@outerlayer/cli 0.17.0 → 0.19.0

package/CHANGELOG.md

@@ -1,5 +1,77 @@
 # @outerlayer/cli
 
+## 0.19.0
+
+### Minor Changes
+
+- 5153995: Add `outerlayer emit step <name>`. An agent reports that it started a step, such as "Review round 2", and the work item's Activity tab shows it.
+
+  The name is 1 to 80 characters on one line. If the gateway cannot be reached, the command queues the step with the time you ran it and exits 0, and `outerlayer sync` sends it later. If the gateway refuses the step, the command prints the reason and exits 1.
+
+- 3d15dba: On a laptop, `outerlayer claude` starts Claude Code with your control plane attached, without writing its files into your repository. It keeps a copy of the control plane under `~/.outerlayer/context/` and starts Claude Code with that copy added.
+
+  A governed repository can now commit its own `CLAUDE.md`, `AGENTS.md` and skills. `outerlayer init` can add a `claude` function to your zsh or bash startup file, so plain `claude` starts the same way. A session that did not start through `outerlayer claude` says the shared instructions are missing.
+
+  `outerlayer context materialize` and the pre-commit guard are removed. A session start removes the files, the exclude block and the guard that an earlier CLI added to a checkout.
+
+- 3210eaa: `outerlayer work logs` prints the runner's log for a host attempt. A runner now sends that log with every release, and gives a reason when a build command dies of a signal it did not send.
+
+### Patch Changes
+
+- ff302c8: The build skill says a pull request closes a GitHub issue, and that a person completes a Linear or Jira issue in its tracker after merge.
+- de29d22: `outerlayer context emit` deletes a generated file whose source is gone, so every orphan `--check` reports is one a plain emit clears. Before, `--check` reported these files and emit left them, so the check kept failing.
+
+  Neither form reads inside a nested git repository, a submodule, or a governed clone any more. Generated files there belong to that tree, not to the repository being emitted.
+
+- 13ee333: Update the bundled `@noble/hashes` library from 1.8 to 2.4. The CLI's pricing code depends on it. Token costs the CLI reports are unchanged.
+
+## 0.18.0
+
+### Minor Changes
+
+- 2ef9133: Add `outerlayer claude`, which starts Claude Code with the repository's control plane attached. A governed build reads its control plane from a directory outside the checkout, so nothing from it is written into the checkout.
+- e92982d: A session now takes its control plane from the one the factory stores, chosen in the factory's Settings with Use as control plane in the Repositories list. Nothing reads a `governs` list in a control plane's config any more, and `doctor` reports a list left there as unused. A gateway older than 0.17.0 does not store the answer, and the CLI says so instead of guessing.
+
+  A validator or policy `when` can name `repositories`, so a check applies only to pull requests in those repositories.
+
+  A session that could not reach the gateway, or reached a gateway too old to answer, no longer reads the retry guess it wrote as a confirmed answer on the next start. A build that cannot write the staged control-plane files now says so, and no longer reports that a credential cannot read the control plane.
+
+- 2cb58e8: A container or microVM build now runs on the devcontainer of the repository that governs it. For a governed repository that is the control plane's `.devcontainer/devcontainer.json` (or `.devcontainer.json`), read at the commit the build's instructions come from. A governed repository's own devcontainer is not read, and the build log says so. A repository that governs itself builds from its own devcontainer, as before. `outerlayer runner image --repository <name>` builds the same image a build of that repository uses.
+
+  Before upgrading a runner host, copy the devcontainer your builds rely on into the control plane. A control plane with no devcontainer gives its builds the runner's default image. A factory whose only repository is its own control plane needs no move.
+
+  In a build with more than one repository, every repository is at `/build/work/repos/<owner>/<repo>`, the primary included. The primary is also at `/build/work/checkout`. The control plane devcontainer's setup commands run once, in the control plane's checkout, so they can name each repository by its fixed path. Host checks check out every repository at the same paths, each at the branch the build pushed there or else at its default branch.
+
+- 07bb510: A `where: host` check can declare `run.judge.brief` instead of `run.command`. After a build ends well, the runner stops everything the build left running, checks that the image's Claude Code is unchanged, and runs a read-only Claude Code session with that brief. It records the verdict under the check's name with the host's own key and links the judge's report.
+
+  The starter `acceptance-criteria` check now uses this form, and the starter `/build` skill no longer records its own `acceptance-criteria` pass. Run `outerlayer doctor` to see an unedited copy of the old file as outdated, and `outerlayer init --update` to replace it.
+
+- d776d34: `outerlayer spec` files and edits specs through OuterLayer, with no tracker tool of your own. `spec target` says where a spec would be filed. `spec search <query>` finds open and closed issues that match. `spec file --title <text> --body-file <path>` creates the issue and prints its key, URL and the `work build` command for it. `spec edit <key> --body-file <path>` replaces an issue's body, and `--updated-at` refuses the edit if the issue changed since you read it.
+
+  Filing works for GitHub today. An API key needs the new `spec.insert` permission to file and `spec.update` to edit, so re-mint keys that should do either. A GitHub organization admin must also approve the OuterLayer App's Issues write permission once.
+
+### Patch Changes
+
+- 8f46b70: The starter `/build` skill reads the issue from `outerlayer work status --json`, under the new `issue` field, instead of from a tracker tool. A build on a host holds no Linear or Jira credential, so it could not read those issues before. The build saves the issue to `build-reports/issue.md` and gives every agent that file. `/outerlayer-amend` reads the issue the same way.
+
+  To pick up the new `/build`, run `outerlayer init --update`. A copy you edited is left as it is.
+
+- fe8bb20: Printed command hints now name the command the way you ran the CLI. Run it through `npx @outerlayer/cli` (or `pnpm dlx`, `yarn dlx` or `bunx`) and a hint says `npx @outerlayer/cli login`, not an `outerlayer login` that is not on your PATH. `--help` usage lines follow the same rule.
+
+  `work build --local` no longer prints a branch name. The session it hands off to works on a branch of its own, so the printed name was never used. `--json` still carries the `branch` field.
+
+  `doctor` no longer warns when Claude Code is newer than the newest version this release was tested with. It passes, and names that tested version. A Claude Code older than the tested range still warns.
+
+- 9b898aa: Session cost estimates price Claude Haiku 5.5 requests over 100,000 input tokens at Haiku 5.5's long-context rates. Token buckets now start a new input band at 100,000 tokens.
+- 5cc77dc: Builds no longer print a Node warning on the stderr of every Node process. The runner sets `NODE_USE_ENV_PROXY` so Node uses the build's proxy, and Node 22 then warns `[UNDICI-EHPA] EnvHttpProxyAgent is experimental`. A test that expects a child process's stderr to be empty failed in a build and passed on a laptop.
+
+  The runner now adds `--disable-warning=UNDICI-EHPA` to `NODE_OPTIONS` in container, microVM and process builds. It keeps the options the image, the recipe's `containerEnv` or a named host variable already set. A build run through a provision hook's `exec` is left as it was. Node before 20.11 does not know the flag and refuses to start with it.
+
+- daac363: Uploaded sessions record the input band boundaries their token buckets were grouped by. The server uses them to tell when a bucket cannot be priced at a single rate, and prices that model from its individual requests instead.
+- 7a16e3f: `outerlayer work status`, `work remove`, `work claim`, `work renew` and `work release` take a Linear or Jira key in `--issue`, such as `--issue ENG-142`. Pass `--tracker linear` or `--tracker jira` when both trackers hold the key. Before, `--issue` took only a GitHub issue number, so a Linear or Jira item could be named only with `--item`.
+
+  A runner's `repos.include` and `repos.exclude` now match a Linear or Jira item by the repository it was added with (`work build --repo`), instead of skipping it. A runner using `builtin:process`, or its own provision hook, now clones the repository the claim chose, so it can build an item that was added without a repository.
+
 ## 0.17.0
 
