fix: "Start it with `outerlayer daemon` (or a login agent)." };
+    return { name: "Daemon running", status: "warn", detail: "not running", fix: `Start it with \`${cliInvocation()} daemon\` (or a login agent).` };
   }
   try {
     const beatMs = statSync(heartbeat).mtimeMs;
     const staleMin = (Date.now() - beatMs) / 6e4;
     if (staleMin > 30) {
-      return { name: "Daemon running", status: "warn", detail: `heartbeat ${Math.round(staleMin)}m stale`, fix: "Restart `outerlayer daemon`." };
+      return { name: "Daemon running", status: "warn", detail: `heartbeat ${Math.round(staleMin)}m stale`, fix: `Restart \`${cliInvocation()} daemon\`.` };
     }
     return { name: "Daemon running", status: "pass", detail: "heartbeat fresh" };
   } catch {
-    return { name: "Daemon running", status: "warn", detail: "pidfile present, no heartbeat", fix: "Restart `outerlayer daemon`." };
+    return { name: "Daemon running", status: "warn", detail: "pidfile present, no heartbeat", fix: `Restart \`${cliInvocation()} daemon\`.` };
   }
 }
 function checkCleanupPeriod(home) {
@@ -580,11 +584,11 @@ function checkCleanupPeriod(home) {
       name: "Retention (cleanupPeriodDays)",
       status: "fail",
       detail: "set to 0 \u2014 this DISABLES transcript persistence (upstream anthropics/claude-code#23710 and #59248)",
-      fix: "Remove cleanupPeriodDays or set it \u226514; run `outerlayer daemon` to mirror before deletion."
+      fix: `Remove cleanupPeriodDays or set it \u226514; run \`${cliInvocation()} daemon\` to mirror before deletion.`
     };
   }
   if (days < 14) {
-    return { name: "Retention (cleanupPeriodDays)", status: "warn", detail: `${days}d \u2014 transcripts deleted quickly`, fix: "Run `outerlayer daemon` so raws are mirrored before cleanup." };
+    return { name: "Retention (cleanupPeriodDays)", status: "warn", detail: `${days}d \u2014 transcripts deleted quickly`, fix: `Run \`${cliInvocation()} daemon\` so raws are mirrored before cleanup.` };
   }
   return { name: "Retention (cleanupPeriodDays)", status: "pass", detail: `${days}d` };
 }
@@ -606,7 +610,7 @@ function checkClaudeVersion(env) {
   const parsed = version.match(/\d+\.\d+\.\d+/)?.[0];
   if (!parsed) return { name: "Claude Code version", status: "warn", detail: `unrecognized: ${version}` };
   if (compareVersions(parsed, SUPPORTED_VERSIONS.max) > 0) {
-    return { name: "Claude Code version", status: "warn", detail: `${parsed} is newer than validated (${SUPPORTED_VERSIONS.max}) \u2014 parser runs best-effort`, fix: "Update OuterLayer if you see parse warnings." };
+    return { name: "Claude Code version", status: "pass", detail: `${parsed} (newer than ${SUPPORTED_VERSIONS.max}, the latest version this release was tested with)` };
   }
   if (compareVersions(parsed, SUPPORTED_VERSIONS.min) < 0) {
     return { name: "Claude Code version", status: "warn", detail: `${parsed} is older than validated (${SUPPORTED_VERSIONS.min})` };
@@ -666,19 +670,92 @@ function defaultClaudeInstalls() {
 function contextDegradedFix(kind) {
   switch (kind) {
     case "unreachable":
-      return "Check network/VPN access to the control plane, then run `outerlayer context materialize`.";
+      return `Check network/VPN access to the control plane, then run \`${cliInvocation()} context materialize\`.`;
     case "no-access":
       return "Check your git credentials (SSH key or token) and org/SSO access to the control plane, then retry.";
     case "designation-unverified":
-      return "Check OuterLayer cloud connectivity/config (~/.outerlayer/config.json), then run `outerlayer context materialize`.";
+      return `Check OuterLayer cloud connectivity/config (~/.outerlayer/config.json), then run \`${cliInvocation()} context materialize\`.`;
     case "not-governed":
-      return "Expected if the control plane's `governs` list changed intentionally; otherwise re-designate the source.";
