@outerlayer/cli 0.18.0 → 0.19.0

package/dist/{cli-C77H54BV.js → cli-HROW5T7X.js}

@@ -1,41 +1,40 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-Y5GE76XC.js';
-import './chunk-ESC6UR76.js';
-import { verifiedTrackerNames, TRACKERS } from './chunk-KK4VBOH6.js';
-import './chunk-WBT5X3NH.js';
-import './chunk-IP7BIBXJ.js';
-import './chunk-S76AYB4M.js';
-import './chunk-MQJSXHV7.js';
+import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-5TN7GLYX.js';
+import './chunk-TWF3RICI.js';
+import { verifiedTrackerNames, TRACKERS } from './chunk-HPJNLETG.js';
+import './chunk-IF2OSI5T.js';
+import './chunk-CG36IONK.js';
+import './chunk-G3IJ3N6F.js';
+import './chunk-BM63HB2M.js';
+import { hookFiredMarkerPath, installedCliDistDir } from './chunk-NFIR3GEE.js';
 import './chunk-DSF2FWAZ.js';
 import './chunk-BKO6JEZI.js';
-import './chunk-BMYGAGBJ.js';
+import './chunk-QNLX477Q.js';
 import './chunk-YVZJ6GKF.js';
-import './chunk-F4XSVQJ4.js';
-import './chunk-NACDBXUG.js';
+import './chunk-6X4SQ5MY.js';
 import './chunk-GOSFARMS.js';
-import { C, NO_COLOR_FLAG, warnDeprecated, stripNoColor, API_KEY_FLAG_DEPRECATION } from './chunk-ANPNT6PM.js';
+import { C, warnDeprecated, API_KEY_FLAG_DEPRECATION, NO_COLOR_FLAG, stripNoColor } from './chunk-ANPNT6PM.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { settingsPath, readSettings, SettingsParseError, listHookCandidates, wrapHooks, writeSettings, unwrapHooks, REGISTERED_EVENTS, cliCommand, removeHooks, removeStatusline, cliBinResolvable, mergeHooks, repointWrappedHooks, AUTO_WRAP_EVENTS, mergeStatusline } from './chunk-5QRP3MVS.js';
-import { pinExists } from './chunk-LXAY4A2G.js';
-import './chunk-T4Y6SCG3.js';
-import './chunk-ZRL6HKBY.js';
-import './chunk-52NC2FIU.js';
-import './chunk-MNTSH4CL.js';
-import './chunk-X5N6KC6V.js';
-import './chunk-N3CUDFCW.js';
+import './chunk-IXYZUUYQ.js';
+import './chunk-FVMYKL6L.js';
+import './chunk-NTRCK4NH.js';
+import './chunk-ZJSNLVCE.js';
+import { findGitDirs } from './chunk-BJ3KTMDH.js';
+import './chunk-G2YNJIGF.js';
+import './chunk-NNLA7LLQ.js';
+import './chunk-WFSUUUAN.js';
+import './chunk-7VUK5RFS.js';
 import './chunk-EABW6AJQ.js';
+import { cliInvocation, packageRunnerOf } from './chunk-CRB3POP4.js';
+import { cloneIsGoverned } from './chunk-YQR6E6OV.js';
+import { removeJournalHooks, removePreCommitGuardHook } from './chunk-TUSYOL2O.js';
+import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
 import './chunk-M2ZWWTWZ.js';
 import './chunk-N2PXGQRL.js';
 import './chunk-BQXFBI7T.js';
-import { hookFiredMarkerPath, installedCliDistDir } from './chunk-ULSIJGLS.js';
-import './chunk-G2YNJIGF.js';
-import { managedHookScripts, removeJournalHooks, installPreCommitGuardHook, removePreCommitGuardHook } from './chunk-XCCLFVXM.js';
-import './chunk-ZJSNLVCE.js';
-import './chunk-BJ3KTMDH.js';
-import { cliInvocation, packageRunnerOf } from './chunk-CRB3POP4.js';
-import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import './chunk-Z5GEFMRW.js';
 import { EventEmitter } from 'events';
 import childProcess, { execFileSync } from 'child_process';
@@ -3548,7 +3547,6 @@ function runInit(opts) {
     recordStatusline(manifestHome, path2, statuslineWrappedCommand !== void 0 ? "wrapped" : "installed", statuslineWrappedCommand);
   }
   const gitHookRemoval = removeJournalHooks(opts.cwd ?? process.cwd());
-  const guardHook = installPreCommitGuardHook(opts.cwd ?? process.cwd());
   let gitignoreUpdated = false;
   if (scope === "project" && opts.addGitignore) {
     gitignoreUpdated = ensureGitignore(opts.cwd ?? process.cwd());
@@ -3560,7 +3558,6 @@ function runInit(opts) {
     events: REGISTERED_EVENTS,
     gitignoreUpdated,
     ...gitHookRemoval.removed ? { gitHookRemoved: true } : {},
-    guardHook,
     wrapped,
     ...statusline ? { statusline } : {},
     ...statuslineWrappedCommand ? { statuslineWrappedCommand } : {}
@@ -3578,8 +3575,12 @@ function tracksOwnOuterlayerDir(cwd) {
     return false;
   }
 }
+function isGovernedCheckout(cwd) {
+  const dirs = findGitDirs(cwd);
+  return dirs !== void 0 && cloneIsGoverned(dirs.gitCommonDir);
+}
 function ensureGitignore(cwd) {
-  if (tracksOwnOuterlayerDir(cwd) || pinExists(cwd)) return false;
+  if (tracksOwnOuterlayerDir(cwd) || isGovernedCheckout(cwd)) return false;
   const gitignore = join(cwd, ".gitignore");
   const entry = ".outerlayer/";
   let contents = "";
@@ -3647,11 +3648,8 @@ function writeJson(value) {
 function apiKeyOption() {
   return new Option("--api-key <key>", `deprecated: use \`${cliInvocation()} login\` or OUTERLAYER_API_KEY`).hideHelp();
 }
-function warnIfApiKeyFlag(opts) {
-  if (opts.apiKey !== void 0) warnDeprecated(API_KEY_FLAG_DEPRECATION);
-}
 async function installStarterPackInRepo() {
-  const { installStarterPack, formatStarterPackOutput } = await import('./starter-pack-OPWUDOWX.js');
+  const { installStarterPack, formatStarterPackOutput } = await import('./starter-pack-6LQVLBIA.js');
   const cwd = process.cwd();
   let repoRoot = cwd;
   try {
@@ -3743,39 +3741,6 @@ turn and at the end of the session, at most once every five minutes.