 ### Minor Changes

package/README.md

@@ -90,14 +90,25 @@ content:
   `release` marks it done. `outerlayer work comment` posts one comment on a
   work item's general thread or a criterion thread — the detected session id
   rides along the same way it does for `emit`, only ever narrowing what the
-  comment may do; `outerlayer work threads` reads them back. A runner key
+  comment may do; `outerlayer work threads` reads them back. `outerlayer work logs`
+  reads the runner's log for a host attempt. A runner key
   needs `git.read` and `work.read` to
   list and read items, and `work.claim` to claim, renew or release — `work.claim`
   is not granted to a dashboard role by default, since a claim is a host's
   lease, not a person's.
+- **`outerlayer spec target`, `search`, `file` and `edit`** each make one
+  request to your gateway (`GET /v1/specs/target`, `GET /v1/specs/search`,
+  `POST /v1/specs`, `PATCH /v1/specs/{key}`). `search` sends your query, and
+  `file` and `edit` send the title and the Markdown body you give them.
+  Your gateway files the issue in your tracker; the CLI never holds a tracker
+  credential.
 - **`outerlayer runner start`** lists, claims, renews and releases work
   items the same way `work claim`/`renew`/`release` do, on the schedule its
-  config sets — it sends nothing about the job it runs beyond that; the
+  config sets. Each release also carries the runner's own log for the attempt:
+  the lines the runner logged for that item, and the tail of the stage log when
+  the attempt ended in provision, sync, cleanup or report. It is scrubbed with
+  the same patterns as the build's session, capped at 64 KiB and always sent.
+  The runner sends nothing else about the job it runs; the
   agent it starts is a separate process with its own credentials, from the
   `runner` block, never the copy-out daemon's. It also sends a heartbeat at
   the end of every poll: the host, the CLI version, the poll interval, the
@@ -116,6 +127,15 @@ content:
   command in a new container, and sends one `POST /v1/emitted-results` for
   each: the check's name, pass or fail, and for a fail the exit status and the
   last line of its output, scrubbed.
+  A `where: host` check that declares a `judge` runs after a successful
+  build instead of a command. The runner reads the item's recorded criteria
+  with `GET /v1/work-items/{id}`, fetches the build's commits and the brief
+  with the host's own git credentials, and copies out the tests that cite the
+  criteria. It starts a Claude Code agent in the build's image with the host's
+  Claude credential. The judge sees only a read-only folder of the criteria,
+  citations and diff, and it has no shell. The runner uploads the judge's
+  `report.html` as an artifact with its own key, and sends one
+  `POST /v1/emitted-results` with pass or fail and a one-line reason.
   Before each check's command runs, the runner writes a read-only folder for it
   to read: the work item, from `GET /v1/work-items/{id}` with the runner's own
   key; the branch's diff, from `git fetch` of the build's commits with the
@@ -225,6 +245,11 @@ content:
   credited the member who asked for the build. The runner sets that author in
   the build's environment and adds the `Co-authored-by` line with git hooks it
   writes into the build's own directory.
+- **`outerlayer claude`** asks your gateway which repository governs the
+  current one (`GET /v1/context/source`, with your API key). When one does, it
+  runs `git fetch` of that control plane into a cache under
+  `~/.outerlayer/context` and starts Claude Code with the files attached.
+  Nothing is written into your working tree.
 - **`outerlayer runner start` with `builtin:container` hooks** also asks your
   gateway which repository governs the item's repository (`GET
   /v1/context/source`, signed with the host key), after the recipe's
@@ -312,6 +337,13 @@ content:
   declared proof kind, from the JSON file you name. The anchoring is the same
   as `emit finding`. Nothing but the file's content and the item number is
   sent.
+- **`outerlayer emit step <name>`** sends the step's name, the time you ran the
+  command, a random id for the step and the item number
+  (`POST /v1/work-items/steps`). The item is `--item`, or the item the
+  recorded session was launched for. When the gateway cannot be reached, the
+  same four values, the factory id and the directory are kept in
+  `~/.outerlayer/spool/steps.jsonl`, and `outerlayer sync` sends them later.
+  Nothing from the session itself is sent.
 - **`outerlayer mcp serve`** is the stdio MCP server your editor spawns. It
   forwards every JSON-RPC message the editor sends to the gateway and returns
   the reply.
@@ -376,9 +408,11 @@ before it gives up.
 | `outerlayer emit artifact <file> --caption <text> [--for <criterion-id>] [--pr <n>]` | Upload a proof artifact — screenshot, recording, report, or log — with its caption. Inside a recorded session it spools locally and ships on the next `sync`; otherwise it uploads immediately, anchored to a pull request or the current checkout. `--replaces` retires artifacts an earlier run uploaded. A JUnit XML file bound with `--for` proves a criterion that declares `test` proof; `--test <name[=path:line]>` binds only the named tests. |
 | `outerlayer emit <name> --result <pass\|fail> [--link <url>] [--body <text>\|--body-file <path>] --item <number>` | Record one named check's outcome on a work item. A check that ran carries the run URL as its proof (`--link`); a judgment you are making yourself carries one sentence (`--body`, or `--body-file` to read it from a file — `-` reads standard input). A `fail` needs at least one of the two; a `pass` needs neither. `--item` names the work item by the number printed when the item was created — always required, in or out of a recorded session; a session records checks on its own item like any other, stored as the session's, but cannot clear a person's fail. Prints the recorded check's id. Who recorded it comes from your API key, never from what you send. |
