@outerlayer/cli 0.17.0 → 0.18.0

package/dist/{chunk-KG5ECZGJ.js → chunk-RAZTWYZN.js}

@@ -1,13 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runEmit } from './chunk-2MNPHL23.js';
-import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME } from './chunk-XCK2YAY5.js';
-import { installStarterPack } from './chunk-42ZI52JW.js';
-import { C } from './chunk-YRYMNBGQ.js';
-import { resolveGitCommonDir, defaultGitRunner } from './chunk-YZ5F4PIS.js';
-import { pinExists, readContextManifest } from './chunk-WTE3MQML.js';
-import { loadTemplateFiles, loadMaintainedFiles, skillDir } from './chunk-POJMEEJJ.js';
-import { generatedHeaderSource } from './chunk-OHVJA253.js';
+import { runEmit } from './chunk-47TTLEDX.js';
+import { addStdioMcpEntryIfAbsent, addDocsMcpEntryIfAbsent, DOCS_MCP_SERVER_NAME } from './chunk-YVZJ6GKF.js';
+import { installStarterPack } from './chunk-F4XSVQJ4.js';
+import { C } from './chunk-ANPNT6PM.js';
+import { resolveGitCommonDir, defaultGitRunner } from './chunk-W5VPCONO.js';
+import { pinExists, readContextManifest } from './chunk-LXAY4A2G.js';
+import { loadTemplateFiles, loadMaintainedFiles, skillDir } from './chunk-MNTSH4CL.js';
+import { generatedHeaderSource } from './chunk-X5N6KC6V.js';
+import { cliInvocation } from './chunk-CRB3POP4.js';
 import { execFileSync } from 'child_process';
 import { existsSync, mkdirSync, writeFileSync } from 'fs';
 import { join, dirname } from 'path';
@@ -176,7 +177,7 @@ function renderPaths(paths, kept) {
 `;
 }
 function renderDone(paths, kept, mcpKept) {
-  const mcpNote = mcpKept ? `  ${C.yellow}!${C.reset} The outerlayer and ${DOCS_MCP_SERVER_NAME} entries were not added to .mcp.json, so their MCP servers are not set up. Add them to .mcp.json by hand, or move the servers you wrote into .outerlayer/mcp.json and run \`outerlayer context emit\`.
+  const mcpNote = mcpKept ? `  ${C.yellow}!${C.reset} The outerlayer and ${DOCS_MCP_SERVER_NAME} entries were not added to .mcp.json, so their MCP servers are not set up. Add them to .mcp.json by hand, or move the servers you wrote into .outerlayer/mcp.json and run \`${cliInvocation()} context emit\`.
 ` : "";
   const what = mcpKept ? "the OuterLayer skills" : "the OuterLayer skills and MCP servers";
   if (paths.length === 0) {

package/dist/{chunk-4NPZVMJU.js → chunk-S26M3YBJ.js}

@@ -1,15 +1,70 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { parseSize } from './chunk-7RQ73DLO.js';
-import { JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_PORT, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-4Q7OMKAT.js';
 import { BUILDKIT_IMAGE } from './chunk-CX22S5BA.js';
-import { compareVersions } from './chunk-JXYVA45C.js';
-import { runnerDir } from './chunk-ZM2IMMYN.js';
+import { compareVersions } from './chunk-BMYGAGBJ.js';
+import { runnerDir } from './chunk-N2PXGQRL.js';
+import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-BQXFBI7T.js';
 import { createHash } from 'crypto';
 import { realpathSync } from 'fs';
 import { join, dirname, resolve } from 'path';
 
