@outerlayer/cli 0.17.0 → 0.19.0

package/dist/{chunk-HGECYFEI.js → chunk-5TN7GLYX.js}

@@ -1,21 +1,22 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { checkStarterFiles, contextIsGoverned } from './chunk-NBGDBTO2.js';
-import { resolveCredentials, getJson, WorkCommandError } from './chunk-S3NYLI2P.js';
-import { readStatuslineState, STATE_FRESH_MS } from './chunk-F47JBIAW.js';
-import { isLinkedRepository } from './chunk-3NSNIIBE.js';
-import { sanitizeTerminal } from './chunk-WUYTWNMA.js';
-import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-JXYVA45C.js';
-import { C } from './chunk-YRYMNBGQ.js';
+import { checkStarterFiles, contextIsGoverned } from './chunk-TWF3RICI.js';
+import { resolveCredentials, getJson, WorkCommandError } from './chunk-HPJNLETG.js';
+import { isLinkedRepository } from './chunk-CG36IONK.js';
+import { sanitizeTerminal } from './chunk-G3IJ3N6F.js';
+import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-NFIR3GEE.js';
+import { readStatuslineState, STATE_FRESH_MS } from './chunk-DSF2FWAZ.js';
+import { resolveRepoIdentity, compareVersions, SUPPORTED_VERSIONS } from './chunk-QNLX477Q.js';
+import { C } from './chunk-ANPNT6PM.js';
 import { readSettings, settingsPath, isOurStatuslineSlot, statuslineWrappedOriginal, REGISTERED_EVENTS, isOurHookCommand, ourCommandBins, cliBinResolvable, ourDirectScriptBins, wrappedOriginalCommand } from './chunk-5QRP3MVS.js';
-import { readPin, readContextManifest, readDegraded, readSourceCache } from './chunk-WTE3MQML.js';
-import { checkFormerSkillNames } from './chunk-C5Y5ZJJZ.js';
-import { defaultFetch } from './chunk-YO4PSLVB.js';
-import { resolveGatewayCredentials } from './chunk-PLMTLGYH.js';
-import { readCloudConfig } from './chunk-EABW6AJQ.js';
-import { sanitizeForContext, spoolDir, assessSyncHealth, readSyncStatus, SYNC_STALE_AFTER_MS, formatAgo, checkInstalledCliStaleness, workspaceRootOf, hookFiredMarkerPath, refreshCommand } from './chunk-BWQ66M6N.js';
-import { deadHooksState, preparePackageManagerCommand, contextExcludesPresent } from './chunk-XCCLFVXM.js';
+import { checkFormerSkillNames } from './chunk-IXYZUUYQ.js';
+import { defaultFetch } from './chunk-FVMYKL6L.js';
+import { resolveGatewayCredentials } from './chunk-NTRCK4NH.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
+import { hookCommandEscapesControlPlane, CONTROL_PLANE_DIR_VARIABLE } from './chunk-G2YNJIGF.js';
+import { cliInvocation } from './chunk-CRB3POP4.js';
+import { readDeliveryRecord, readDegraded, readSourceCache } from './chunk-YQR6E6OV.js';
+import { deadHooksState, preparePackageManagerCommand } from './chunk-TUSYOL2O.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync, existsSync, accessSync, constants, statSync, readdirSync, realpathSync } from 'fs';
 import { join, dirname, resolve, delimiter } from 'path';
@@ -192,13 +193,15 @@ function runDoctor(env = {}) {
     ...starter?.checks ?? [],
     ...laptop ? checkRenamedSkills(env.cwd) : [],
     ...starter !== void 0 && !starter.mcpOutdated ? checkMcpCommand(env.cwd, env.processEnv) : [],
-    ...checkContextSource(home, env.cwd),
+    ...checkContextSource(env.cwd),
+    ...checkGovernsList(env.cwd),
+    ...checkControlPlaneHooks(env.cwd),
     ...checkInstalledCli(home, env.cwd ?? process.cwd())
   ];
 }
 function checkRenamedSkills(cwd) {
   const dirs = findGitDirs(cwd ?? process.cwd());
-  if (dirs === void 0 || contextIsGoverned(dirs.repoRoot, dirs.gitCommonDir)) return [];
+  if (dirs === void 0 || contextIsGoverned(dirs.gitCommonDir)) return [];
   return checkFormerSkillNames(dirs.repoRoot);
 }
 function checkInstalledCli(home, cwd) {
@@ -275,11 +278,11 @@ function checkStatusline(home, now, cwd) {
         name,
         status: "warn",
         detail: `the OuterLayer segment was installed (recorded ${record.updatedAt}) but the slot no longer holds it \u2014 settings were rewritten or reset${record.original !== void 0 ? `; it wrapped: ${record.original}` : ""}`,
-        fix: "Run `outerlayer init` to reinstall the segment."