+      return "Expected after the control plane was removed, or after this repository stopped being linked to its factory. Otherwise link the repository to the factory and, in the factory's Settings, choose the control plane in the Repositories list with Use as control plane.";
     case "adoption-conflict":
-      return "Remove the committed AGENTS.md/.claude/.outerlayer files in a commit, then run `outerlayer context materialize`.";
+      return `Remove the committed AGENTS.md/.claude/.outerlayer files in a commit, then run \`${cliInvocation()} context materialize\`.`;
     case "conflict":
-      return "Revoke the designation from all but one of the claiming factories, then run `outerlayer context materialize`.";
+      return `This record is stale: a gateway that stores the control plane never reports two. Run \`${cliInvocation()} context materialize\` again.`;
   }
 }
+function checkGovernsList(cwd) {
+  let repoRoot;
+  try {
+    repoRoot = execFileSync("git", ["-C", cwd ?? process.cwd(), "rev-parse", "--show-toplevel"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 2e3
+    }).trim();
+  } catch {
+    return [];
+  }
+  let config;
+  try {
+    config = JSON.parse(readFileSync(join(repoRoot, ".outerlayer", "config.json"), "utf8"));
+  } catch {
+    return [];
+  }
+  if (typeof config !== "object" || config === null || !("governs" in config)) return [];
+  return [
+    {
+      name: "Governs list",
+      status: "warn",
+      detail: "`governs` in .outerlayer/config.json is ignored. A control plane governs every repository its factory links, so the list decides nothing.",
+      fix: "Delete `governs` from .outerlayer/config.json once every machine and runner host runs CLI 0.17.0 or later. Older CLIs still read it."
+    }
+  ];
+}
+function hookCommandsOf(settings) {
+  const hooks = settings?.hooks;
+  if (typeof hooks !== "object" || hooks === null) return [];
+  const commands = [];
+  for (const groups of Object.values(hooks)) {
+    if (!Array.isArray(groups)) continue;
+    for (const group of groups) {
+      const entries = group?.hooks;
+      if (!Array.isArray(entries)) continue;
+      for (const entry of entries) {
+        const command = entry?.command;
+        if (typeof command === "string") commands.push(command);
+      }
+    }
+  }
+  return commands;
+}
+function checkControlPlaneHooks(cwd) {
+  let repoRoot;
+  try {
+    repoRoot = execFileSync("git", ["-C", cwd ?? process.cwd(), "rev-parse", "--show-toplevel"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 2e3
+    }).trim();
+  } catch {
+    return [];
+  }
+  if (!existsSync(join(repoRoot, ".outerlayer"))) return [];
+  let settings;
+  try {
+    settings = JSON.parse(readFileSync(join(repoRoot, ".claude", "settings.json"), "utf8"));
+  } catch {
+    return [];
+  }
+  const escaping = hookCommandsOf(settings).filter(hookCommandEscapesControlPlane);
+  if (escaping.length === 0) return [];
+  return [
+    {
+      name: "Control plane hook paths",
+      status: "warn",
+      detail: `${escaping.length === 1 ? "this hook command reaches" : "these hook commands reach"} a .claude directory by a path a governed build does not provide, so ${escaping.length === 1 ? "it fails" : "they fail"} there without a message: ${escaping.map((command) => `\`${command}\``).join(", ")}`,
+      fix: `Name the script as \`\${${CONTROL_PLANE_DIR_VARIABLE}:-$CLAUDE_PROJECT_DIR}/.claude/\u2026\`. A governed build sets ${CONTROL_PLANE_DIR_VARIABLE} to where it reads the control plane; a checkout that holds its own copy falls back to the project directory.`
+    }
+  ];
+}
 function checkContextSource(home, cwd) {
   const dir = cwd ?? process.cwd();
   let repoRoot;
@@ -711,7 +788,7 @@ function checkContextSource(home, cwd) {
       name,
       status: "warn",
       detail: `pin (${pin.sha.slice(0, 7)}) and manifest (${manifest.sha.slice(0, 7)}) disagree`,
-      fix: "Run `outerlayer context materialize` to reconcile."
