@outerlayer/cli 0.18.0 → 0.19.0

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # @outerlayer/cli
 
+## 0.19.0
+
+### Minor Changes
+
+- 5153995: Add `outerlayer emit step <name>`. An agent reports that it started a step, such as "Review round 2", and the work item's Activity tab shows it.
+
+  The name is 1 to 80 characters on one line. If the gateway cannot be reached, the command queues the step with the time you ran it and exits 0, and `outerlayer sync` sends it later. If the gateway refuses the step, the command prints the reason and exits 1.
+
+- 3d15dba: On a laptop, `outerlayer claude` starts Claude Code with your control plane attached, without writing its files into your repository. It keeps a copy of the control plane under `~/.outerlayer/context/` and starts Claude Code with that copy added.
+
+  A governed repository can now commit its own `CLAUDE.md`, `AGENTS.md` and skills. `outerlayer init` can add a `claude` function to your zsh or bash startup file, so plain `claude` starts the same way. A session that did not start through `outerlayer claude` says the shared instructions are missing.
+
+  `outerlayer context materialize` and the pre-commit guard are removed. A session start removes the files, the exclude block and the guard that an earlier CLI added to a checkout.
+
+- 3210eaa: `outerlayer work logs` prints the runner's log for a host attempt. A runner now sends that log with every release, and gives a reason when a build command dies of a signal it did not send.
+
+### Patch Changes
+
+- ff302c8: The build skill says a pull request closes a GitHub issue, and that a person completes a Linear or Jira issue in its tracker after merge.
+- de29d22: `outerlayer context emit` deletes a generated file whose source is gone, so every orphan `--check` reports is one a plain emit clears. Before, `--check` reported these files and emit left them, so the check kept failing.
+
+  Neither form reads inside a nested git repository, a submodule, or a governed clone any more. Generated files there belong to that tree, not to the repository being emitted.
+
+- 13ee333: Update the bundled `@noble/hashes` library from 1.8 to 2.4. The CLI's pricing code depends on it. Token costs the CLI reports are unchanged.
+
 ## 0.18.0
 