+        fix: `Run \`${cliInvocation()} init\` to reinstall the segment.`
       }];
     }
     return [
-      foreign !== void 0 ? { name, status: "warn", detail: `slot occupied by: ${foreign}`, fix: "Run `outerlayer init` to add the OuterLayer segment (wraps the existing command, never replaces it)." } : { name, status: "warn", detail: "not installed", fix: "Run `outerlayer init`." }
+      foreign !== void 0 ? { name, status: "warn", detail: `slot occupied by: ${foreign}`, fix: `Run \`${cliInvocation()} init\` to add the OuterLayer segment (wraps the existing command, never replaces it).` } : { name, status: "warn", detail: "not installed", fix: `Run \`${cliInvocation()} init\`.` }
     ];
   }
   const checks = [
@@ -288,12 +291,12 @@ function checkStatusline(home, now, cwd) {
   const stateName = "Status-line state";
   const state = readStatuslineState(home);
   if (!state) {
-    checks.push({ name: stateName, status: "warn", detail: "no state file \u2014 line runs degraded (session cost only)", fix: "Start `outerlayer daemon` (it maintains this file)." });
+    checks.push({ name: stateName, status: "warn", detail: "no state file \u2014 line runs degraded (session cost only)", fix: `Start \`${cliInvocation()} daemon\` (it maintains this file).` });
     return checks;
   }
   const age = now() - Date.parse(state.generatedAt);
   if (!Number.isFinite(age) || age > STATE_FRESH_MS) {
-    checks.push({ name: stateName, status: "warn", detail: `state ${formatAgo(age)} \u2014 line runs degraded`, fix: "Restart `outerlayer daemon`." });
+    checks.push({ name: stateName, status: "warn", detail: `state ${formatAgo(age)} \u2014 line runs degraded`, fix: `Restart \`${cliInvocation()} daemon\`.` });
     return checks;
   }
   checks.push({ name: stateName, status: "pass", detail: `fresh (${formatAgo(age)})` });
@@ -339,7 +342,7 @@ function checkTranscripts(transcripts, now) {
     return { name: "Transcripts", status: "warn", detail: "no projects directory yet", fix: "Run a Claude Code session, then re-check." };
   }
   if (transcripts.count === 0) {
-    return { name: "Transcripts", status: "warn", detail: "0 transcripts found", fix: "Run a Claude Code session, then run `outerlayer doctor` again." };
+    return { name: "Transcripts", status: "warn", detail: "0 transcripts found", fix: `Run a Claude Code session, then run \`${cliInvocation()} doctor\` again.` };
   }
   const age = formatAgeH(now() - transcripts.newest);
   return { name: "Transcripts", status: "pass", detail: `${transcripts.count} transcripts, newest ${age}` };
@@ -402,7 +405,7 @@ function checkHooksInstalled(home, cwd, firingFresh) {
           name,
           status: "fail",
           detail: `hooks in ${path} run ${missing.join(", ")}, which no longer exists \u2014 no session is being captured`,
-          fix: "Run `outerlayer init` to reinstall."
+          fix: `Run \`${cliInvocation()} init\` to reinstall.`
         };
       }
       const unexecutable = ourDirectScriptBins(settings).filter((bin) => !isExecutable(bin));
@@ -411,13 +414,13 @@ function checkHooksInstalled(home, cwd, firingFresh) {
           name,
           status: "fail",
           detail: `hooks in ${path} run ${unexecutable.join(", ")} directly, and it is not executable \u2014 every hook fails with "Permission denied" and no session is linked to its work item`,
-          fix: "Run `outerlayer init` to rewrite the hooks so they run through node."