+      fix: `Run \`${cliInvocation()} context materialize\` to reconcile.`
     });
   } else if (pin ?? manifest) {
     const sha = (pin ?? manifest).sha;
@@ -730,7 +807,7 @@ function checkContextSource(home, cwd) {
       name: "Context exclude block",
       status: "warn",
       detail: "materialized paths are not excluded in .git/info/exclude",
-      fix: "Run `outerlayer context materialize` to repair it."
+      fix: `Run \`${cliInvocation()} context materialize\` to repair it.`
     });
   }
   if (pin && !readCloudConfig(home).url) {
@@ -738,7 +815,7 @@ function checkContextSource(home, cwd) {
       name,
       status: "warn",
       detail: "a pin exists but OuterLayer cloud sync isn't configured \u2014 the designation cannot be confirmed",
-      fix: "Run `outerlayer login` to connect."
+      fix: `Run \`${cliInvocation()} login\` to connect.`
     });
   }
   if (looksGoverned) {
@@ -759,7 +836,7 @@ function checkContextSource(home, cwd) {
         name,
         status: "fail",
         detail: `committed context files shadow the control plane: ${sample}`,
-        fix: "Remove the committed AGENTS.md/.claude/.outerlayer files in a commit, then run `outerlayer context materialize`."
+        fix: `Remove the committed AGENTS.md/.claude/.outerlayer files in a commit, then run \`${cliInvocation()} context materialize\`.`
       });
     }
   }
@@ -816,7 +893,7 @@ function githubAppRefusalCheck(err) {
   if (err instanceof WorkCommandError && err.status === 403) {
     return { name, status: "warn", detail: `the key cannot read the factory's repositories: ${message}`, fix: "Use a key that holds git.read." };
   }
-  return { name, status: "warn", detail: `could not read the factory's repositories: ${message}`, fix: "Run `outerlayer doctor` again; check the gateway URL in ~/.outerlayer/config.json." };
+  return { name, status: "warn", detail: `could not read the factory's repositories: ${message}`, fix: `Run \`${cliInvocation()} doctor\` again; check the gateway URL in ~/.outerlayer/config.json.` };
 }
 function describeMissing(missing) {
   const held = missing.granted === null ? "not granted" : `has ${sanitizeTerminal(missing.granted)}`;
@@ -877,8 +954,8 @@ function repositoryAccessCheck(access) {
   return { name, status: "pass", detail: `every permission builds need is accepted; ${pullRequest}` };
 }
 var CREDENTIAL_CHECK_TIMEOUT_MS = 15e3;
-var LOGIN_FIX = "Run `outerlayer login` to sign in again.";
-var CONNECT_FIX = "Run `outerlayer connect` to choose a factory for this repository.";
+var LOGIN_FIX = `Run \`${cliInvocation()} login\` to sign in again.`;
+var CONNECT_FIX = `Run \`${cliInvocation()} connect\` to choose a factory for this repository.`;
 var SETUP_PANEL_FIX = "Link the repository on the factory's setup panel in the dashboard.";
 var MINT_KEY_FIX = "Mint a key for a factory that exists: dashboard \u2192 Settings \u2192 API keys.";
 async function askGateway(fetchImpl, url, path, credential, appId) {
@@ -906,7 +983,7 @@ function refusalMessage(body) {
   const message = body?.error?.message;
   return typeof message === "string" ? sanitizeTerminal(message) : "";
 }
-var NETWORK_FIX = "Check the network and the gateway address, then run `outerlayer doctor` again.";
+var NETWORK_FIX = `Check the network and the gateway address, then run \`${cliInvocation()} doctor\` again.`;
 var UPDATE_FIX = "Update the outerlayer CLI and the gateway to the same release.";
 var skippedCheck = (name, detail, fix) => ({ name, status: "skipped", detail, ...fix ? { fix } : {} });
 function withSkippedRest(first, reason) {
@@ -976,7 +1053,7 @@ async function loginChecks(fetchImpl, url, token, appId, local, inRepository) {
     return [login, factoryCheck, { name: "Repository", status: "pass", detail: `${shown} is linked to ${factorySlug(factory)}` }];
   }
   const elsewhere = factories.find((f) => f.id !== factory.id && f.linked === true);