 createRequire(import.meta.url);
+
+// src/runner/judge-command.ts
+var JUDGE_DIR = "/outerlayer/judge";
+var JUDGE_HOME = `${JUDGE_DIR}/home`;
+var JUDGE_TREE = `${JUDGE_DIR}/tree`;
+var JUDGE_REPORT = `${JUDGE_DIR}/report.html`;
+var JUDGE_PROGRAM = "/opt/outerlayer/claude/bin/claude";
+var MAX_REPORT_BYTES = 5 * 1024 * 1024;
+var JUDGE_MAX_TURNS = 60;
+var JUDGE_PATH = "/opt/outerlayer/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
+var JUDGE_TOOLS = "Read,Grep,Glob,Write";
+function judgeCommand(input) {
+  const env = {
+    HOME: JUDGE_HOME,
+    TMPDIR: `${JUDGE_HOME}/tmp`,
+    PATH: JUDGE_PATH,
+    ANTHROPIC_BASE_URL: `http://127.0.0.1:${CLAUDE_PORT}`,
+    CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1",
+    DISABLE_AUTOUPDATER: "1",
+    ...input.credential === void 0 ? {} : { [input.credential.variable]: input.credential.placeholder }
+  };
+  const argv = [
+    JUDGE_PROGRAM,
+    "-p",
+    "--output-format",
+    "json",
+    "--setting-sources",
+    "user",
+    "--strict-mcp-config",
+    "--disable-slash-commands",
+    "--no-session-persistence",
+    "--tools",
+    JUDGE_TOOLS,
+    "--allowedTools",
+    // A path that starts with two slashes is absolute in a permission rule.
+    `Read(/${JUDGE_DIR}/**),Edit(/${JUDGE_REPORT})`,
+    "--add-dir",
+    JUDGE_TREE,
+    "--permission-mode",
+    "dontAsk",
+    "--max-turns",
+    String(JUDGE_MAX_TURNS),
+    // After the separator, so a brief that starts with a dash is not read as an option.
+    "--",
+    input.brief
+  ];
+  return { argv, env, cwd: JUDGE_DIR };
+}
+var HASH_SCRIPT = 'const fs=require("fs"),c=require("crypto");const p=fs.realpathSync(process.argv[1]);process.stdout.write(c.createHash("sha256").update(fs.readFileSync(p)).digest("hex")+" "+p+"\\n")';
+var HASH_ARGV = ["/opt/outerlayer/bin/node", "-e", HASH_SCRIPT, JUDGE_PROGRAM];
+function parseProgramHash(stdout) {
+  return /^([0-9a-f]{64}) /.exec(stdout.trim())?.[1];
+}
+
+// src/runner/container/run-args.ts
 var BUILD_LABEL = "ai.outerlayer.build";
 var RUNNER_LABEL = "ai.outerlayer.runner";
 function resolvedRunnerDir(configPath) {
@@ -71,6 +126,7 @@ function containerRunArgs(input) {
     `type=volume,src=${input.volume},dst=/tmp,volume-subpath=tmp`,
     "--mount",
     `type=bind,src=${mountPath(input.buildDir)},dst=${JOB_MOUNT},readonly`,
+    ...input.judgeDir === void 0 ? [] : ["--mount", `type=bind,src=${mountPath(input.judgeDir)},dst=${JUDGE_DIR}`],
     "--entrypoint",
     "/opt/outerlayer/bin/tini",
     input.image,
@@ -261,4 +317,4 @@ function ensureBuilder(rawRun, spec, options = {}) {
   );
 }
 
-export { BUILD_LABEL, MIN_BUILDX_VERSION, RUNNER_LABEL, builderName, builderSpec, buildxState, containerExecArgs, containerRunArgs, ensureBuilder, ensureFailureCount, isOutOfMemory, prepareRunArgs, proxyEnvironment, runnerLabelValue, trackImageBuild };
+export { BUILD_LABEL, HASH_ARGV, JUDGE_DIR, JUDGE_MAX_TURNS, JUDGE_PROGRAM, MAX_REPORT_BYTES, MIN_BUILDX_VERSION, RUNNER_LABEL, builderName, builderSpec, buildxState, containerExecArgs, containerRunArgs, ensureBuilder, ensureFailureCount, isOutOfMemory, judgeCommand, parseProgramHash, prepareRunArgs, proxyEnvironment, runnerLabelValue, trackImageBuild };

package/dist/{chunk-UGP76IZ5.js → chunk-S5PCA3SN.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-N2PXGQRL.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-3NSNIIBE.js → chunk-S76AYB4M.js}

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { sanitizeTerminal } from './chunk-WUYTWNMA.js';
-import { remoteLookupFailed } from './chunk-JXYVA45C.js';
-import { DEFAULT_DASHBOARD } from './chunk-4KSQKQXE.js';
-import { resolveGatewayCredentials } from './chunk-PLMTLGYH.js';
+import { sanitizeTerminal } from './chunk-MQJSXHV7.js';
+import { remoteLookupFailed } from './chunk-BMYGAGBJ.js';
+import { DEFAULT_DASHBOARD } from './chunk-NACDBXUG.js';
+import { resolveGatewayCredentials } from './chunk-52NC2FIU.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
 import { writeRepoConnection, findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
+import { cliInvocation } from './chunk-CRB3POP4.js';
 import { execFileSync } from 'child_process';
 import { createInterface } from 'readline/promises';
 