+          fix: `Run \`${cliInvocation()} init\` to rewrite the hooks so they run through node.`
         };
       }
       return { name, status: "pass", detail: `${installed.join(", ")} (${scope})` };
     }
     if (installed.length > 0) {
-      return { name, status: "warn", detail: `only ${installed.join(", ")} installed`, fix: "Run `outerlayer init` to (re)install all lifecycle hooks." };
+      return { name, status: "warn", detail: `only ${installed.join(", ")} installed`, fix: `Run \`${cliInvocation()} init\` to (re)install all lifecycle hooks.` };
     }
   }
   const manifest = readManifest(home);
@@ -428,13 +431,13 @@ function checkHooksInstalled(home, cwd, firingFresh) {
       name,
       status: "fail",
       detail: `hooks were installed into ${recorded} (recorded ${record.updatedAt}) but the settings file no longer contains them \u2014 it was rewritten or reset`,
-      fix: "Run `outerlayer init` to reinstall."
+      fix: `Run \`${cliInvocation()} init\` to reinstall.`
     };
   }
   if (firingFresh) {
     return { name, status: "pass", detail: "not in user/project settings, but hooks are firing \u2014 installed in another scope (managed settings?)" };
   }
-  return { name, status: "fail", detail: "no OuterLayer hooks found", fix: "Run `outerlayer init`." };
+  return { name, status: "fail", detail: "no OuterLayer hooks found", fix: `Run \`${cliInvocation()} init\`.` };
 }
 function checkWrappedHooks(home, cwd) {
   const manifest = readManifest(home);
@@ -469,7 +472,7 @@ function checkWrappedHooks(home, cwd) {
     name: "Wrapped hooks",
     status: "warn",
     detail: `recorded as wrapped but the settings no longer carry the wrapped form \u2014 ${missing.join("; ")}`,
-    fix: "Run `outerlayer hooks wrap` to re-wrap, or `outerlayer hooks unwrap` if the wrap is no longer wanted."
+    fix: `Run \`${cliInvocation()} hooks wrap\` to re-wrap, or \`${cliInvocation()} hooks unwrap\` if the wrap is no longer wanted.`
   };
 }
 function checkHooksFiring(transcripts, lastFired, now) {
@@ -488,7 +491,7 @@ function checkHooksFiring(transcripts, lastFired, now) {
       name,
       status: "fail",
       detail: `sessions as recent as ${formatAgeH(now() - transcripts.newest)}, but no lifecycle hook has fired since ${formatAgeH(now() - lastFired)}`,
-      fix: "Hooks are configured but not running \u2014 run `outerlayer init` and check `claude --debug` hook output."
+      fix: `Hooks are configured but not running \u2014 run \`${cliInvocation()} init\` and check \`claude --debug\` hook output.`
     };
   }
   return { name, status: "pass", detail: `last fired ${formatAgeH(now() - lastFired)}` };
@@ -504,7 +507,7 @@ function checkDeadHooksState(cwd) {
         name,
         status: "fail",
         detail: `${sanitizeForContext(state.hooksDir)} could not be read (${state.unreadableError.code ?? state.unreadableError.message}) \u2014 git's hooks status is unknown, not confirmed healthy`,
-        fix: "Fix the directory's permissions so it can be listed, then re-run `outerlayer doctor`."