-  const fix = elsewhere === void 0 ? SETUP_PANEL_FIX : `Run \`outerlayer connect --factory ${factorySlug(elsewhere)}\` to use the factory this repository is linked to.`;
+  const fix = elsewhere === void 0 ? SETUP_PANEL_FIX : `Run \`${cliInvocation()} connect --factory ${factorySlug(elsewhere)}\` to use the factory this repository is linked to.`;
   return [login, factoryCheck, { name: "Repository", status: "warn", detail: `${shown} is not linked to ${factorySlug(factory)}`, fix }];
 }
 async function factoryKeyChecks(fetchImpl, url, key, appId, source, local) {
@@ -1074,7 +1151,7 @@ async function credentialChecks(options = {}) {
   const resolved = resolveGatewayCredentials({ home: options.home, env, cwd });
   if (resolved.credential === void 0 || resolved.url === void 0) {
     const reason = resolved.credential === void 0 ? "no login and no factory key is saved" : "no gateway address is saved";
-    return withSkippedRest(skippedCheck("Credential", reason, "Run `outerlayer login` to sign in."), "there is no credential to check");
+    return withSkippedRest(skippedCheck("Credential", reason, `Run \`${cliInvocation()} login\` to sign in.`), "there is no credential to check");
   }
   const fetchImpl = options.fetchImpl ?? defaultFetch;
   const local = resolveRepoIdentity(cwd).gitRepo;
@@ -1093,7 +1170,7 @@ async function governanceChecks(options = {}) {
   const cwd = options.cwd ?? process.cwd();
   const resolved = resolveGatewayCredentials({ home: options.home, env, cwd });
   if (resolved.credential === void 0 || resolved.url === void 0) {
-    return [skippedCheck(name, "there is no credential to ask with", "Run `outerlayer login` to sign in.")];
+    return [skippedCheck(name, "there is no credential to ask with", `Run \`${cliInvocation()} login\` to sign in.`)];
   }
   const local = resolveRepoIdentity(cwd).gitRepo;
   if (local === void 0) return [skippedCheck(name, "not inside a git repository with a remote")];
@@ -1103,7 +1180,7 @@ async function governanceChecks(options = {}) {
   const unanswered = unansweredDetail(reply);
   if (unanswered !== void 0 && !("failure" in reply) && reply.status === 503) {
     const message = refusalMessage(reply.body);
-    return [{ name, status: "warn", detail: message === "" ? unanswered : `governed, but ${message}`, fix: "Check that the GitHub App can read the control plane, then run `outerlayer doctor` again." }];
+    return [{ name, status: "warn", detail: message === "" ? unanswered : `governed, but ${message}`, fix: `Check that the GitHub App can read the control plane, then run \`${cliInvocation()} doctor\` again.` }];
   }
   if (unanswered !== void 0) return [{ name, status: "warn", detail: unanswered, fix: NETWORK_FIX }];
   const { status, body } = reply;
@@ -1140,7 +1217,7 @@ function doctorExitCode(checks) {
 
 // src/doctor-report.ts
 async function gatherDoctorChecks() {
-  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-N3C6DFQA.js');
+  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-FXDG4NPJ.js');
   const configPath = defaultRunnerConfigPath();
   const checks = runDoctor({ runnerHost: hasRunnerBlock(configPath) });
   const credential = await credentialChecks();
@@ -1152,7 +1229,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-4TAIARIG.js');
+    const { runnerHostChecks } = await import('./doctor-2NQQML6P.js');
     const hooks = (() => {
       try {
         return loadRunnerConfig(configPath).hooks;
@@ -1187,7 +1264,7 @@ async function gatherDoctorChecks() {
       const { existsSync: existsSync3 } = await import('fs');
       if (process.platform !== "linux" || !existsSync3("/run/systemd/system")) return void 0;
       const { inspectService, realInspectProbes } = await import('./inspect-6UYAAXH7.js');
-      const { DEFAULT_UNIT_NAME } = await import('./install-HDBIPHTX.js');
+      const { DEFAULT_UNIT_NAME } = await import('./install-CBWIEF3R.js');
       const { dirname: dirname2 } = await import('path');
       return inspectService(DEFAULT_UNIT_NAME, dirname2(configPath), realInspectProbes());
     })();