 | `outerlayer work comment --item <n> [--criterion <id>] --body <text> [--artifact <id>] [--pass\|--fail\|--attach\|--ready]` | Post one comment on a work item's general thread, or on one acceptance criterion's own thread with `--criterion`. `--pass`/`--fail` need a person's own credential and apply to the whole item, so they work on the general thread only and the gateway refuses them with `--criterion`; `--attach` makes the named artifact that criterion's current proof; `--ready` hands a thread back to a person. The detected session id rides along automatically, only ever narrowing what the comment may do. |
+| `outerlayer work logs --item <n> [--attempt <claim id>]` | Print the runner's log for a host attempt on a work item: the newest attempt a runner made, or the one `--attempt` names (an `id` from `claims` in `work status --json`). The log is what the runner did around the agent, with secrets removed on the host. Exits 1 for an attempt that is still running or that an older runner released without a log. |
 | `outerlayer work threads --item <n>` | Read a work item's threads back — the general thread first, then one per criterion with proof or a comment, each with its `waitingOn`. |
 | `outerlayer emit finding --id <id> --category <context\|flaky-test\|tooling\|environment\|defect\|other> --title <text> --file <path> --where <label> [--line <n>] [--item <number>] [--cause <text>] [--detail <text>] [--suggestion <text>] [--command <text>] [--error <text>] [--test <name>] [--symbol <name>] [--started-at <event> --ended-at <event>] [--problem <id> … --link-reason <text> \| --new] …` | Record one problem you hit in the factory. `--category` is one of `context` (an instruction that is wrong, broken or missing), `flaky-test`, `tooling`, `environment`, `defect` (a bug outside your own change) or `other`. A `context` finding also needs `--rule-path` and `--rule-relation` (`wrong`, `broken` or `missing`), and `--rule-quote` unless the relation is `missing`. `--cause`, `--detail`, `--suggestion`, `--command`, `--error` (the first error line), `--test` and `--symbol` carry what a fix needs. Every finding joins a factory-level problem: when a key of the finding matches a known problem it joins that problem; otherwise nothing is stored, the closest problems are printed, and the command exits with code 3. Run it again with `--problem <id> --link-reason <text>` (repeat `--problem` for each problem the finding reports) or with `--new`. Without `--started-at`, it prints the session's recent events with ids and times; name the event where you hit the problem and the one where you got past it with `--started-at` and `--ended-at`. Findings are informational; nothing reads one to pass or fail the work. `--item` names the work item; without it, inside a recorded session, the item that session was launched for is used automatically. Re-emitting the same `--id` on the item replaces that finding and keeps its problems. |
 | `outerlayer emit findings <file> [--item <number>]` | Record a whole batch at once, read from a JSON file (`-` for standard input) with `"schemaVersion": 3` — the same shape and validation as `emit finding`, one record per id. A finding's `startedAt` and `endedAt` may be event ids. The findings that match a key are stored; those that need a choice are listed with their candidates and not stored, and the exit code is 3. Anchored the same way: `--item`, else a recorded session's own item. |
+| `outerlayer emit step <name> [--item <number>]` | Report that you started a step. The name is free text, 1 to 80 characters on one line. The work item's Activity tab shows the step with the time you ran the command. A step has a start and nothing else, so run it again at the start of the next step. `--item` names the work item; without it, inside a recorded session, the item that session was launched for is used. If the gateway cannot be reached, or answers with a 5xx, the step is queued in `~/.outerlayer/spool/steps.jsonl`, the command exits 0, and `outerlayer sync` sends it later with its original time. If the gateway refuses the step, the command prints why and exits 1. |
 | `outerlayer emit criteria <file> [--item <number>]` | Record a work item's acceptance criteria as one list, read from a JSON file (`-` for standard input): `{"criteria": [{"id": "AC-1", "text": "Given …", "proof": null}]}`. An `id` is 1 to 64 characters of `A-Z a-z 0-9 . _ : -`, the same id `emit artifact --for` binds evidence to. `proof` is `video`, `screenshot`, `report`, `log`, `test`, `file` or `null` (any bound artifact proves it). The list holds 1 to 200 criteria, each `text` at most 2,000 characters, with no id twice. It is validated before anything is sent. This list is the only source for the item's Criteria tab. Once an item has a list, only a person can replace it: run the command outside an agent session, with your own login. Anchored the same way as `emit findings`: `--item`, else a recorded session's own item. |
 | `outerlayer mcp install [--transport stdio\|http] [--url] [--name] [--command]` | Write (or update) an `mcpServers` entry in `.mcp.json` for the OuterLayer gateway. Default `stdio`: the client spawns `outerlayer mcp serve`, which reads the API key from `~/.outerlayer/config.json` (or `OUTERLAYER_API_KEY`) each time it connects, so a reconnect picks up a newly saved or rotated key. `--transport http` writes a direct `POST /v1/mcp` entry referencing `${OUTERLAYER_API_KEY}`, resolved by the client from the environment it was launched with. Never writes an API key. Pass `--url`/`--app-id` for self-host. |
 | `outerlayer mcp serve [--url] [--app-id]` | Stdio MCP server bridging stdin/stdout JSON-RPC to the gateway's `POST /v1/mcp`. What the stdio `.mcp.json` entry runs; exits 1 with a clear message when no API key is configured. |