+        fix: `Fix the directory's permissions so it can be listed, then re-run \`${cliInvocation()} doctor\`.`
       }
     ];
   }
@@ -536,15 +539,15 @@ function checkSpoolWritable(home) {
 function checkLastSync(home, now) {
   const name = "Cloud sync";
   if (!existsSync(join(home, ".outerlayer", "config.json"))) {
-    return { name, status: "warn", detail: "not configured \u2014 sessions stay on this machine", fix: "Run `outerlayer login` to connect." };
+    return { name, status: "warn", detail: "not configured \u2014 sessions stay on this machine", fix: `Run \`${cliInvocation()} login\` to connect.` };
   }
   const health = assessSyncHealth(readSyncStatus(home), now(), SYNC_STALE_AFTER_MS);
   const detail = [health.headline, ...health.details].join("; ");
   if (health.level === "error") {
-    return { name, status: "fail", detail, fix: "Check the destination and API key in ~/.outerlayer/config.json, then run `outerlayer sync` to see the full error." };
+    return { name, status: "fail", detail, fix: `Check the destination and API key in ~/.outerlayer/config.json, then run \`${cliInvocation()} sync\` to see the full error.` };
   }
   if (health.level === "warn" || health.level === "unknown") {
-    return { name, status: "warn", detail, fix: "Run `outerlayer sync` to confirm the connection works." };
+    return { name, status: "warn", detail, fix: `Run \`${cliInvocation()} sync\` to confirm the connection works.` };
   }
   return { name, status: "pass", detail };
 }
@@ -552,17 +555,17 @@ function checkDaemon(home) {
   const pidfile = join(home, ".outerlayer", "daemon.pid");
   const heartbeat = join(home, ".outerlayer", "daemon.heartbeat");
   if (!existsSync(pidfile)) {
-    return { name: "Daemon running", status: "warn", detail: "not running", fix: "Start it with `outerlayer daemon` (or a login agent)." };
+    return { name: "Daemon running", status: "warn", detail: "not running", fix: `Start it with \`${cliInvocation()} daemon\` (or a login agent).` };
   }
   try {
     const beatMs = statSync(heartbeat).mtimeMs;
     const staleMin = (Date.now() - beatMs) / 6e4;
     if (staleMin > 30) {
-      return { name: "Daemon running", status: "warn", detail: `heartbeat ${Math.round(staleMin)}m stale`, fix: "Restart `outerlayer daemon`." };
+      return { name: "Daemon running", status: "warn", detail: `heartbeat ${Math.round(staleMin)}m stale`, fix: `Restart \`${cliInvocation()} daemon\`.` };
     }
     return { name: "Daemon running", status: "pass", detail: "heartbeat fresh" };
   } catch {
-    return { name: "Daemon running", status: "warn", detail: "pidfile present, no heartbeat", fix: "Restart `outerlayer daemon`." };
+    return { name: "Daemon running", status: "warn", detail: "pidfile present, no heartbeat", fix: `Restart \`${cliInvocation()} daemon\`.` };
   }
 }
 function checkCleanupPeriod(home) {
@@ -580,11 +583,11 @@ function checkCleanupPeriod(home) {
       name: "Retention (cleanupPeriodDays)",
       status: "fail",
       detail: "set to 0 \u2014 this DISABLES transcript persistence (upstream anthropics/claude-code#23710 and #59248)",
-      fix: "Remove cleanupPeriodDays or set it \u226514; run `outerlayer daemon` to mirror before deletion."
+      fix: `Remove cleanupPeriodDays or set it \u226514; run \`${cliInvocation()} daemon\` to mirror before deletion.`
     };
   }
   if (days < 14) {
-    return { name: "Retention (cleanupPeriodDays)", status: "warn", detail: `${days}d \u2014 transcripts deleted quickly`, fix: "Run `outerlayer daemon` so raws are mirrored before cleanup." };
+    return { name: "Retention (cleanupPeriodDays)", status: "warn", detail: `${days}d \u2014 transcripts deleted quickly`, fix: `Run \`${cliInvocation()} daemon\` so raws are mirrored before cleanup.` };
   }
   return { name: "Retention (cleanupPeriodDays)", status: "pass", detail: `${days}d` };
 }
@@ -606,7 +609,7 @@ function checkClaudeVersion(env) {
   const parsed = version.match(/\d+\.\d+\.\d+/)?.[0];
   if (!parsed) return { name: "Claude Code version", status: "warn", detail: `unrecognized: ${version}` };
   if (compareVersions(parsed, SUPPORTED_VERSIONS.max) > 0) {
-    return { name: "Claude Code version", status: "warn", detail: `${parsed} is newer than validated (${SUPPORTED_VERSIONS.max}) \u2014 parser runs best-effort`, fix: "Update OuterLayer if you see parse warnings." };