@@ -53,7 +54,7 @@ function notLinkedText(factoryName, repository, url) {
 Link it on the factory's Work page: ${url}
   1. Connect GitHub repository, and grant the App access to ${name}.
   2. Link repository, and pick ${name} and its default branch.
-Then run \`outerlayer connect\` again.
+Then run \`${cliInvocation()} connect\` again.
 `;
 }
 
@@ -151,7 +152,7 @@ async function fetchFactories(fetchImpl, url, token, repository) {
     return { ok: false, result: result(1, "failed", message, message) };
   }
   if (res.status === 401) {
-    const message = "the gateway refused the login. Run `outerlayer login` to sign in again.";
+    const message = `the gateway refused the login. Run \`${cliInvocation()} login\` to sign in again.`;
     return { ok: false, result: result(1, "failed", message, message) };
   }
   if (!res.ok) {
@@ -160,7 +161,7 @@ async function fetchFactories(fetchImpl, url, token, repository) {
   }
   const factories = parseFactories(await res.json().catch(() => null));
   if (factories === void 0) {
-    const message = `${url} answered, but the reply is not a list of factories. Check the gateway address with \`outerlayer doctor\`, then run \`outerlayer connect\` again.`;
+    const message = `${url} answered, but the reply is not a list of factories. Check the gateway address with \`${cliInvocation()} doctor\`, then run \`${cliInvocation()} connect\` again.`;
     return { ok: false, result: result(1, "failed", `${url} did not answer with a factory list`, message) };
   }
   return { ok: true, factories };
@@ -205,7 +206,7 @@ ${listText(factories, repository)}`;
   if (!deps.isTerminal) {
     const why = linked.length > 1 ? `${repository} is linked to more than one factory you can use` : `you can use more than one factory, and none is the only one ${repository} is linked to`;
     const message = `${why}, and there is no terminal to ask on.
-Run \`outerlayer connect --factory <org>/<factory>\` with one of:
+Run \`${cliInvocation()} connect --factory <org>/<factory>\` with one of:
 ${listText(factories, repository)}`;
     return result(1, "failed", "more than one factory fits; pass --factory", message);
   }
@@ -226,18 +227,18 @@ ${listText(factories, repository)}`;
     }))
   });
   const factory = pool.find((f) => f.id === picked);
-  if (!factory) return result(1, "failed", "no factory was chosen", "no factory was chosen. Run `outerlayer connect` again, or pass --factory <org>/<factory>.");
+  if (!factory) return result(1, "failed", "no factory was chosen", `no factory was chosen. Run \`${cliInvocation()} connect\` again, or pass --factory <org>/<factory>.`);
   return { factory, reason: "prompt" };
 }
 async function runConnect(flags, deps) {
   const creds = resolveGatewayCredentials({ home: deps.home, env: deps.env, cwd: deps.cwd });
   if (creds.credential === void 0) {
-    const message = "no saved credential. Run `outerlayer login` to sign in, then run `outerlayer connect` again.";
-    return { ...result(1, "skipped", "no credential; run `outerlayer login` first", message), next: "Run `outerlayer login`, then `outerlayer init` again." };
+    const message = `no saved credential. Run \`${cliInvocation()} login\` to sign in, then run \`${cliInvocation()} connect\` again.`;
+    return { ...result(1, "skipped", `no credential; run \`${cliInvocation()} login\` first`, message), next: `Run \`${cliInvocation()} login\`, then \`${cliInvocation()} init\` again.` };
   }
   if (creds.kind === "key") {
     if (flags.factory !== void 0 && flags.factory !== creds.appId) {
-      const message2 = `a factory key decides the factory${creds.appId ? ` (${creds.appId})` : ""}, so --factory ${flags.factory} cannot apply. Remove --factory, or sign in with \`outerlayer login\` and unset the key.`;
+      const message2 = `a factory key decides the factory${creds.appId ? ` (${creds.appId})` : ""}, so --factory ${flags.factory} cannot apply. Remove --factory, or sign in with \`${cliInvocation()} login\` and unset the key.`;
       return result(1, "failed", "--factory names a factory other than the key's", message2);
     }
     const message = `Your factory key decides the factory${creds.appId ? ` (${creds.appId})` : ""}, so there is nothing to connect. No file was changed.`;
@@ -248,14 +249,14 @@ async function runConnect(flags, deps) {
   }
   const repository = deps.resolveRepository(deps.cwd);
   if (repository === void 0 && remoteLookupFailed(deps.cwd)) {
-    const message = "git did not answer when asked for this repository's remote, so connect cannot tell which repository it is. Run `git remote -v` here, then run `outerlayer connect` again.";
+    const message = `git did not answer when asked for this repository's remote, so connect cannot tell which repository it is. Run \`git remote -v\` here, then run \`${cliInvocation()} connect\` again.`;
     return result(1, "failed", "git could not read this repository's remote", message);
   }
   if (repository === void 0) {
-    return result(1, "skipped", "this repository has no git remote", "this repository has no git remote, so connect cannot tell which repository it is. Add one (`git remote add origin <url>`), then run `outerlayer connect` again.");
+    return result(1, "skipped", "this repository has no git remote", `this repository has no git remote, so connect cannot tell which repository it is. Add one (\`git remote add origin <url>\`), then run \`${cliInvocation()} connect\` again.`);
   }
   if (creds.url === void 0) {
-    const message = "no gateway address is saved. Run `outerlayer login` to sign in.";
+    const message = `no gateway address is saved. Run \`${cliInvocation()} login\` to sign in.`;
     return result(1, "failed", message, message);
   }
   const listed = await fetchFactories(deps.fetchImpl, creds.url, creds.credential, repository);
@@ -285,7 +286,7 @@ async function runConnect(flags, deps) {
     const linkUrl = workPageUrl(deps.home, factory.organization.name, factory.name);
     return { ...result(EXIT_NOT_LINKED, "done", why, connected + notLinkedText(factory.displayName, repository, linkUrl)), ...chosen, linked, linkUrl };
   }
-  const changeIt = "Run `outerlayer connect --factory <org>/<factory>` to change it.";
+  const changeIt = `Run \`${cliInvocation()} connect --factory <org>/<factory>\` to change it.`;
   const text = linked === null ? `${connected}Could not check whether ${sanitizeTerminal(repository)} is linked to ${factory.displayName}.
 ${changeIt}` : connected + changeIt;
   return { ...result(0, "done", why, text), ...chosen, linked };