 ### Minor Changes

package/README.md

@@ -90,7 +90,8 @@ content:
   `release` marks it done. `outerlayer work comment` posts one comment on a
   work item's general thread or a criterion thread — the detected session id
   rides along the same way it does for `emit`, only ever narrowing what the
-  comment may do; `outerlayer work threads` reads them back. A runner key
+  comment may do; `outerlayer work threads` reads them back. `outerlayer work logs`
+  reads the runner's log for a host attempt. A runner key
   needs `git.read` and `work.read` to
   list and read items, and `work.claim` to claim, renew or release — `work.claim`
   is not granted to a dashboard role by default, since a claim is a host's
@@ -103,7 +104,11 @@ content:
   credential.
 - **`outerlayer runner start`** lists, claims, renews and releases work
   items the same way `work claim`/`renew`/`release` do, on the schedule its
-  config sets — it sends nothing about the job it runs beyond that; the
+  config sets. Each release also carries the runner's own log for the attempt:
+  the lines the runner logged for that item, and the tail of the stage log when
+  the attempt ended in provision, sync, cleanup or report. It is scrubbed with
+  the same patterns as the build's session, capped at 64 KiB and always sent.
+  The runner sends nothing else about the job it runs; the
   agent it starts is a separate process with its own credentials, from the
   `runner` block, never the copy-out daemon's. It also sends a heartbeat at
   the end of every poll: the host, the CLI version, the poll interval, the
@@ -240,6 +245,11 @@ content:
   credited the member who asked for the build. The runner sets that author in
   the build's environment and adds the `Co-authored-by` line with git hooks it
   writes into the build's own directory.
+- **`outerlayer claude`** asks your gateway which repository governs the
+  current one (`GET /v1/context/source`, with your API key). When one does, it
+  runs `git fetch` of that control plane into a cache under
+  `~/.outerlayer/context` and starts Claude Code with the files attached.
+  Nothing is written into your working tree.
 - **`outerlayer runner start` with `builtin:container` hooks** also asks your
   gateway which repository governs the item's repository (`GET
   /v1/context/source`, signed with the host key), after the recipe's
@@ -327,6 +337,13 @@ content:
   declared proof kind, from the JSON file you name. The anchoring is the same
   as `emit finding`. Nothing but the file's content and the item number is
   sent.
+- **`outerlayer emit step <name>`** sends the step's name, the time you ran the
+  command, a random id for the step and the item number
+  (`POST /v1/work-items/steps`). The item is `--item`, or the item the
+  recorded session was launched for. When the gateway cannot be reached, the
+  same four values, the factory id and the directory are kept in
+  `~/.outerlayer/spool/steps.jsonl`, and `outerlayer sync` sends them later.
+  Nothing from the session itself is sent.
 - **`outerlayer mcp serve`** is the stdio MCP server your editor spawns. It
   forwards every JSON-RPC message the editor sends to the gateway and returns
   the reply.
@@ -391,9 +408,11 @@ before it gives up.
 | `outerlayer emit artifact <file> --caption <text> [--for <criterion-id>] [--pr <n>]` | Upload a proof artifact — screenshot, recording, report, or log — with its caption. Inside a recorded session it spools locally and ships on the next `sync`; otherwise it uploads immediately, anchored to a pull request or the current checkout. `--replaces` retires artifacts an earlier run uploaded. A JUnit XML file bound with `--for` proves a criterion that declares `test` proof; `--test <name[=path:line]>` binds only the named tests. |
 | `outerlayer emit <name> --result <pass\|fail> [--link <url>] [--body <text>\|--body-file <path>] --item <number>` | Record one named check's outcome on a work item. A check that ran carries the run URL as its proof (`--link`); a judgment you are making yourself carries one sentence (`--body`, or `--body-file` to read it from a file — `-` reads standard input). A `fail` needs at least one of the two; a `pass` needs neither. `--item` names the work item by the number printed when the item was created — always required, in or out of a recorded session; a session records checks on its own item like any other, stored as the session's, but cannot clear a person's fail. Prints the recorded check's id. Who recorded it comes from your API key, never from what you send. |
 | `outerlayer work comment --item <n> [--criterion <id>] --body <text> [--artifact <id>] [--pass\|--fail\|--attach\|--ready]` | Post one comment on a work item's general thread, or on one acceptance criterion's own thread with `--criterion`. `--pass`/`--fail` need a person's own credential and apply to the whole item, so they work on the general thread only and the gateway refuses them with `--criterion`; `--attach` makes the named artifact that criterion's current proof; `--ready` hands a thread back to a person. The detected session id rides along automatically, only ever narrowing what the comment may do. |