package/dist/agent-setup-TPR4BBFV.js

@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+export { keepHandWritten, runAgentSetup } from './chunk-DJ3ZUSC3.js';
+import './chunk-ZHAUSEEN.js';
+import './chunk-YVZJ6GKF.js';
+import './chunk-6X4SQ5MY.js';
+import './chunk-ANPNT6PM.js';
+import './chunk-452TM7J4.js';
+import './chunk-IXYZUUYQ.js';
+import './chunk-FVMYKL6L.js';
+import './chunk-NTRCK4NH.js';
+import './chunk-ZJSNLVCE.js';
+import './chunk-BJ3KTMDH.js';
+import './chunk-NNLA7LLQ.js';
+import './chunk-WFSUUUAN.js';
+import './chunk-7VUK5RFS.js';
+import './chunk-EABW6AJQ.js';
+import './chunk-CRB3POP4.js';
+import './chunk-YQR6E6OV.js';
+import './chunk-VNVZDWO3.js';
+import './chunk-RA3O54FC.js';
+import './chunk-M2ZWWTWZ.js';
+import './chunk-N2PXGQRL.js';
+import './chunk-BQXFBI7T.js';
+import './chunk-Z5GEFMRW.js';
+
+createRequire(import.meta.url);

package/dist/{artifact-link-cmd-2F47LT7F.js → artifact-link-cmd-W7XF5BFB.js}

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { sanitizeTerminal, readEffectiveArtifactSpoolState } from './chunk-WUYTWNMA.js';
-import './chunk-J5M7BSJQ.js';
+import { sanitizeTerminal, readEffectiveArtifactSpoolState } from './chunk-G3IJ3N6F.js';
+import './chunk-7VUK5RFS.js';
+import { cliInvocation } from './chunk-CRB3POP4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import './chunk-Z5GEFMRW.js';
 