package/dist/{chunk-RMWLBUCJ.js → chunk-SADUQSO4.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-N2PXGQRL.js';
 import { existsSync, readFileSync, mkdirSync, chmodSync, writeFileSync } from 'fs';
 import { dirname, join } from 'path';
 

package/dist/{chunk-OZGHL5Y5.js → chunk-SWCTGCSC.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_UNIT_NAME } from './chunk-RLYZLUQ7.js';
+import { DEFAULT_UNIT_NAME } from './chunk-WGAUY5LE.js';
 import { parseRunnerEnv } from './chunk-6MZSX4M7.js';
-import { RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
+import { RUNNER_FILE_MODE } from './chunk-N2PXGQRL.js';
 import { existsSync, readFileSync, writeFileSync, renameSync, rmSync } from 'fs';
 import { join, dirname } from 'path';
 

package/dist/{chunk-GQD22KKN.js → chunk-T2Q7ISPE.js}

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { parseTrackerNumber } from './chunk-WZBHBH3J.js';
+import { cliInvocation } from './chunk-CRB3POP4.js';
 import { mkdirSync, appendFileSync, readFileSync } from 'fs';
 import { join } from 'path';
 
 createRequire(import.meta.url);
-var HOW_TO_CREATE_AN_ITEM = "outerlayer work build --local";
+var HOW_TO_CREATE_AN_ITEM = `${cliInvocation()} work build --local`;
 function parseWorkItemEnv(raw) {
   if (raw === void 0) return { reason: "OUTERLAYER_WORK is not set" };
   const value = raw.trim();

package/dist/{chunk-C5Y5ZJJZ.js → chunk-T4Y6SCG3.js}

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { skillDir, FORMER_MAINTAINED_NAMES, isMaintainedCopy } from './chunk-POJMEEJJ.js';
-import { emitTree, ALL_TARGET_IDS, classifyTree } from './chunk-OHVJA253.js';
+import { skillDir, FORMER_MAINTAINED_NAMES, isMaintainedCopy } from './chunk-MNTSH4CL.js';
+import { emitTree, ALL_TARGET_IDS, classifyTree } from './chunk-X5N6KC6V.js';
+import { cliInvocation } from './chunk-CRB3POP4.js';
 import { readFileSync, existsSync, unlinkSync, rmdirSync, readdirSync } from 'fs';
 import { join, dirname, relative, sep } from 'path';
 