+    return { name: "Claude Code version", status: "pass", detail: `${parsed} (newer than ${SUPPORTED_VERSIONS.max}, the latest version this release was tested with)` };
   }
   if (compareVersions(parsed, SUPPORTED_VERSIONS.min) < 0) {
     return { name: "Claude Code version", status: "warn", detail: `${parsed} is older than validated (${SUPPORTED_VERSIONS.min})` };
@@ -666,29 +669,96 @@ function defaultClaudeInstalls() {
 function contextDegradedFix(kind) {
   switch (kind) {
     case "unreachable":
-      return "Check network/VPN access to the control plane, then run `outerlayer context materialize`.";
+      return `Check network/VPN access to the control plane, then start Claude Code with \`${cliInvocation()} claude\`.`;
     case "no-access":
       return "Check your git credentials (SSH key or token) and org/SSO access to the control plane, then retry.";
     case "designation-unverified":
-      return "Check OuterLayer cloud connectivity/config (~/.outerlayer/config.json), then run `outerlayer context materialize`.";
+      return `Check OuterLayer cloud connectivity/config (~/.outerlayer/config.json), then start Claude Code with \`${cliInvocation()} claude\`.`;
     case "not-governed":
-      return "Expected if the control plane's `governs` list changed intentionally; otherwise re-designate the source.";
+      return "A record from an earlier CLI. It is cleared the next time `outerlayer claude` asks which control plane governs this repository.";
     case "adoption-conflict":
-      return "Remove the committed AGENTS.md/.claude/.outerlayer files in a commit, then run `outerlayer context materialize`.";
+      return "A record from an earlier CLI. Committed AGENTS.md or .claude files no longer block the control plane, and the record is cleared the next time `outerlayer claude` asks which control plane governs this repository.";
     case "conflict":
-      return "Revoke the designation from all but one of the claiming factories, then run `outerlayer context materialize`.";
+      return `This record is stale: a gateway that stores the control plane never reports two. Start Claude Code with \`${cliInvocation()} claude\` to clear it.`;
   }
 }
-function checkContextSource(home, cwd) {
-  const dir = cwd ?? process.cwd();
+function checkGovernsList(cwd) {
   let repoRoot;
-  let gitCommonDir;
   try {
-    repoRoot = execFileSync("git", ["-C", dir, "rev-parse", "--show-toplevel"], {
+    repoRoot = execFileSync("git", ["-C", cwd ?? process.cwd(), "rev-parse", "--show-toplevel"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
       timeout: 2e3
     }).trim();
+  } catch {
+    return [];
+  }
+  let config;
+  try {
+    config = JSON.parse(readFileSync(join(repoRoot, ".outerlayer", "config.json"), "utf8"));
+  } catch {
+    return [];
+  }
+  if (typeof config !== "object" || config === null || !("governs" in config)) return [];
+  return [
+    {
+      name: "Governs list",
+      status: "warn",
+      detail: "`governs` in .outerlayer/config.json is ignored. A control plane governs every repository its factory links, so the list decides nothing.",
+      fix: "Delete `governs` from .outerlayer/config.json once every machine and runner host runs CLI 0.17.0 or later. Older CLIs still read it."
+    }
+  ];
+}
+function hookCommandsOf(settings) {
+  const hooks = settings?.hooks;
+  if (typeof hooks !== "object" || hooks === null) return [];
+  const commands = [];
+  for (const groups of Object.values(hooks)) {
+    if (!Array.isArray(groups)) continue;
+    for (const group of groups) {
+      const entries = group?.hooks;
+      if (!Array.isArray(entries)) continue;
+      for (const entry of entries) {
+        const command = entry?.command;
+        if (typeof command === "string") commands.push(command);
+      }
+    }
+  }
+  return commands;
+}
+function checkControlPlaneHooks(cwd) {
+  let repoRoot;
+  try {
+    repoRoot = execFileSync("git", ["-C", cwd ?? process.cwd(), "rev-parse", "--show-toplevel"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 2e3
+    }).trim();
+  } catch {
+    return [];
+  }
+  if (!existsSync(join(repoRoot, ".outerlayer"))) return [];
+  let settings;
+  try {
+    settings = JSON.parse(readFileSync(join(repoRoot, ".claude", "settings.json"), "utf8"));
+  } catch {
+    return [];
+  }
+  const escaping = hookCommandsOf(settings).filter(hookCommandEscapesControlPlane);