   );
   return lines.join("");
 }
-function formatGuardInstallOutput(guard) {
-  switch (guard.status) {
-    case "installed":
-    case "updated":
-    case "unchanged":
-      return { lines: [`${C.green}\u2713${C.reset} materialized-context commit guard ${guard.status} \u2192 ${guard.path}`] };
-    case "skipped-foreign":
-      if (guard.adopted) {
-        return { lines: [`${C.green}\u2713${C.reset} materialized-context commit guard hand-adopted into ${guard.path} \u2014 left untouched.`] };
-      }
-      return {
-        lines: [
-          `${C.yellow}!${C.reset} a pre-commit hook we did not write already exists (${guard.path}) \u2014 left untouched.`,
-          `  Append the guard script yourself: ${C.yellow}${cliInvocation()} hooks install-git --print${C.reset}`,
-          `  Place it before any exit in the existing hook \u2014 code after an early exit never runs.`
-        ],
-        exitCode: 1
-      };
-    case "skipped-custom-hooks-path":
-      if (guard.adopted) {
-        return { lines: [`${C.green}\u2713${C.reset} materialized-context commit guard hand-adopted at ${guard.path} (core.hooksPath) \u2014 left untouched.`] };
-      }
-      return {
-        lines: [
-          `${C.yellow}!${C.reset} this repo manages hooks in its working tree (core.hooksPath) \u2014 nothing written.`,
-          `  Add the script to your hook manager instead: ${C.yellow}${cliInvocation()} hooks install-git --print${C.reset}`
-        ],
-        exitCode: 1
-      };
-    case "not-a-repo":
-      return { lines: [], error: "not inside a git repository." };
-  }
-}
 async function installHooks(opts, resolvedBin, connected, starterTemplate, withNext = true) {
   const scope = opts.project ? "project" : "user";
   let cliBin;
@@ -3814,8 +3779,8 @@ ${starter.output}`),
   }
 }
 async function realConnectDepsForCwd() {
-  const { realConnectDeps } = await import('./connect-cmd-ZW5FV3ZW.js');
-  const { resolveRepoIdentity } = await import('./dist-QTX4RSCL.js');
+  const { realConnectDeps } = await import('./connect-cmd-UNYKGDAL.js');
+  const { resolveRepoIdentity } = await import('./dist-WO7NOJNG.js');
   return {
     ...realConnectDeps(),
     home: homeFromEnv(),
@@ -3830,13 +3795,15 @@ function invokedCommandToken(argv) {
 }
 function buildProgram(argv = process.argv) {
   const program2 = new Command();
-  program2.name(cliInvocation()).description("OuterLayer \u2014 see what your coding agents actually do").enablePositionalOptions().version(resolveVersion()).option(NO_COLOR_FLAG, "disable color (NO_COLOR=1 does the same)").addHelpText("after", SUPPORT_TEXT);
-  program2.command("init").description("Connect this repository, install hooks and agent skills, run doctor").option("--user", "install into user settings [default]").option("--project", "install into project settings (./.claude/settings.json)").option("--org", "print a managed-settings.json snippet for MDM/GPO rollout").option("--remove", "uninstall OuterLayer hooks").option("--local", "install the hooks only: no connect step and no network call").option("--factory <org/factory>", `the factory to connect this repository to (see \`${cliInvocation()} connect\`)`).option("--gitignore", "also add .outerlayer/ to .gitignore (project scope)").option("--template <name>", "install the starter skills and a policy file (only: default)").option("--update", "update the files init wrote that you have not edited, and write missing ones").option("--dry-run", "with --update: print the plan and write nothing").option("--no-wrap-hooks", "leave PreToolUse/PostToolUse hooks unwrapped").option("--statusline", "install the status-line segment [default]").option("--no-statusline", "leave the statusLine slot untouched").option("--json", "machine-readable JSON output").addHelpText(
+  program2.name(cliInvocation()).description("OuterLayer \u2014 see what your coding agents actually do").enablePositionalOptions().version(resolveVersion()).hook("preAction", (_root, command) => {
+    if (command.opts().apiKey !== void 0) warnDeprecated(API_KEY_FLAG_DEPRECATION);
+  }).option(NO_COLOR_FLAG, "disable color (NO_COLOR=1 does the same)").addHelpText("after", SUPPORT_TEXT);