@@ -70,7 +71,7 @@ function checkFormerSkillNames(repoRoot) {
       name: "Renamed skills",
       status: "warn",
       detail: `copies under earlier names: ${retired.map(skillDir).join(", ")}`,
-      fix: "Run `outerlayer context emit` to replace them with the current names, then commit."
+      fix: `Run \`${cliInvocation()} context emit\` to replace them with the current names, then commit.`
     });
   }
   const hits = filesNamingFormerSkills(repoRoot);
@@ -79,7 +80,7 @@ function checkFormerSkillNames(repoRoot) {
       name: "Skill names",
       status: "warn",
       detail: `${hits.map((h) => `${h.path} (${h.formers.join(", ")})`).join("; ")} still ${hits.length === 1 ? "names" : "name"} a skill by an earlier name`,
-      fix: `Replace each earlier name with the current one: ${Object.entries(FORMER_MAINTAINED_NAMES).map(([former, current]) => `${former} \u2192 ${current}`).join(", ")}. \`outerlayer init --update\` does this for a file you have not edited.`
+      fix: `Replace each earlier name with the current one: ${Object.entries(FORMER_MAINTAINED_NAMES).map(([former, current]) => `${former} \u2192 ${current}`).join(", ")}. \`${cliInvocation()} init --update\` does this for a file you have not edited.`
     });
   }
   return checks;