+  if (escaping.length === 0) return [];
+  return [
+    {
+      name: "Control plane hook paths",
+      status: "warn",
+      detail: `${escaping.length === 1 ? "this hook command reaches" : "these hook commands reach"} a .claude directory by a path a governed build does not provide, so ${escaping.length === 1 ? "it fails" : "they fail"} there without a message: ${escaping.map((command) => `\`${command}\``).join(", ")}`,
+      fix: `Name the script as \`\${${CONTROL_PLANE_DIR_VARIABLE}:-$CLAUDE_PROJECT_DIR}/.claude/\u2026\`. A governed build sets ${CONTROL_PLANE_DIR_VARIABLE} to where it reads the control plane; a checkout that holds its own copy falls back to the project directory.`
+    }
+  ];
+}
+function checkContextSource(cwd) {
+  const dir = cwd ?? process.cwd();
+  let gitCommonDir;
+  try {
     gitCommonDir = execFileSync("git", ["-C", dir, "rev-parse", "--path-format=absolute", "--git-common-dir"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
@@ -697,72 +767,31 @@ function checkContextSource(home, cwd) {
   } catch {
     return [];
   }
-  if (!repoRoot || !gitCommonDir) return [];
-  const pin = readPin(repoRoot);
-  const manifest = readContextManifest(gitCommonDir);
+  if (!gitCommonDir) return [];
+  const delivery = readDeliveryRecord(gitCommonDir);
   const degraded = readDegraded(gitCommonDir);
-  const sourceCache = readSourceCache(gitCommonDir);
-  const looksGoverned = pin !== void 0 || sourceCache?.status === "governed";
-  if (!pin && !manifest && !degraded && !looksGoverned) return [];
+  const governed = readSourceCache(gitCommonDir)?.status === "governed";
+  if (!governed && delivery === void 0 && !degraded) return [];
   const checks = [];
   const name = "Context source";
-  if (pin && manifest && pin.sha !== manifest.sha) {
+  if (delivery !== void 0 && existsSync(delivery.dir)) {
+    checks.push({ name, status: degraded ? "warn" : "pass", detail: `control plane delivered at ${delivery.sha.slice(0, 7)}` });
+  } else if (governed) {
     checks.push({
       name,
       status: "warn",
-      detail: `pin (${pin.sha.slice(0, 7)}) and manifest (${manifest.sha.slice(0, 7)}) disagree`,
-      fix: "Run `outerlayer context materialize` to reconcile."
+      detail: delivery === void 0 ? "a control plane governs this repository, and no copy of it has been delivered to this machine" : `the delivered control plane is no longer at ${delivery.dir}`,
+      fix: `Start Claude Code with \`${cliInvocation()} claude\`.`
     });
-  } else if (pin ?? manifest) {
-    const sha = (pin ?? manifest).sha;
-    checks.push({ name, status: degraded ? "warn" : "pass", detail: `materialized at ${sha.slice(0, 7)}` });
   }
   if (degraded) {
     checks.push({
       name: "Context source degradation",
-      status: degraded.kind === "adoption-conflict" || degraded.kind === "conflict" ? "fail" : "warn",
+      status: degraded.kind === "conflict" ? "fail" : "warn",
       detail: degraded.message,
       fix: contextDegradedFix(degraded.kind)
     });
   }
-  if ((pin || manifest) && !contextExcludesPresent(gitCommonDir)) {
-    checks.push({
-      name: "Context exclude block",
-      status: "warn",
-      detail: "materialized paths are not excluded in .git/info/exclude",
-      fix: "Run `outerlayer context materialize` to repair it."
-    });
-  }
-  if (pin && !readCloudConfig(home).url) {
-    checks.push({
-      name,
-      status: "warn",
-      detail: "a pin exists but OuterLayer cloud sync isn't configured \u2014 the designation cannot be confirmed",
-      fix: "Run `outerlayer login` to connect."
-    });
-  }
-  if (looksGoverned) {
-    let tracked = "";
-    try {
-      tracked = execFileSync("git", ["-C", repoRoot, "ls-files", "--", "AGENTS.md", ".claude", ".outerlayer"], {
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "ignore"],
-        timeout: 2e3
-      }).trim();
-    } catch {
-      tracked = "";
-    }
-    if (tracked) {
-      const paths = tracked.split("\n");
-      const sample = paths.slice(0, 3).join(", ") + (paths.length > 3 ? ", \u2026" : "");
-      checks.push({
-        name,
-        status: "fail",
-        detail: `committed context files shadow the control plane: ${sample}`,
-        fix: "Remove the committed AGENTS.md/.claude/.outerlayer files in a commit, then run `outerlayer context materialize`."