+| `outerlayer work logs --item <n> [--attempt <claim id>]` | Print the runner's log for a host attempt on a work item: the newest attempt a runner made, or the one `--attempt` names (an `id` from `claims` in `work status --json`). The log is what the runner did around the agent, with secrets removed on the host. Exits 1 for an attempt that is still running or that an older runner released without a log. |
 | `outerlayer work threads --item <n>` | Read a work item's threads back — the general thread first, then one per criterion with proof or a comment, each with its `waitingOn`. |
 | `outerlayer emit finding --id <id> --category <context\|flaky-test\|tooling\|environment\|defect\|other> --title <text> --file <path> --where <label> [--line <n>] [--item <number>] [--cause <text>] [--detail <text>] [--suggestion <text>] [--command <text>] [--error <text>] [--test <name>] [--symbol <name>] [--started-at <event> --ended-at <event>] [--problem <id> … --link-reason <text> \| --new] …` | Record one problem you hit in the factory. `--category` is one of `context` (an instruction that is wrong, broken or missing), `flaky-test`, `tooling`, `environment`, `defect` (a bug outside your own change) or `other`. A `context` finding also needs `--rule-path` and `--rule-relation` (`wrong`, `broken` or `missing`), and `--rule-quote` unless the relation is `missing`. `--cause`, `--detail`, `--suggestion`, `--command`, `--error` (the first error line), `--test` and `--symbol` carry what a fix needs. Every finding joins a factory-level problem: when a key of the finding matches a known problem it joins that problem; otherwise nothing is stored, the closest problems are printed, and the command exits with code 3. Run it again with `--problem <id> --link-reason <text>` (repeat `--problem` for each problem the finding reports) or with `--new`. Without `--started-at`, it prints the session's recent events with ids and times; name the event where you hit the problem and the one where you got past it with `--started-at` and `--ended-at`. Findings are informational; nothing reads one to pass or fail the work. `--item` names the work item; without it, inside a recorded session, the item that session was launched for is used automatically. Re-emitting the same `--id` on the item replaces that finding and keeps its problems. |
 | `outerlayer emit findings <file> [--item <number>]` | Record a whole batch at once, read from a JSON file (`-` for standard input) with `"schemaVersion": 3` — the same shape and validation as `emit finding`, one record per id. A finding's `startedAt` and `endedAt` may be event ids. The findings that match a key are stored; those that need a choice are listed with their candidates and not stored, and the exit code is 3. Anchored the same way: `--item`, else a recorded session's own item. |
+| `outerlayer emit step <name> [--item <number>]` | Report that you started a step. The name is free text, 1 to 80 characters on one line. The work item's Activity tab shows the step with the time you ran the command. A step has a start and nothing else, so run it again at the start of the next step. `--item` names the work item; without it, inside a recorded session, the item that session was launched for is used. If the gateway cannot be reached, or answers with a 5xx, the step is queued in `~/.outerlayer/spool/steps.jsonl`, the command exits 0, and `outerlayer sync` sends it later with its original time. If the gateway refuses the step, the command prints why and exits 1. |
 | `outerlayer emit criteria <file> [--item <number>]` | Record a work item's acceptance criteria as one list, read from a JSON file (`-` for standard input): `{"criteria": [{"id": "AC-1", "text": "Given …", "proof": null}]}`. An `id` is 1 to 64 characters of `A-Z a-z 0-9 . _ : -`, the same id `emit artifact --for` binds evidence to. `proof` is `video`, `screenshot`, `report`, `log`, `test`, `file` or `null` (any bound artifact proves it). The list holds 1 to 200 criteria, each `text` at most 2,000 characters, with no id twice. It is validated before anything is sent. This list is the only source for the item's Criteria tab. Once an item has a list, only a person can replace it: run the command outside an agent session, with your own login. Anchored the same way as `emit findings`: `--item`, else a recorded session's own item. |
 | `outerlayer mcp install [--transport stdio\|http] [--url] [--name] [--command]` | Write (or update) an `mcpServers` entry in `.mcp.json` for the OuterLayer gateway. Default `stdio`: the client spawns `outerlayer mcp serve`, which reads the API key from `~/.outerlayer/config.json` (or `OUTERLAYER_API_KEY`) each time it connects, so a reconnect picks up a newly saved or rotated key. `--transport http` writes a direct `POST /v1/mcp` entry referencing `${OUTERLAYER_API_KEY}`, resolved by the client from the environment it was launched with. Never writes an API key. Pass `--url`/`--app-id` for self-host. |
 | `outerlayer mcp serve [--url] [--app-id]` | Stdio MCP server bridging stdin/stdout JSON-RPC to the gateway's `POST /v1/mcp`. What the stdio `.mcp.json` entry runs; exits 1 with a clear message when no API key is configured. |