@@ -13,7 +14,7 @@ function lookupArtifactLink(artifactId, home = homeFromEnv()) {
   const entry = readEffectiveArtifactSpoolState(home).state.get(artifactId);
   if (entry === void 0) return { ok: false, reason: `no artifact ${shown} is queued or uploaded on this machine` };
   if (entry.state !== "uploaded") {
-    return { ok: false, reason: `artifact ${shown} is ${entry.state}, not uploaded yet \u2014 run \`outerlayer sync\` first` };
+    return { ok: false, reason: `artifact ${shown} is ${entry.state}, not uploaded yet \u2014 run \`${cliInvocation()} sync\` first` };
   }
   if (entry.url === void 0) {
     return { ok: false, reason: `artifact ${shown} uploaded, but the gateway returned no link for it` };

package/dist/{build-BG2YENGK.js → build-TQ6X5PYN.js}

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { buildRepositoryImage } from './chunk-R7PF5OOU.js';
+export { buildRepositoryImage } from './chunk-3CWUOFV6.js';
 export { RecipeError } from './chunk-QOZKPLVJ.js';
-import './chunk-N5FOE5PS.js';
 import './chunk-CX22S5BA.js';
-import './chunk-BYT5O5RV.js';
-import './chunk-ZM2IMMYN.js';
+import './chunk-ECODQ7II.js';
+import './chunk-JBJTC3UU.js';
+import './chunk-N2PXGQRL.js';
+import './chunk-BQXFBI7T.js';
 import './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-09T21:24:47.045Z+8773e8e","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-13T19:11:37.037Z+109c2bd","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{builder-2D3WSOOY.js → builder-C4QNTYMS.js}

@@ -1,13 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-4NPZVMJU.js';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-3UZTIRLF.js';
 import './chunk-7RQ73DLO.js';
-import './chunk-4Q7OMKAT.js';
 import './chunk-CX22S5BA.js';
-import './chunk-JXYVA45C.js';
-import './chunk-BYT5O5RV.js';
-import './chunk-J5M7BSJQ.js';
-import './chunk-ZM2IMMYN.js';
+import './chunk-QNLX477Q.js';
+import './chunk-7VUK5RFS.js';
+import './chunk-N2PXGQRL.js';
+import './chunk-BQXFBI7T.js';
 import './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);