-      });
-    }
-  }
   return checks;
 }
 var PROTECT_DEFAULT_BRANCH_DOCS = "https://docs.outerlayer.ai/github-app-and-build-tokens#protect-the-default-branch";
@@ -816,7 +845,7 @@ function githubAppRefusalCheck(err) {
   if (err instanceof WorkCommandError && err.status === 403) {
     return { name, status: "warn", detail: `the key cannot read the factory's repositories: ${message}`, fix: "Use a key that holds git.read." };
   }
-  return { name, status: "warn", detail: `could not read the factory's repositories: ${message}`, fix: "Run `outerlayer doctor` again; check the gateway URL in ~/.outerlayer/config.json." };
+  return { name, status: "warn", detail: `could not read the factory's repositories: ${message}`, fix: `Run \`${cliInvocation()} doctor\` again; check the gateway URL in ~/.outerlayer/config.json.` };
 }
 function describeMissing(missing) {
   const held = missing.granted === null ? "not granted" : `has ${sanitizeTerminal(missing.granted)}`;
@@ -877,8 +906,8 @@ function repositoryAccessCheck(access) {
   return { name, status: "pass", detail: `every permission builds need is accepted; ${pullRequest}` };
 }
 var CREDENTIAL_CHECK_TIMEOUT_MS = 15e3;
-var LOGIN_FIX = "Run `outerlayer login` to sign in again.";
-var CONNECT_FIX = "Run `outerlayer connect` to choose a factory for this repository.";
+var LOGIN_FIX = `Run \`${cliInvocation()} login\` to sign in again.`;
+var CONNECT_FIX = `Run \`${cliInvocation()} connect\` to choose a factory for this repository.`;
 var SETUP_PANEL_FIX = "Link the repository on the factory's setup panel in the dashboard.";
 var MINT_KEY_FIX = "Mint a key for a factory that exists: dashboard \u2192 Settings \u2192 API keys.";
 async function askGateway(fetchImpl, url, path, credential, appId) {
@@ -906,7 +935,7 @@ function refusalMessage(body) {
   const message = body?.error?.message;
   return typeof message === "string" ? sanitizeTerminal(message) : "";
 }
-var NETWORK_FIX = "Check the network and the gateway address, then run `outerlayer doctor` again.";
+var NETWORK_FIX = `Check the network and the gateway address, then run \`${cliInvocation()} doctor\` again.`;
 var UPDATE_FIX = "Update the outerlayer CLI and the gateway to the same release.";
 var skippedCheck = (name, detail, fix) => ({ name, status: "skipped", detail, ...fix ? { fix } : {} });
 function withSkippedRest(first, reason) {
@@ -976,7 +1005,7 @@ async function loginChecks(fetchImpl, url, token, appId, local, inRepository) {
     return [login, factoryCheck, { name: "Repository", status: "pass", detail: `${shown} is linked to ${factorySlug(factory)}` }];
   }
   const elsewhere = factories.find((f) => f.id !== factory.id && f.linked === true);
-  const fix = elsewhere === void 0 ? SETUP_PANEL_FIX : `Run \`outerlayer connect --factory ${factorySlug(elsewhere)}\` to use the factory this repository is linked to.`;
+  const fix = elsewhere === void 0 ? SETUP_PANEL_FIX : `Run \`${cliInvocation()} connect --factory ${factorySlug(elsewhere)}\` to use the factory this repository is linked to.`;
   return [login, factoryCheck, { name: "Repository", status: "warn", detail: `${shown} is not linked to ${factorySlug(factory)}`, fix }];
 }
 async function factoryKeyChecks(fetchImpl, url, key, appId, source, local) {
@@ -1074,7 +1103,7 @@ async function credentialChecks(options = {}) {
   const resolved = resolveGatewayCredentials({ home: options.home, env, cwd });
   if (resolved.credential === void 0 || resolved.url === void 0) {
     const reason = resolved.credential === void 0 ? "no login and no factory key is saved" : "no gateway address is saved";
-    return withSkippedRest(skippedCheck("Credential", reason, "Run `outerlayer login` to sign in."), "there is no credential to check");
+    return withSkippedRest(skippedCheck("Credential", reason, `Run \`${cliInvocation()} login\` to sign in.`), "there is no credential to check");
   }
   const fetchImpl = options.fetchImpl ?? defaultFetch;