+  program2.command("init").description("Connect this repository, install hooks and agent skills, run doctor").option("--user", "install into user settings [default]").option("--project", "install into project settings (./.claude/settings.json)").option("--org", "print a managed-settings.json snippet for MDM/GPO rollout").option("--remove", "uninstall OuterLayer hooks").option("--local", "install the hooks only: no connect step and no network call").option("--factory <org/factory>", `the factory to connect this repository to (see \`${cliInvocation()} connect\`)`).option("--gitignore", "also add .outerlayer/ to .gitignore (project scope)").option("--template <name>", "install the starter skills and a policy file (only: default)").option("--update", "update the files init wrote that you have not edited, and write missing ones").option("--dry-run", "with --update: print the plan and write nothing").option("--no-wrap-hooks", "leave PreToolUse/PostToolUse hooks unwrapped").option("--statusline", "install the status-line segment [default]").option("--no-statusline", "leave the statusLine slot untouched").option("--shell-function", "make plain claude run `outerlayer claude` (edits ~/.zshrc or ~/.bashrc)").option("--no-shell-function", "do not set up the shell function, and remove it if it is there").option("--json", "machine-readable JSON output").addHelpText(
     "after",
     `
 In a repository, init runs four steps: connect the repository to a
 factory (\`${cliInvocation()} connect\`), install the hooks, set up the coding agent,
-and run \`${cliInvocation()} doctor\`. It never signs in and asks nothing. With no
+and run \`${cliInvocation()} doctor\`. It never signs in. With no
 login it skips the connect step and says to run \`${cliInvocation()} login\`. With
 --json it prints one document naming the outcome of each step: done,
 skipped or failed. The exit code is 1 when a step failed.
@@ -3876,7 +3843,7 @@ states under Starter files.
 `
   ).action(async (opts) => {
     if (opts.update || opts.dryRun) {
-      const { runInitUpdate, formatInitUpdate, updateFlagProblem } = await import('./init-update-E3J6TVIN.js');
+      const { runInitUpdate, formatInitUpdate, updateFlagProblem } = await import('./init-update-LWX5MPPR.js');
       const problem = updateFlagProblem(opts);
       if (problem !== void 0) {
         fail(problem);
@@ -3890,7 +3857,7 @@ states under Starter files.
     }
     let starterTemplate;
     if (opts.template !== void 0) {
-      const { assertKnownTemplate, StarterPackError } = await import('./starter-pack-OPWUDOWX.js');
+      const { assertKnownTemplate, StarterPackError } = await import('./starter-pack-6LQVLBIA.js');
       try {
         assertKnownTemplate(opts.template);
       } catch (err) {
@@ -3917,13 +3884,19 @@ states under Starter files.
         fail(outcome.text);
         return;
       }
+      if (opts.remove) {
+        const { removeShellFunction } = await import('./shell-function-NRD4KVUK.js');
+        const changed = removeShellFunction({ home: homeFromEnv() });
+        if (changed.length > 0 && !opts.json) process.stdout.write(`Removed the claude function from ${changed.join(", ")}.
+`);
+      }
       if (opts.json) writeJson(outcome.result);
       else process.stdout.write(outcome.text);
       return;
     }
-    const { runInitCommand } = await import('./init-cmd-WS6TIRYT.js');
+    const { runInitCommand } = await import('./init-cmd-HSMRID6A.js');
     const code = await runInitCommand(
-      { json: opts.json, factory: opts.factory },
+      { json: opts.json, factory: opts.factory, shellFunction: opts.shellFunction },
       {
         connect: await realConnectDepsForCwd(),
         stdout: process.stdout,
@@ -3933,10 +3906,26 @@ states under Starter files.
           return { ok, text, detail };
         },
         runAgentSetup: async () => {
-          const { runAgentSetup } = await import('./agent-setup-RBTEACYU.js');
+          const { runAgentSetup } = await import('./agent-setup-TPR4BBFV.js');
           return runAgentSetup({ cwd: process.cwd() });
         },
-        runDoctorChecks: gatherDoctorChecks
+        runDoctorChecks: gatherDoctorChecks,
+        shell: {
+          home: homeFromEnv(),
+          shellPath: process.env.SHELL,
+          interactive: Boolean(process.stdin.isTTY && process.stderr.isTTY) && opts.json !== true,
+          ask: async () => {
+            const { promptOnTerminal } = await import('./connect-cmd-UNYKGDAL.js');
+            const answer = await promptOnTerminal({
+              message: `Should plain claude start Claude Code through ${cliInvocation()} claude? That is how a session in a governed repository gets its control plane. It adds one block to your zsh or bash startup file.`,
+              options: [
+                { label: "Yes, add the block", value: "yes" },
+                { label: "No, I will run outerlayer claude myself", value: "no" }
+              ]
+            });
+            return answer === "yes";
+          }
+        }
       }
     );
     if (code !== 0) process.exitCode = code;
@@ -3965,7 +3954,7 @@ linked (true, false, or null when it could not be checked) and, when false,
 linkUrl.