package/dist/{check-5XE7XMC4.js → check-UWQAL2MN.js}

@@ -1,73 +1,77 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-WVUIRTWA.js';
-import './chunk-G5NPRL2K.js';
-import './chunk-RMWLBUCJ.js';
-import './chunk-O765JR4W.js';
-import './chunk-UGP76IZ5.js';
+import { probeCredentials } from './chunk-5MYFOW5V.js';
+import './chunk-6U3MV7TZ.js';
+import './chunk-MTP2QEVO.js';
+import './chunk-S5PCA3SN.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-YETTWTAY.js';
+import './chunk-SADUQSO4.js';
 import './chunk-I2UOAV7X.js';
-import './chunk-NNRTPG7X.js';
-import './chunk-HYZRY4KZ.js';
-import './chunk-ADJRGVZC.js';
-import './chunk-NWQTTSBB.js';
-import './chunk-HHJDN6AU.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-LWSJQJC6.js';
+import './chunk-BWSUPRDK.js';
+import './chunk-5GHGAF6P.js';
+import './chunk-XNGMQ27R.js';
+import './chunk-7SJPQWBM.js';
+import './chunk-KYS3TQAG.js';
+import './chunk-ESVW4MJY.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-DADWEUH3.js';
 import './chunk-YYYRBYWG.js';
-import './chunk-TI7B7UEO.js';
+import './chunk-AMFWYESY.js';
 import './chunk-TBT347UY.js';
-import './chunk-VQYBXPI7.js';
-import './chunk-ONKJUM6R.js';
-import './chunk-MAK5LYRF.js';
-import './chunk-KMDLFI4P.js';
-import './chunk-QKFB4K7X.js';
-import './chunk-RSNSZ2LJ.js';
-import './chunk-OZGHL5Y5.js';
-import './chunk-RLYZLUQ7.js';
+import './chunk-6D7GT22T.js';
+import './chunk-7YP7T6GV.js';
+import './chunk-UVG35MWF.js';
+import './chunk-7KSSBQTS.js';
+import './chunk-OGFGZQA3.js';
+import './chunk-VMJPFQNE.js';
+import './chunk-3UZTIRLF.js';
+import './chunk-GGOMT6KF.js';
+import './chunk-X5H2WYMB.js';
+import './chunk-XSZD4AZ6.js';
+import './chunk-QEFKA2QD.js';
 import { parseRunnerEnv } from './chunk-6MZSX4M7.js';
-import './chunk-S3NYLI2P.js';
-import './chunk-6Y5RUTHO.js';
-import './chunk-IP7BIBXJ.js';
-import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-22RMZBGW.js';
+import './chunk-HPJNLETG.js';
+import './chunk-IF2OSI5T.js';
+import './chunk-CG36IONK.js';
+import './chunk-G3IJ3N6F.js';
+import './chunk-BM63HB2M.js';
+import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-P53VEAOF.js';
 import './chunk-UXYLWVTQ.js';
-import './chunk-R7PF5OOU.js';
-import './chunk-QOZKPLVJ.js';
-import './chunk-N5FOE5PS.js';
-import './chunk-OGFGZQA3.js';
-import './chunk-4NPZVMJU.js';
 import './chunk-7RQ73DLO.js';
-import './chunk-4Q7OMKAT.js';
+import './chunk-3CWUOFV6.js';
+import './chunk-QOZKPLVJ.js';
 import './chunk-CX22S5BA.js';
+import './chunk-ECODQ7II.js';
+import './chunk-JBJTC3UU.js';
+import './chunk-NFIR3GEE.js';
 import './chunk-F7CU5ABH.js';
 import './chunk-BKO6JEZI.js';
-import './chunk-3NSNIIBE.js';
-import './chunk-WUYTWNMA.js';
-import './chunk-JXYVA45C.js';
-import './chunk-4KSQKQXE.js';
-import './chunk-N6LURUEF.js';
-import './chunk-YRYMNBGQ.js';
-import './chunk-GQD22KKN.js';
+import './chunk-QNLX477Q.js';
+import './chunk-GOSFARMS.js';
+import './chunk-ANPNT6PM.js';
+import './chunk-T2Q7ISPE.js';
 import './chunk-WZBHBH3J.js';
 import './chunk-5QRP3MVS.js';
-import './chunk-YZ5F4PIS.js';
-import './chunk-WTE3MQML.js';
-import './chunk-C5Y5ZJJZ.js';
+import './chunk-LLM3I5YU.js';
+import './chunk-452TM7J4.js';
+import './chunk-IXYZUUYQ.js';
+import './chunk-FVMYKL6L.js';
+import './chunk-NTRCK4NH.js';
 import './chunk-ZJSNLVCE.js';
-import './chunk-YO4PSLVB.js';
-import './chunk-BYT5O5RV.js';
-import './chunk-POJMEEJJ.js';
-import './chunk-OHVJA253.js';
-import './chunk-PLMTLGYH.js';
-import './chunk-J5M7BSJQ.js';
-import './chunk-EABW6AJQ.js';
-import './chunk-RA3O54FC.js';
-import './chunk-V7NIVOFD.js';
-import './chunk-ZM2IMMYN.js';
-import './chunk-BWQ66M6N.js';
-import './chunk-XCCLFVXM.js';
 import './chunk-BJ3KTMDH.js';
+import './chunk-G2YNJIGF.js';
+import './chunk-NNLA7LLQ.js';
+import './chunk-WFSUUUAN.js';
+import './chunk-7VUK5RFS.js';
+import './chunk-EABW6AJQ.js';
+import './chunk-CRB3POP4.js';
+import './chunk-YQR6E6OV.js';
+import './chunk-TUSYOL2O.js';
 import './chunk-VNVZDWO3.js';
+import './chunk-RA3O54FC.js';
+import './chunk-M2ZWWTWZ.js';
+import './chunk-N2PXGQRL.js';
+import './chunk-BQXFBI7T.js';
 import './chunk-Z5GEFMRW.js';
 import { readFileSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-R7PF5OOU.js → chunk-3CWUOFV6.js}