   const local = resolveRepoIdentity(cwd).gitRepo;
@@ -1093,7 +1122,7 @@ async function governanceChecks(options = {}) {
   const cwd = options.cwd ?? process.cwd();
   const resolved = resolveGatewayCredentials({ home: options.home, env, cwd });
   if (resolved.credential === void 0 || resolved.url === void 0) {
-    return [skippedCheck(name, "there is no credential to ask with", "Run `outerlayer login` to sign in.")];
+    return [skippedCheck(name, "there is no credential to ask with", `Run \`${cliInvocation()} login\` to sign in.`)];
   }
   const local = resolveRepoIdentity(cwd).gitRepo;
   if (local === void 0) return [skippedCheck(name, "not inside a git repository with a remote")];
@@ -1103,7 +1132,7 @@ async function governanceChecks(options = {}) {
   const unanswered = unansweredDetail(reply);
   if (unanswered !== void 0 && !("failure" in reply) && reply.status === 503) {
     const message = refusalMessage(reply.body);
-    return [{ name, status: "warn", detail: message === "" ? unanswered : `governed, but ${message}`, fix: "Check that the GitHub App can read the control plane, then run `outerlayer doctor` again." }];
+    return [{ name, status: "warn", detail: message === "" ? unanswered : `governed, but ${message}`, fix: `Check that the GitHub App can read the control plane, then run \`${cliInvocation()} doctor\` again.` }];
   }
   if (unanswered !== void 0) return [{ name, status: "warn", detail: unanswered, fix: NETWORK_FIX }];
   const { status, body } = reply;
@@ -1140,7 +1169,7 @@ function doctorExitCode(checks) {
 
 // src/doctor-report.ts
 async function gatherDoctorChecks() {
-  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-N3C6DFQA.js');
+  const { defaultRunnerConfigPath, hasRunnerBlock, loadRunnerConfig, runnerVmOf } = await import('./config-CLSGABD5.js');
   const configPath = defaultRunnerConfigPath();
   const checks = runDoctor({ runnerHost: hasRunnerBlock(configPath) });
   const credential = await credentialChecks();
@@ -1152,7 +1181,7 @@ async function gatherDoctorChecks() {
     const { runnerVmCheck } = await import('./doctor-53F2PYY7.js');
     checks.push(runnerVmCheck(configPath, { lima: realLima(), home: homeFromEnv(), instance: runnerVm.instance }));
   } else if (hasRunnerBlock(configPath)) {
-    const { runnerHostChecks } = await import('./doctor-4TAIARIG.js');
+    const { runnerHostChecks } = await import('./doctor-23BBJWBX.js');
     const hooks = (() => {
       try {
         return loadRunnerConfig(configPath).hooks;
@@ -1187,7 +1216,7 @@ async function gatherDoctorChecks() {
       const { existsSync: existsSync3 } = await import('fs');
       if (process.platform !== "linux" || !existsSync3("/run/systemd/system")) return void 0;
       const { inspectService, realInspectProbes } = await import('./inspect-6UYAAXH7.js');
-      const { DEFAULT_UNIT_NAME } = await import('./install-HDBIPHTX.js');
+      const { DEFAULT_UNIT_NAME } = await import('./install-4SEFIIW2.js');
       const { dirname: dirname2 } = await import('path');
       return inspectService(DEFAULT_UNIT_NAME, dirname2(configPath), realInspectProbes());
     })();

package/dist/{chunk-VQYBXPI7.js → chunk-6D7GT22T.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-ONKJUM6R.js';
-import { MIN_ENGINE_MAJOR } from './chunk-MAK5LYRF.js';
-import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-OZGHL5Y5.js';
-import { runnerCredentialProblem } from './chunk-22RMZBGW.js';
-import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
+import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-7YP7T6GV.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-UVG35MWF.js';
+import { MIN_ENGINE_MAJOR } from './chunk-7KSSBQTS.js';
+import { runnerCredentialProblem } from './chunk-P53VEAOF.js';
+import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-N2PXGQRL.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import { dirname } from 'path';