package/dist/{chunk-BWQ66M6N.js → chunk-ULSIJGLS.js}

@@ -1,7 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
+import { CONTROL_PLANE_DIR_VARIABLE } from './chunk-G2YNJIGF.js';
 import { deadHooksState, huskyPrepareScript, preparePackageManagerCommand } from './chunk-XCCLFVXM.js';
+import { appendContextProvenance } from './chunk-ZJSNLVCE.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
+import { cliInvocation } from './chunk-CRB3POP4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync, existsSync, statSync, appendFileSync, opendirSync, unlinkSync } from 'fs';
 import { spawn, execFileSync } from 'child_process';
@@ -56,7 +59,7 @@ function assessSyncHealth(status, now = Date.now(), staleAfterMs = SYNC_STALE_AF
     return {
       level: "unknown",
       headline: "no sync has run on this machine yet",
-      details: ["run `outerlayer sync` once to verify the connection"]
+      details: [`run \`${cliInvocation()} sync\` once to verify the connection`]
     };
   }
   const host = status.url ? safeHost(status.url) : "the configured endpoint";
@@ -71,7 +74,7 @@ function assessSyncHealth(status, now = Date.now(), staleAfterMs = SYNC_STALE_AF
     );
     if (status.pending) details.push(`${status.pending} session(s) waiting to ship`);
     if (status.held) details.push(`${status.held} transcript(s) held \u2014 their launch could not be determined`);
-    details.push("run `outerlayer doctor` for the full picture");
+    details.push(`run \`${cliInvocation()} doctor\` for the full picture`);
     return {
       level: "error",
       headline: `sync is FAILING \u2014 last attempt ${formatAgo(now - Date.parse(status.at))}`,
@@ -104,7 +107,7 @@ function assessSyncHealth(status, now = Date.now(), staleAfterMs = SYNC_STALE_AF
       headline: `sync ran ${formatAgo(age)} but ${host} has never been reached`,
       details: [
         "every run so far had an empty queue, so the connection is unproven",
-        "run `outerlayer sync --all` to verify it"
+        `run \`${cliInvocation()} sync --all\` to verify it`
       ]
     };
   }
@@ -388,7 +391,7 @@ function hookErrorsContext(home, writtenBytes, seenBytes) {
 }
 async function handleWorkLaunch(sessionId, home, env, spawnImpl = spawnDetached, cwd = process.cwd()) {
   if (!sessionId || env.OUTERLAYER_WORK === void 0) return void 0;
-  const { parseWorkItemEnv, appendLaunchRecord } = await import('./work-launch-R5HTAP6X.js');
+  const { parseWorkItemEnv, appendLaunchRecord } = await import('./work-launch-LEQ2MPM3.js');
   const parsed = parseWorkItemEnv(env.OUTERLAYER_WORK);
   if ("reason" in parsed) {
     logHookError(home, new Error(`OUTERLAYER_WORK ignored: ${parsed.reason}`));
@@ -433,7 +436,7 @@ async function missingRenewalHookContext(home, cwd) {
     const registeredIn = (settings) => (settings.hooks?.PostToolUse ?? []).some((block) => (block.hooks ?? []).some((h) => isOurHookCommand(h)));
     const registered = userSettings !== null && registeredIn(userSettings) || projectSettings !== null && registeredIn(projectSettings);
     if (registered) return void 0;
-    return "This install has no PostToolUse hook, so this session's work-item lease will never be renewed while it works and may be lost to another worker mid-session. Run `outerlayer init` to register it.";
+    return `This install has no PostToolUse hook, so this session's work-item lease will never be renewed while it works and may be lost to another worker mid-session. Run \`${cliInvocation()} init\` to register it.`;
   } catch {
     return void 0;
   }
@@ -454,7 +457,7 @@ async function maybeRenewWorkLease(event, sessionId, home = homeFromEnv(), env =
       if (now - statSync(marker).mtimeMs < WORK_LEASE_RENEW_DEBOUNCE_MS) return;
     } catch {
     }
-    const { parseWorkItemEnv } = await import('./work-launch-R5HTAP6X.js');
+    const { parseWorkItemEnv } = await import('./work-launch-LEQ2MPM3.js');
     const parsed = parseWorkItemEnv(env.OUTERLAYER_WORK);
     if ("reason" in parsed) return;
     writeFileSync(marker, String(now));
@@ -470,7 +473,7 @@ async function handleWorkSessionEnd(event, sessionId, _home = homeFromEnv(), env
   try {
     if (event !== "SessionEnd") return;
     if (!sessionId || env.OUTERLAYER_WORK === void 0) return;
-    const { parseWorkItemEnv } = await import('./work-launch-R5HTAP6X.js');
+    const { parseWorkItemEnv } = await import('./work-launch-LEQ2MPM3.js');
     const parsed = parseWorkItemEnv(env.OUTERLAYER_WORK);
     if ("reason" in parsed) return;
     spawnImpl(
@@ -487,7 +490,7 @@ function syncHealthContext(home) {
   if (health.level !== "error") return null;
   return [`OuterLayer sync is failing on this machine: ${health.headline}`, ...health.details.map((d) => `  - ${d}`)].join("\n");
 }
-var UNTRUSTED_STALE_CLI_CONTEXT = "The installed OuterLayer CLI appears stale relative to a checkout near your working directory; run `outerlayer doctor` for details.";
+var UNTRUSTED_STALE_CLI_CONTEXT = `The installed OuterLayer CLI appears stale relative to a checkout near your working directory; run \`${cliInvocation()} doctor\` for details.`;
 function installedCliStalenessContext(home, cwd) {