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { RecipeError, locateRecipe, readRecipe, assertBuildable, writeSanitizedRecipe, classifyProperties, SANITIZED_NAME } from './chunk-QOZKPLVJ.js';
-import { startTimeOf, claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-N5FOE5PS.js';
 import { CLAUDE_CODE_VERSION, NODE_IMAGE, DEFAULT_BASE_IMAGE, TINI_VERSION, GH_VERSION, GH_SHA256, TINI_SHA256 } from './chunk-CX22S5BA.js';
-import { withGitConfig, tokenHeader } from './chunk-BYT5O5RV.js';
-import { RUNNER_DIR_MODE, repoCacheDir, imagesDir, attemptStamp, runnerDir, rootfsPathFor, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
+import { claimPidFile, RunnerAlreadyRunningError, releasePidFile } from './chunk-ECODQ7II.js';
+import { startTimeOf } from './chunk-JBJTC3UU.js';
+import { RUNNER_DIR_MODE, repoCacheDir, imagesDir, attemptStamp, runnerDir, rootfsPathFor, RUNNER_FILE_MODE } from './chunk-N2PXGQRL.js';
+import { withGitConfig, tokenHeader } from './chunk-BQXFBI7T.js';
 import { mkdirSync, rmSync, existsSync, mkdtempSync, cpSync, readFileSync, writeFileSync, readdirSync, lstatSync, readlinkSync } from 'fs';
 import { tmpdir } from 'os';
 import { dirname, join } from 'path';
@@ -36,6 +37,10 @@ function git(cwd, args, timeoutMs, extend = (env) => env) {
     );
   });
 }
+function gitFailureLine(err) {
+  const lines = (err instanceof Error ? err.message : String(err)).replace(/^git [\w-]+ failed: /, "").split("\n").map((line) => line.trim()).filter((line) => line !== "");
+  return lines.find((line) => !/^warning:/i.test(line)) ?? lines[0] ?? "";
+}
 function defaultBranchOf(lsRemote) {
   const match = lsRemote.match(/^ref: refs\/heads\/(\S+)\s+HEAD$/m);
   return match ? match[1] : null;
@@ -90,7 +95,7 @@ async function readBranchHead(input) {
   try {
     out = await git(input.dir, ["ls-remote", "--heads", input.remote, `refs/heads/${input.branch}`], HEAD_TIMEOUT_MS, credential);
   } catch (err) {
-    return { kind: "unreadable", reason: (err instanceof Error ? err.message : String(err)).replace(/^git [\w-]+ failed: /, "").split("\n")[0] };
+    return { kind: "unreadable", reason: gitFailureLine(err) };
   }
   const sha = out.match(/^([0-9a-f]{40}|[0-9a-f]{64})\trefs\/heads\//m)?.[1];
   return sha === void 0 ? { kind: "absent" } : { kind: "found", sha };
@@ -102,9 +107,10 @@ async function fetchCommit(input) {
     await git(input.dir, ["init", "--quiet"]);
     await git(input.dir, ["fetch", "--quiet", "--depth", "1", "--no-tags", input.remote, input.commit], CLONE_TIMEOUT_MS, credential);
     await git(input.dir, ["checkout", "--quiet", "--detach", "--force", "FETCH_HEAD"]);
+    if (input.clean === true) await git(input.dir, ["clean", "-ffdx", "--quiet"]);
     return { ok: true };
   } catch (err) {
-    const detail = (err instanceof Error ? err.message : String(err)).replace(/^git [\w-]+ failed: /, "").split("\n")[0];
+    const detail = gitFailureLine(err);
     return { ok: false, reason: `the fetch of ${input.commit.slice(0, 8)} from ${input.remote} failed: ${detail}` };
   }
 }
@@ -122,7 +128,7 @@ async function diffBetween(input) {
     );
     return { ok: true };
   } catch (err) {
-    const detail = (err instanceof Error ? err.message : String(err)).replace(/^git [\w-]+ failed: /, "").split("\n")[0];
+    const detail = gitFailureLine(err);
     return { ok: false, reason: `the diff of ${input.head.slice(0, 8)} from ${input.base.slice(0, 8)} could not be read from ${input.remote}: ${detail}` };
   }
 }
@@ -189,9 +195,9 @@ function toolsDockerfile(parts) {
     " && chmod 1777 /out/build",
     ...parts.guestHelper === true ? [
       "COPY guest/outerlayer-guest /out/opt/outerlayer/bin/outerlayer-guest",
-      // The guest mounts the build's tmpfs, the kernel's file systems and the run directory over these.
+      // The guest mounts the build's tmpfs, the kernel's file systems and the run directory over these. The judge's tmpfs is mounted over its directory when the judge runs.
       "RUN chmod 0755 /out/opt/outerlayer/bin/outerlayer-guest \\",
-      " && mkdir -p /out/outerlayer/job /out/run /out/proc /out/sys /out/dev"
+      " && mkdir -p /out/outerlayer/job /out/outerlayer/judge /out/run /out/proc /out/sys /out/dev"
     ] : [],
     `RUN set -eu \\`,
     ` && case "$TARGETARCH" in \\`,
@@ -295,6 +301,11 @@ function splitRepository(repository) {
   }
   return { full, owner: parts[0], name: parts[1] };
 }
+async function fetchPinnedCommit(opts) {
+  const fetched = await fetchCommit({ remote: opts.remote, dir: opts.dir, commit: opts.commit, token: opts.token, clean: true });
+  if (!fetched.ok) throw new RecipeError("repository_unreadable", `cannot read ${opts.repository}: ${fetched.reason}`);
+  return { dir: opts.dir, defaultBranch: opts.ref, commit: opts.commit };
+}
 function metadataOf(image) {
   try {
     const parsed = JSON.parse(image.labels["devcontainer.metadata"] ?? "[]");
@@ -345,12 +356,8 @@ async function buildRepositoryImage(opts, ports) {
     throw err;
   }
   try {
-    const checkout = await fetchDefaultBranch({
-      remote: opts.remote ?? `https://github.com/${owner}/${name}.git`,
-      dir: cacheDir,
-      token: opts.readToken,
-      repository
-    });
+    const remote = opts.remote ?? `https://github.com/${owner}/${name}.git`;
+    const checkout = opts.pinned === void 0 ? await fetchDefaultBranch({ remote, dir: cacheDir, token: opts.readToken, repository }) : await fetchPinnedCommit({ remote, dir: cacheDir, token: opts.readToken, repository, ...opts.pinned });
     const location = locateRecipe(checkout.dir);
     const recipe = readRecipe(checkout.dir, location);
     assertBuildable(checkout.dir, location, recipe);