 `
   ).action(async (opts) => {
-    const { runConnectCommand } = await import('./connect-cmd-ZW5FV3ZW.js');
+    const { runConnectCommand } = await import('./connect-cmd-UNYKGDAL.js');
     const code = await runConnectCommand({ factory: opts.factory, json: opts.json }, await realConnectDepsForCwd(), {
       stdout: process.stdout,
       stderr: process.stderr
@@ -4004,7 +3993,7 @@ Every later command reads the saved file, so none of them needs a key on
 its command line. A saved key is checked for real on the first \`sync\`.
 `
   ).action(async (opts) => {
-    const { runLoginCommand, realLoginDeps } = await import('./login-browser-O63QZN7D.js');
+    const { runLoginCommand, realLoginDeps } = await import('./login-browser-DX35MARZ.js');
     const code = await runLoginCommand(
       {
         browser: opts.browser !== false,
@@ -4036,15 +4025,14 @@ code is 1: revoke the token on /profile/security.
     "after",
     "\nIncremental: only sessions newer than the last checkpoint ship. The tier\nis applied on this machine before anything leaves it; `--dry-run` prints\nexactly what would. The hook-triggered background sync runs `--quiet`.\nExit 2 means the server rejected at least one session.\n"
   ).action(async (opts) => {
-    warnIfApiKeyFlag(opts);
     if (opts.link !== void 0) {
-      const { lookupArtifactLink } = await import('./artifact-link-cmd-AVM2EKTV.js');
+      const { lookupArtifactLink } = await import('./artifact-link-cmd-W7XF5BFB.js');
       const found = lookupArtifactLink(opts.link);
       if (found.ok) process.stdout.write(found.url + "\n");
       else fail(found.reason);
       return;
     }
-    const { runSync, SyncConfigError, SyncTransportError } = await import('./sync-cmd-Q6VYNPWG.js');
+    const { runSync, SyncConfigError, SyncTransportError } = await import('./sync-cmd-G7GF4UTW.js');
     try {
       const result = await runSync({
         url: opts.url,
@@ -4075,7 +4063,7 @@ code is 1: revoke the token on /profile/security.
     if (invokedCommandToken(argv) === "watch") {
       warnDeprecated(`\`${cliInvocation()} watch\` is now \`${cliInvocation()} daemon\`; the old name will be removed in a future release.`);
     }
-    const { runWatch } = await import('./watch-ARAGADTF.js');
+    const { runWatch } = await import('./watch-EVM5GSMP.js');
     await runWatch({ once: opts.once });
   });
   program2.command("hook <event>", { hidden: true }).description("capture-hook fast path, installed by `init`").action(() => {
@@ -4084,7 +4072,7 @@ code is 1: revoke the token on /profile/security.
   });
   program2.command("hook-wrap", { hidden: true }).description("runs a hook wrapped by `hooks wrap`, recording exec evidence").option("--id <base64>", "the original hook command, base64-encoded").option("--capture-output", "tee stdout/stderr into a bounded tail").action(() => {
   });
-  program2.command("claude [args...]", { hidden: true }).description("start Claude Code with the repository's control plane attached").allowUnknownOption().helpOption(false).action(() => {
+  program2.command("claude [args...]").description("start Claude Code with the repository's control plane attached").allowUnknownOption().helpOption(false).action(() => {
   });
   program2.command("broker-relay", { hidden: true }).description("relay a build's loopback connections to the runner's tunnel and destinations").requiredOption("--port <port>", "the loopback port to listen on").requiredOption("--socket <path>", "the runner's tunnel socket").option("--forward <port=socket>", "also relay a loopback port to a destination's socket; repeatable", (value, previous) => [...previous, value], []).action(async (opts) => {
     const { startRelay } = await import('./relay-L76HDX72.js');
@@ -4131,7 +4119,7 @@ code is 1: revoke the token on /profile/security.
     }
   });
   program2.command("session-sender", { hidden: true }).description("stream a runner build's sessions to its work item while the build runs").action(async () => {
-    const { runSessionSender } = await import('./session-sender-NNVPSPY7.js');
+    const { runSessionSender } = await import('./session-sender-GGIY5OAX.js');
     try {
       await runSessionSender();
     } catch (err) {
@@ -4167,7 +4155,7 @@ async function runCli(processArgv) {
   await buildProgram(argv).parseAsync(argv);
 }
 async function compileContext(opts) {
-  const { runEmit, EmitError } = await import('./emit-cmd-PPN4QQF2.js');
+  const { runEmit, EmitError } = await import('./emit-cmd-7SP3I6UZ.js');
   try {
     const result = runEmit({ cwd: opts.dir, check: opts.check, json: opts.json });
     if (result.exitCode !== 0) process.exitCode = result.exitCode;
@@ -4204,7 +4192,8 @@ criterion's thread instead \u2014 see \`${cliInvocation()} work comment\`.
 
 Subcommands: \`emit artifact <file>\` for screenshots, recordings, reports and
 logs; \`emit finding\` / \`emit findings <file>\` to record a problem in the factory;
-\`emit criteria <file>\` to record a work item's acceptance criteria.
+\`emit criteria <file>\` to record a work item's acceptance criteria;
+\`emit step <name>\` to report that you started a step.
 Compiling .outerlayer/ moved to \`${cliInvocation()} context emit\`.