   const result = checkInstalledCliStaleness({ home, cwd });
   if (result === null || !result.stale) return null;
@@ -547,10 +550,10 @@ function deadHooksAutoHealContext(cwd, home) {
   const hooksDirLabel = sanitizeForContext(state.hooksDir);
   const script = huskyPrepareScript(state.repoRoot);
   if (script === null) {
-    return `Git hooks are dead in this checkout (${hooksDirLabel} is missing or empty, via core.hooksPath) and package.json declares no husky prepare script to run automatically. Run \`outerlayer doctor\` for the fix.`;
+    return `Git hooks are dead in this checkout (${hooksDirLabel} is missing or empty, via core.hooksPath) and package.json declares no husky prepare script to run automatically. Run \`${cliInvocation()} doctor\` for the fix.`;
   }
   if (recentHealFailure(home, state.repoRoot)) {
-    return `Git hooks are still dead in this checkout (${hooksDirLabel}) \u2014 a previous auto-heal attempt failed recently, so it will not retry yet. Run \`outerlayer doctor\` for the fix.`;
+    return `Git hooks are still dead in this checkout (${hooksDirLabel}) \u2014 a previous auto-heal attempt failed recently, so it will not retry yet. Run \`${cliInvocation()} doctor\` for the fix.`;
   }
   const command = preparePackageManagerCommand(state.repoRoot);
   const [bin, ...args] = command.split(" ");
@@ -563,7 +566,7 @@ function deadHooksAutoHealContext(cwd, home) {
   const after = deadHooksState(state.repoRoot);
   if (after.dead) {
     markHealFailure(home, state.repoRoot);
-    return `OuterLayer ran \`${command}\` to regenerate dead git hooks, but ${hooksDirLabel} is still missing or empty afterward. Run \`outerlayer doctor\` for the fix.`;
+    return `OuterLayer ran \`${command}\` to regenerate dead git hooks, but ${hooksDirLabel} is still missing or empty afterward. Run \`${cliInvocation()} doctor\` for the fix.`;
   }
   clearHealFailureMarker(home, state.repoRoot);
   return null;
@@ -594,6 +597,29 @@ function contextPossiblyGoverned(cwd, home = homeFromEnv()) {
     return false;
   }
 }
+function recordDeliveredContext(cwd, sessionId, home) {
+  const dirs = findGitDirs(cwd);
+  if (dirs === void 0) return;
+  let record;
+  try {
+    record = JSON.parse(readFileSync(join(dirs.gitCommonDir, "outerlayer", "delivery.json"), "utf8"));
+  } catch {
+    return;
+  }
+  if (typeof record.repository !== "string" || typeof record.sha !== "string") return;
+  appendContextProvenance(
+    {
+      t: (/* @__PURE__ */ new Date()).toISOString(),
+      sessionId,
+      repoRoot: dirs.repoRoot,
+      repository: record.repository,
+      ...typeof record.ref === "string" ? { ref: record.ref } : {},
+      sha: record.sha,
+      verification: "verified"
+    },
+    home
+  );
+}
 async function runHookFast(event, home = homeFromEnv(), read = readStdin, env = process.env, spawnImpl = spawnDetached) {
   try {
     const stdin = read();
@@ -632,9 +658,15 @@ async function runHookFast(event, home = homeFromEnv(), read = readStdin, env =
       const hookErrorsBytes = fileSizeBytes(join(dir, "hook-errors.log"));
       const hookErrorsSeen = hookErrorsSeenBytes(home);
       recordHookErrorsSeen(home, hookErrorsBytes);
-      if (contextPossiblyGoverned(sessionCwd, home)) {
+      if (env[CONTROL_PLANE_DIR_VARIABLE] !== void 0) {
+        try {
+          recordDeliveredContext(sessionCwd, typeof payload.session_id === "string" ? payload.session_id : "unknown", home);
+        } catch (err) {
+          logHookError(home, err);
+        }
+      } else if (contextPossiblyGoverned(sessionCwd, home)) {
         try {
-          const { materializeContext: materialize } = await import('./context-materialize-IV2TUUFO.js');
+          const { materializeContext: materialize } = await import('./context-materialize-Y5IJ4MQT.js');
           const sessionId = typeof payload.session_id === "string" ? payload.session_id : "unknown";
           const result = await materialize({ cwd: sessionCwd, sessionId, home });
           materializeMessage = result.message;

package/dist/{chunk-NNRTPG7X.js → chunk-UYOYTKE2.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { LiveUploader } from './chunk-NWQTTSBB.js';
-import { CaptureDaemon } from './chunk-JXYVA45C.js';
-import { parseWorkItemEnv } from './chunk-GQD22KKN.js';
-import { spoolDir } from './chunk-BWQ66M6N.js';
+import { LiveUploader } from './chunk-JF42URPU.js';
+import { CaptureDaemon } from './chunk-BMYGAGBJ.js';
+import { parseWorkItemEnv } from './chunk-T2Q7ISPE.js';
+import { spoolDir } from './chunk-ULSIJGLS.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { mkdirSync, writeFileSync, rmSync } from 'fs';
 import { join } from 'path';

package/dist/{chunk-PTW6W5NR.js → chunk-VYAL7PUE.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { currentLink } from './chunk-TI7B7UEO.js';
+import { currentLink } from './chunk-AMFWYESY.js';
 import { readFileSync, statSync, chmodSync, mkdirSync, writeFileSync, renameSync, rmSync, existsSync, lstatSync, accessSync, constants, realpathSync } from 'fs';
 import { randomBytes } from 'crypto';
 import { join, dirname, delimiter, resolve } from 'path';