package/dist/{chunk-4NPZVMJU.js → chunk-3UZTIRLF.js}

@@ -1,15 +1,70 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { parseSize } from './chunk-7RQ73DLO.js';
-import { JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_PORT, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-4Q7OMKAT.js';
 import { BUILDKIT_IMAGE } from './chunk-CX22S5BA.js';
-import { compareVersions } from './chunk-JXYVA45C.js';
-import { runnerDir } from './chunk-ZM2IMMYN.js';
+import { compareVersions } from './chunk-QNLX477Q.js';
+import { runnerDir } from './chunk-N2PXGQRL.js';
+import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-BQXFBI7T.js';
 import { createHash } from 'crypto';
 import { realpathSync } from 'fs';
 import { join, dirname, resolve } from 'path';
 
 createRequire(import.meta.url);
+
+// src/runner/judge-command.ts
+var JUDGE_DIR = "/outerlayer/judge";
+var JUDGE_HOME = `${JUDGE_DIR}/home`;
+var JUDGE_TREE = `${JUDGE_DIR}/tree`;
+var JUDGE_REPORT = `${JUDGE_DIR}/report.html`;
+var JUDGE_PROGRAM = "/opt/outerlayer/claude/bin/claude";
+var MAX_REPORT_BYTES = 5 * 1024 * 1024;
+var JUDGE_MAX_TURNS = 60;
+var JUDGE_PATH = "/opt/outerlayer/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
+var JUDGE_TOOLS = "Read,Grep,Glob,Write";
+function judgeCommand(input) {
+  const env = {
+    HOME: JUDGE_HOME,
+    TMPDIR: `${JUDGE_HOME}/tmp`,
+    PATH: JUDGE_PATH,
+    ANTHROPIC_BASE_URL: `http://127.0.0.1:${CLAUDE_PORT}`,
+    CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1",
+    DISABLE_AUTOUPDATER: "1",
+    ...input.credential === void 0 ? {} : { [input.credential.variable]: input.credential.placeholder }
+  };
+  const argv = [
+    JUDGE_PROGRAM,
+    "-p",
+    "--output-format",
+    "json",
+    "--setting-sources",
+    "user",
+    "--strict-mcp-config",
+    "--disable-slash-commands",
+    "--no-session-persistence",
+    "--tools",
+    JUDGE_TOOLS,
+    "--allowedTools",
+    // A path that starts with two slashes is absolute in a permission rule.
+    `Read(/${JUDGE_DIR}/**),Edit(/${JUDGE_REPORT})`,
+    "--add-dir",
+    JUDGE_TREE,
+    "--permission-mode",
+    "dontAsk",
+    "--max-turns",
+    String(JUDGE_MAX_TURNS),
+    // After the separator, so a brief that starts with a dash is not read as an option.
+    "--",
+    input.brief
+  ];
+  return { argv, env, cwd: JUDGE_DIR };
+}
+var HASH_SCRIPT = 'const fs=require("fs"),c=require("crypto");const p=fs.realpathSync(process.argv[1]);process.stdout.write(c.createHash("sha256").update(fs.readFileSync(p)).digest("hex")+" "+p+"\\n")';
+var HASH_ARGV = ["/opt/outerlayer/bin/node", "-e", HASH_SCRIPT, JUDGE_PROGRAM];
+function parseProgramHash(stdout) {
+  return /^([0-9a-f]{64}) /.exec(stdout.trim())?.[1];
+}
+
+// src/runner/container/run-args.ts
 var BUILD_LABEL = "ai.outerlayer.build";
 var RUNNER_LABEL = "ai.outerlayer.runner";
 function resolvedRunnerDir(configPath) {
@@ -71,6 +126,7 @@ function containerRunArgs(input) {
     `type=volume,src=${input.volume},dst=/tmp,volume-subpath=tmp`,
     "--mount",
     `type=bind,src=${mountPath(input.buildDir)},dst=${JOB_MOUNT},readonly`,
+    ...input.judgeDir === void 0 ? [] : ["--mount", `type=bind,src=${mountPath(input.judgeDir)},dst=${JUDGE_DIR}`],
     "--entrypoint",
     "/opt/outerlayer/bin/tini",
     input.image,
@@ -261,4 +317,4 @@ function ensureBuilder(rawRun, spec, options = {}) {
   );
 }
 
-export { BUILD_LABEL, MIN_BUILDX_VERSION, RUNNER_LABEL, builderName, builderSpec, buildxState, containerExecArgs, containerRunArgs, ensureBuilder, ensureFailureCount, isOutOfMemory, prepareRunArgs, proxyEnvironment, runnerLabelValue, trackImageBuild };
+export { BUILD_LABEL, HASH_ARGV, JUDGE_DIR, JUDGE_MAX_TURNS, JUDGE_PROGRAM, MAX_REPORT_BYTES, MIN_BUILDX_VERSION, RUNNER_LABEL, builderName, builderSpec, buildxState, containerExecArgs, containerRunArgs, ensureBuilder, ensureFailureCount, isOutOfMemory, judgeCommand, parseProgramHash, prepareRunArgs, proxyEnvironment, runnerLabelValue, trackImageBuild };