 `
   ).action(async (name, opts) => {
@@ -4213,8 +4202,7 @@ Compiling .outerlayer/ moved to \`${cliInvocation()} context emit\`.
       await compileContext({ dir: opts.dir, check: opts.check, json: opts.json });
       return;
     }
-    warnIfApiKeyFlag(opts);
-    const { runEmitResult, EmitResultError } = await import('./emit-result-cmd-UZVMOCF4.js');
+    const { runEmitResult, EmitResultError } = await import('./emit-result-cmd-RUICOKWQ.js');
     try {
       const result = await runEmitResult({
         name,
@@ -4264,8 +4252,7 @@ everywhere, bytes and deep link untouched; a still-queued one is cancelled
 locally so it never uploads. One correction can retire several duplicates.
 `
   ).action(async (file, opts) => {
-    warnIfApiKeyFlag(opts);
-    const { runEmitArtifact, EmitArtifactError } = await import('./emit-artifact-cmd-7MP63KXU.js');
+    const { runEmitArtifact, EmitArtifactError } = await import('./emit-artifact-cmd-O6SCM7TV.js');
     let pr;
     if (opts.pr !== void 0) {
       pr = parseTrackerNumber(opts.pr);
@@ -4324,8 +4311,7 @@ recent events with their ids. --find <text> searches all of them.
 item that session was launched for is used automatically.
 `
   ).action(async (opts) => {
-    warnIfApiKeyFlag(opts);
-    const { runEmitFinding, refuseRemovedFindingFlags, EmitFindingError } = await import('./emit-finding-cmd-OL7JB6H3.js');
+    const { runEmitFinding, refuseRemovedFindingFlags, EmitFindingError } = await import('./emit-finding-cmd-AJPKHIOV.js');
     try {
       refuseRemovedFindingFlags(opts);
       const result = await runEmitFinding({
@@ -4392,8 +4378,7 @@ the whole batch. "untimed": true records one with no time on purpose.
 that session was launched for is used automatically.
 `
   ).action(async (file, opts) => {
-    warnIfApiKeyFlag(opts);
-    const { runEmitFindings, EmitFindingError } = await import('./emit-finding-cmd-OL7JB6H3.js');
+    const { runEmitFindings, EmitFindingError } = await import('./emit-finding-cmd-AJPKHIOV.js');
     try {
       const result = await runEmitFindings({
         file,
@@ -4412,6 +4397,40 @@ that session was launched for is used automatically.
       throw err;
     }
   });
+  emitCmd.command("step <name>").description("Report that you started a step; the work item's Activity tab shows it").option("--item <number>", "work item to report on, by its number in this factory").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
+    "after",
+    `
+  ${cliInvocation()} emit step "Review round 2"
+  ${cliInvocation()} emit step "Plan" --item 412
+
+Run it when you start a step. The name is free text: 1 to 80 characters on one
+line. A step has a start and nothing else, so run it again for the next step.
+--item names the work item; without it, inside a recorded session, the item that
+session was launched for is used.
+
+If the gateway cannot be reached, the step is queued with the time you ran the
+command, the command exits 0, and \`sync\` sends it later. If the gateway refuses
+the step, the command prints why and exits 1.
+`
+  ).action(async (name, opts) => {
+    const { runEmitStep, EmitStepError } = await import('./emit-step-cmd-347XNGPQ.js');
+    try {
+      await runEmitStep({
+        name,
+        item: opts.item,
+        json: opts.json,
+        url: opts.url,
+        apiKey: opts.apiKey,
+        appId: opts.appId
+      });
+    } catch (err) {
+      if (err instanceof EmitStepError) {
+        fail(err.message);
+        return;
+      }
+      throw err;
+    }
+  });
   emitCmd.command("criteria <file>").description("Record a work item's acceptance criteria from a JSON file (- for stdin)").option("--item <number>", "work item to record on directly, by its number in this factory").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
     "after",
     `
@@ -4432,8 +4451,7 @@ agent session, with your own login. A key bound to no member cannot replace it e
 session was launched for is used automatically.
 `
   ).action(async (file, opts) => {
-    warnIfApiKeyFlag(opts);
-    const { runEmitCriteria, EmitCriteriaError } = await import('./emit-criteria-cmd-3RXPDLNK.js');
+    const { runEmitCriteria, EmitCriteriaError } = await import('./emit-criteria-cmd-LQNERZRV.js');
     try {
       const result = await runEmitCriteria({
         file,
@@ -4456,11 +4474,10 @@ session was launched for is used automatically.