package/dist/{agent-setup-RBTEACYU.js → agent-setup-TPR4BBFV.js}

@@ -1,28 +1,27 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { keepHandWritten, runAgentSetup } from './chunk-RAZTWYZN.js';
-import './chunk-47TTLEDX.js';
+export { keepHandWritten, runAgentSetup } from './chunk-DJ3ZUSC3.js';
+import './chunk-ZHAUSEEN.js';
 import './chunk-YVZJ6GKF.js';
-import './chunk-F4XSVQJ4.js';
+import './chunk-6X4SQ5MY.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-W5VPCONO.js';
-import './chunk-LXAY4A2G.js';
-import './chunk-T4Y6SCG3.js';
-import './chunk-ZRL6HKBY.js';
-import './chunk-52NC2FIU.js';
-import './chunk-MNTSH4CL.js';
-import './chunk-X5N6KC6V.js';
-import './chunk-N3CUDFCW.js';
+import './chunk-452TM7J4.js';
+import './chunk-IXYZUUYQ.js';
+import './chunk-FVMYKL6L.js';
+import './chunk-NTRCK4NH.js';
+import './chunk-ZJSNLVCE.js';
+import './chunk-BJ3KTMDH.js';
+import './chunk-NNLA7LLQ.js';
+import './chunk-WFSUUUAN.js';
+import './chunk-7VUK5RFS.js';
 import './chunk-EABW6AJQ.js';
+import './chunk-CRB3POP4.js';
+import './chunk-YQR6E6OV.js';
+import './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
 import './chunk-M2ZWWTWZ.js';
 import './chunk-N2PXGQRL.js';
 import './chunk-BQXFBI7T.js';
-import './chunk-XCCLFVXM.js';
-import './chunk-ZJSNLVCE.js';
-import './chunk-BJ3KTMDH.js';
-import './chunk-CRB3POP4.js';
-import './chunk-VNVZDWO3.js';
 import './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);

package/dist/{artifact-link-cmd-AVM2EKTV.js → artifact-link-cmd-W7XF5BFB.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { sanitizeTerminal, readEffectiveArtifactSpoolState } from './chunk-MQJSXHV7.js';
-import './chunk-N3CUDFCW.js';
+import { sanitizeTerminal, readEffectiveArtifactSpoolState } from './chunk-G3IJ3N6F.js';
+import './chunk-7VUK5RFS.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import './chunk-Z5GEFMRW.js';

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-13T00:18:48.455Z+4c5e4a3","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-13T19:11:37.037Z+109c2bd","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{builder-DUI2ZH2H.js → builder-C4QNTYMS.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-S26M3YBJ.js';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-3UZTIRLF.js';
 import './chunk-7RQ73DLO.js';
 import './chunk-CX22S5BA.js';
-import './chunk-BMYGAGBJ.js';
-import './chunk-N3CUDFCW.js';
+import './chunk-QNLX477Q.js';
+import './chunk-7VUK5RFS.js';
 import './chunk-N2PXGQRL.js';
 import './chunk-BQXFBI7T.js';
 import './chunk-Z5GEFMRW.js';