 function registerSpecCommands(program2) {
   const specCmd = program2.command("spec").description("Find, file and edit the issue a spec lives in, in your factory's tracker");
   const credentialOptions = (command) => command.option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)");
-  const run = async (opts, action) => {
-    warnIfApiKeyFlag(opts);
-    const { WorkCommandError } = await import('./work-cmd-7S5B2H2P.js');
+  const run = async (action) => {
+    const { WorkCommandError } = await import('./work-cmd-5EPPD33Y.js');
     try {
-      await action(await import('./spec-cmd-OWVTBB4J.js'));
+      await action(await import('./spec-cmd-SIZBRN7D.js'));
     } catch (err) {
       if (err instanceof WorkCommandError) {
         fail(err.message);
@@ -4471,16 +4488,16 @@ function registerSpecCommands(program2) {
   };
   credentialOptions(
     specCmd.command("target").description("Say where a spec would be filed, and whether this factory can file there").option("--tracker <name>", "one connected tracker, when the factory has more than one")
-  ).action((opts) => run(opts, (spec) => spec.runSpecTarget(opts)));
+  ).action((opts) => run((spec) => spec.runSpecTarget(opts)));
   credentialOptions(
     specCmd.command("search").description("Find open and closed issues that match a query, before filing a duplicate").argument("<query>", "words from the title or body").option("--tracker <name>", "one connected tracker, when the factory has more than one")
-  ).action((query, opts) => run(opts, (spec) => spec.runSpecSearch({ ...opts, query })));
+  ).action((query, opts) => run((spec) => spec.runSpecSearch({ ...opts, query })));
   credentialOptions(
     specCmd.command("file").description("File a spec as an issue and print its key, URL and the command that builds it").requiredOption("--title <text>", "the issue title").option("--body-file <path>", "the spec as Markdown; - reads standard input").option("--repo <owner/name>", "the repository to file in (GitHub), or the one the work lands in").option("--tracker <name>", "the tracker, when the factory files in more than one").option("--scope <key>", "the Linear team or Jira project, when the connection covers several")
-  ).action((opts) => run(opts, (spec) => spec.runSpecFile(opts)));
+  ).action((opts) => run((spec) => spec.runSpecFile(opts)));
   credentialOptions(
     specCmd.command("edit").description("Replace the body of an issue that holds a spec").argument("<key>", "the issue key, such as acme/api#12 or ENG-142").option("--body-file <path>", "the new body as Markdown; - reads standard input").option("--updated-at <timestamp>", "the updatedAt you read; the edit is refused if the issue has changed since")
-  ).action((key, opts) => run(opts, (spec) => spec.runSpecEdit({ ...opts, key })));
+  ).action((key, opts) => run((spec) => spec.runSpecEdit({ ...opts, key })));
 }
 function registerWorkCommands(program2) {
   const workCmd = program2.command("work").description("Start, remove, or read what the factory is working on (the Work page)");
@@ -4501,8 +4518,7 @@ takes it, and prints the line that starts your session on it. That
 session links itself and holds the item's lease while it works.
 `
   ).action(async (opts) => {
-    warnIfApiKeyFlag(opts);
-    const { runWorkBuild, WorkCommandError } = await import('./work-cmd-7S5B2H2P.js');
+    const { runWorkBuild, WorkCommandError } = await import('./work-cmd-5EPPD33Y.js');
     try {
       await runWorkBuild(opts);
     } catch (err) {
@@ -4525,8 +4541,7 @@ renews that session's own 20-minute lease, unless --no-lease or
 --ended is given, or another worker already holds a live one.
 `
   ).action(async (number, opts) => {
-    warnIfApiKeyFlag(opts);
-    const { runWorkLinkSession, WorkCommandError } = await import('./work-cmd-7S5B2H2P.js');
+    const { runWorkLinkSession, WorkCommandError } = await import('./work-cmd-5EPPD33Y.js');
     try {
       await runWorkLinkSession({ ...opts, number, noLease: opts.lease === false, logFailures: opts.logFailures === true });
     } catch (err) {
@@ -4550,9 +4565,8 @@ criterion's new proof; --ready hands the thread back to a person. At
 most one action flag may be given.
 `
   ).action(async (opts) => {
-    warnIfApiKeyFlag(opts);
-    const { runWorkComment, WorkCommentCommandError } = await import('./work-comment-cmd-SZJSPM5S.js');
-    const { WorkCommandError } = await import('./work-cmd-7S5B2H2P.js');
+    const { runWorkComment, WorkCommentCommandError } = await import('./work-comment-cmd-2ACOZQAE.js');
+    const { WorkCommandError } = await import('./work-cmd-5EPPD33Y.js');
     try {
       await runWorkComment(opts);
     } catch (err) {
@@ -4573,9 +4587,8 @@ criterion that carries proof or a comment, each with who is waiting
 on whom next.
 `
   ).action(async (opts) => {
-    warnIfApiKeyFlag(opts);
-    const { runWorkThreads, WorkCommentCommandError } = await import('./work-comment-cmd-SZJSPM5S.js');
-    const { WorkCommandError } = await import('./work-cmd-7S5B2H2P.js');
+    const { runWorkThreads, WorkCommentCommandError } = await import('./work-comment-cmd-2ACOZQAE.js');
+    const { WorkCommandError } = await import('./work-cmd-5EPPD33Y.js');
     try {
       await runWorkThreads(opts);
     } catch (err) {
@@ -4586,6 +4599,31 @@ on whom next.
       throw err;
     }
   });
+  workCmd.command("logs").description("Read the runner's log for a host attempt on a work item").requiredOption("--item <number>", "the item's number inside this factory").option("--attempt <claim id>", "an attempt's id, from `work status --json` (default: the newest)").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
+    "after",
+    `
+  ${cliInvocation()} work logs --item 7
+  ${cliInvocation()} work logs --item 7 --attempt 7b0a3c52-9f1e-4d6b-8a21-5c3e9d2f1a40
+
+Prints what the runner did around the agent on that attempt, one line
+per event with its timestamp, with secrets removed on the host. The
+runner sends it when it releases the attempt, so an attempt that is
+still running, or that an older runner released, has no log and the
+command exits 1.
+`
+  ).action(async (opts) => {
+    const { runWorkLogs, WorkLogsCommandError } = await import('./work-logs-cmd-QDD2NMJL.js');
+    const { WorkCommandError } = await import('./work-cmd-5EPPD33Y.js');
+    try {
+      await runWorkLogs(opts);
+    } catch (err) {
+      if (err instanceof WorkLogsCommandError || err instanceof WorkCommandError) {
+        fail(err.message);
+        return;
+      }
+      throw err;
+    }
+  });
   workCmd.command("remove").description("Withdraw a source's addition \u2014 never deletes the item").option("--item <number>", "the item's number inside this factory").option("--issue <number>", "issue number or Linear/Jira key (default: named by --item instead)").option(TRACKER_OPTION_FLAG, "tracker for a keyed --issue, when both hold the key").option("--repo <owner/name>", "repository for an issue number (default: the checkout's remote)").requiredOption("--reason <text>", "why this source is no longer working on it").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
     "after",
     `
@@ -4596,8 +4634,7 @@ deletes anything \u2014 the item is removed from Work only once no
 live addition remains on it.
 `
   ).action(async (opts) => {
-    warnIfApiKeyFlag(opts);
-    const { runWorkRemove, WorkCommandError } = await import('./work-cmd-7S5B2H2P.js');
+    const { runWorkRemove, WorkCommandError } = await import('./work-cmd-5EPPD33Y.js');
     try {
       await runWorkRemove(opts);
     } catch (err) {
@@ -4609,8 +4646,7 @@ live addition remains on it.
     }
   });
   workCmd.command("status").description("Show one item's stage, gate ledger, and additions").option("--item <number>", "the item's number inside this factory").option("--issue <number>", "issue number, or a Linear/Jira key like ENG-123").option(TRACKER_OPTION_FLAG, "tracker for a keyed --issue, when both hold the key").option("--repo <owner/name>", "repository for an issue number (default: the checkout's remote)").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").action(async (opts) => {
-    warnIfApiKeyFlag(opts);
-    const { runWorkStatus, WorkCommandError } = await import('./work-cmd-7S5B2H2P.js');
+    const { runWorkStatus, WorkCommandError } = await import('./work-cmd-5EPPD33Y.js');
     try {
       await runWorkStatus(opts);
     } catch (err) {
@@ -4622,8 +4658,7 @@ live addition remains on it.
     }
   });
   workCmd.command("list").description("List live work items for this factory").option("--stage <spec|build|review>", "filter by stage").option("--section <attention|waiting|flowing>", "filter by Queue section").option("--repo <owner/name>", "repository (default: the current checkout's remote)").option("--unclaimed", "only items with no live lease").option("--claimed", "only items with a live lease, held by a host or a local session").option("--startable", "only items a host can start: a build request, no open PR, no live lease").option("--needs <amend>", "only items with a thread waiting on an agent").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").action(async (opts) => {
-    warnIfApiKeyFlag(opts);
-    const { runWorkList, WorkCommandError } = await import('./work-cmd-7S5B2H2P.js');
+    const { runWorkList, WorkCommandError } = await import('./work-cmd-5EPPD33Y.js');
     try {
       await runWorkList(opts);
     } catch (err) {
@@ -4644,8 +4679,7 @@ by a different key is refused; claiming again with the same key extends
 it. --host is a label only.
 `
   ).action(async (opts) => {
-    warnIfApiKeyFlag(opts);
-    const { runWorkClaim, WorkCommandError } = await import('./work-claim-cmd-34FERLYX.js');
+    const { runWorkClaim, WorkCommandError } = await import('./work-claim-cmd-3J3QW56U.js');
     try {
       await runWorkClaim(opts);
     } catch (err) {
@@ -4665,8 +4699,7 @@ Extends the live lease this API key holds. Refused with a 410 if the
 lease has expired, or a 403 if a different key holds it.
 `
   ).action(async (opts) => {
-    warnIfApiKeyFlag(opts);
-    const { runWorkRenew, WorkCommandError } = await import('./work-claim-cmd-34FERLYX.js');
+    const { runWorkRenew, WorkCommandError } = await import('./work-claim-cmd-3J3QW56U.js');
     try {
       await runWorkRenew(opts);
     } catch (err) {
@@ -4698,8 +4731,7 @@ applies to a host's lease only. A later tool call in the session
 takes the lease again.
 `
   ).action(async (opts) => {
-    warnIfApiKeyFlag(opts);
-    const { runWorkRelease, WorkCommandError } = await import('./work-claim-cmd-34FERLYX.js');
+    const { runWorkRelease, WorkCommandError } = await import('./work-claim-cmd-3J3QW56U.js');
     try {
       await runWorkRelease(opts);
     } catch (err) {
@@ -4726,8 +4758,7 @@ Idempotent: declaring the same pull request twice is a no-op.
 needs your own login; an agent session or a factory key is refused.
 `
   ).action(async (number, opts) => {
-    warnIfApiKeyFlag(opts);
-    const { runWorkPr, WorkPrCommandError } = await import('./work-pr-cmd-5LGANL32.js');
+    const { runWorkPr, WorkPrCommandError } = await import('./work-pr-cmd-H4OQR26N.js');
     try {
       await runWorkPr({ ...opts, number });
     } catch (err) {
@@ -4752,9 +4783,8 @@ login, then declares the pull request on the item, as \`work pr\` does.