package/dist/{check-5C4YDZYV.js → check-UWQAL2MN.js}

@@ -1,39 +1,41 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-QQM2UJ6T.js';
+import { probeCredentials } from './chunk-5MYFOW5V.js';
+import './chunk-6U3MV7TZ.js';
+import './chunk-MTP2QEVO.js';
+import './chunk-S5PCA3SN.js';
 import './chunk-3JVYMD4G.js';
-import './chunk-I2UOAV7X.js';
 import './chunk-YETTWTAY.js';
-import './chunk-3OFZM4X6.js';
 import './chunk-SADUQSO4.js';
-import './chunk-KDVIU23F.js';
-import './chunk-MTP2QEVO.js';
-import './chunk-S5PCA3SN.js';
-import './chunk-UYOYTKE2.js';
+import './chunk-I2UOAV7X.js';
+import './chunk-BWSUPRDK.js';
+import './chunk-5GHGAF6P.js';
 import './chunk-XNGMQ27R.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-FUB7LRUE.js';
-import './chunk-AMFWYESY.js';
-import './chunk-YYYRBYWG.js';
-import './chunk-GOBOJMOJ.js';
-import './chunk-JF42URPU.js';
+import './chunk-7SJPQWBM.js';
+import './chunk-KYS3TQAG.js';
 import './chunk-ESVW4MJY.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-DADWEUH3.js';
+import './chunk-YYYRBYWG.js';
+import './chunk-AMFWYESY.js';
 import './chunk-TBT347UY.js';
-import './chunk-NL4XPC7W.js';
-import './chunk-Y5MXET4M.js';
-import './chunk-L2USZT6T.js';
-import './chunk-S26M3YBJ.js';
+import './chunk-6D7GT22T.js';
+import './chunk-7YP7T6GV.js';
+import './chunk-UVG35MWF.js';
+import './chunk-7KSSBQTS.js';
+import './chunk-OGFGZQA3.js';
+import './chunk-VMJPFQNE.js';
+import './chunk-3UZTIRLF.js';
 import './chunk-GGOMT6KF.js';
 import './chunk-X5H2WYMB.js';
-import './chunk-6CHIYEZZ.js';
-import './chunk-SWCTGCSC.js';
-import './chunk-WGAUY5LE.js';
+import './chunk-XSZD4AZ6.js';
+import './chunk-QEFKA2QD.js';
 import { parseRunnerEnv } from './chunk-6MZSX4M7.js';
-import './chunk-KK4VBOH6.js';
-import './chunk-WBT5X3NH.js';
-import './chunk-IP7BIBXJ.js';
-import './chunk-S76AYB4M.js';
-import './chunk-MQJSXHV7.js';
-import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-XGP3VYOG.js';
+import './chunk-HPJNLETG.js';
+import './chunk-IF2OSI5T.js';
+import './chunk-CG36IONK.js';
+import './chunk-G3IJ3N6F.js';
+import './chunk-BM63HB2M.js';
+import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-P53VEAOF.js';
 import './chunk-UXYLWVTQ.js';
 import './chunk-7RQ73DLO.js';
 import './chunk-3CWUOFV6.js';
@@ -41,36 +43,35 @@ import './chunk-QOZKPLVJ.js';
 import './chunk-CX22S5BA.js';
 import './chunk-ECODQ7II.js';
 import './chunk-JBJTC3UU.js';
-import './chunk-OGFGZQA3.js';
+import './chunk-NFIR3GEE.js';
 import './chunk-F7CU5ABH.js';
 import './chunk-BKO6JEZI.js';
-import './chunk-BMYGAGBJ.js';
-import './chunk-NACDBXUG.js';
+import './chunk-QNLX477Q.js';
 import './chunk-GOSFARMS.js';
 import './chunk-ANPNT6PM.js';
 import './chunk-T2Q7ISPE.js';
 import './chunk-WZBHBH3J.js';
 import './chunk-5QRP3MVS.js';
-import './chunk-W5VPCONO.js';
-import './chunk-LXAY4A2G.js';
-import './chunk-T4Y6SCG3.js';
-import './chunk-ZRL6HKBY.js';
-import './chunk-52NC2FIU.js';
-import './chunk-MNTSH4CL.js';
-import './chunk-X5N6KC6V.js';
-import './chunk-N3CUDFCW.js';
+import './chunk-LLM3I5YU.js';
+import './chunk-452TM7J4.js';
+import './chunk-IXYZUUYQ.js';
+import './chunk-FVMYKL6L.js';
+import './chunk-NTRCK4NH.js';
+import './chunk-ZJSNLVCE.js';
+import './chunk-BJ3KTMDH.js';
+import './chunk-G2YNJIGF.js';
+import './chunk-NNLA7LLQ.js';
+import './chunk-WFSUUUAN.js';
+import './chunk-7VUK5RFS.js';
 import './chunk-EABW6AJQ.js';
+import './chunk-CRB3POP4.js';
+import './chunk-YQR6E6OV.js';
+import './chunk-TUSYOL2O.js';
+import './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
 import './chunk-M2ZWWTWZ.js';
 import './chunk-N2PXGQRL.js';
 import './chunk-BQXFBI7T.js';
-import './chunk-ULSIJGLS.js';
-import './chunk-G2YNJIGF.js';
-import './chunk-XCCLFVXM.js';
-import './chunk-ZJSNLVCE.js';
-import './chunk-BJ3KTMDH.js';
-import './chunk-CRB3POP4.js';
-import './chunk-VNVZDWO3.js';
 import './chunk-Z5GEFMRW.js';
 import { readFileSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-S26M3YBJ.js → chunk-3UZTIRLF.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { parseSize } from './chunk-7RQ73DLO.js';
 import { BUILDKIT_IMAGE } from './chunk-CX22S5BA.js';
-import { compareVersions } from './chunk-BMYGAGBJ.js';
+import { compareVersions } from './chunk-QNLX477Q.js';
 import { runnerDir } from './chunk-N2PXGQRL.js';
 import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-BQXFBI7T.js';
 import { createHash } from 'crypto';