 Run it again after a change to the title or description.
 `
   ).action(async (opts) => {
-    warnIfApiKeyFlag(opts);
-    const { runWorkOpenPr, WorkOpenPrCommandError } = await import('./work-open-pr-cmd-RPXKCBWS.js');
-    const { WorkCommandError } = await import('./work-cmd-7S5B2H2P.js');
+    const { runWorkOpenPr, WorkOpenPrCommandError } = await import('./work-open-pr-cmd-XNCEI4ZM.js');
+    const { WorkCommandError } = await import('./work-cmd-5EPPD33Y.js');
     try {
       await runWorkOpenPr(opts);
     } catch (err) {
@@ -4770,8 +4800,8 @@ function registerRunnerCommands(program2) {
   const runnerCmd = program2.command("runner").description("Take work from the implement and amend queues on this machine");
   const configOption = "the cloud config file to run against (default: ~/.outerlayer/config.json)";
   runnerCmd.command("start").description("Run the loop: claim work, run it, report, clean up, repeat").option("--config <path>", configOption).action(async (opts) => {
-    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-FXDG4NPJ.js');
-    const { start, RunnerStartError } = await import('./loop-UGI2BJOT.js');
+    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-CLSGABD5.js');
+    const { start, RunnerStartError } = await import('./loop-SYYPVFYW.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-3DM4OBKO.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     try {
@@ -4786,8 +4816,8 @@ function registerRunnerCommands(program2) {
     }
   });
   runnerCmd.command("check").description("Validate the config, the hooks and the key, and print the effective settings").option("--config <path>", configOption).action(async (opts) => {
-    const { defaultRunnerConfigPath } = await import('./config-FXDG4NPJ.js');
-    const { runRunnerCheck } = await import('./check-5C4YDZYV.js');
+    const { defaultRunnerConfigPath } = await import('./config-CLSGABD5.js');
+    const { runRunnerCheck } = await import('./check-UWQAL2MN.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const result = await runRunnerCheck(configPath);
     if (!result.ok) {
@@ -4803,7 +4833,7 @@ function registerRunnerCommands(program2) {
 `);
   });
   runnerCmd.command("install").description("Put this CLI in the runner's install layout; --service adds its service").option("--config <path>", configOption).option("--service", "set up the service that keeps the runner running").option("--print", "with --service, print the unit and set up nothing").option("--user <account>", "with --service, the account the service runs as").option("--replace", "replace a unit or launcher file this command did not write").option("--allow-downgrade", "install this CLI even when it is older than the version the runner runs").option("--unit-name <name>", "with --service, the unit's name, to run a second runner beside the first").action(async (opts) => {
-    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-FXDG4NPJ.js');
+    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-CLSGABD5.js');
     const { runRunnerInstall, RunnerInstallError, launcherSummary, restartNote } = await import('./install-cmd-QDOTR4OM.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     if (opts.service !== true) {
@@ -4816,7 +4846,7 @@ function registerRunnerCommands(program2) {
     }
     try {
       if (opts.service === true) {
-        const { installServiceCommand } = await import('./command-H5CILO4S.js');
+        const { installServiceCommand } = await import('./command-OEAV7BVX.js');
         const result2 = await installServiceCommand({
           configPath,
           print: opts.print,
@@ -4871,8 +4901,8 @@ To keep it running, run ${C.yellow}${cliInvocation()} runner install --service${
       fail(`pass --service: \`${cliInvocation()} runner uninstall --service\` removes the runner's service.`);
       return;
     }
-    const { defaultRunnerConfigPath } = await import('./config-FXDG4NPJ.js');
-    const { uninstallServiceCommand } = await import('./command-H5CILO4S.js');
+    const { defaultRunnerConfigPath } = await import('./config-CLSGABD5.js');
+    const { uninstallServiceCommand } = await import('./command-OEAV7BVX.js');
     const result = await uninstallServiceCommand({ configPath: opts.config ?? defaultRunnerConfigPath(), unitName: opts.unitName, home: homeFromEnv() });
     if (result.ok) for (const line of result.lines) process.stdout.write(`${C.green}\u2713${C.reset} ${line}
 `);
@@ -4899,12 +4929,12 @@ already in runner.env is used.
   printf '%s' "$CLAUDE_CODE_OAUTH_TOKEN" | ${cliInvocation()} runner init --agent claude --factory <org>/<factory>
 `
   ).action(async (opts) => {
-    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-FXDG4NPJ.js');
-    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-VWXIZEAN.js');
-    const { obtainRunnerKey, runnerKeyLogin } = await import('./runner-key-TC3NFWFV.js');
-    const { detectMachine } = await import('./machine-JOW4RNZ7.js');
-    const { chooseVm, runVmInit, VmInitError } = await import('./init-WNXXYMO7.js');
-    const { AGENT_COMMANDS, credentialFromStdin, isAgentName, restartForCredential, RunnerEnvError } = await import('./runner-env-4NB2GA7O.js');
+    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-CLSGABD5.js');
+    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-MOINY2DD.js');
+    const { obtainRunnerKey, runnerKeyLogin } = await import('./runner-key-276SJU5R.js');
+    const { detectMachine } = await import('./machine-6X63G2KH.js');
+    const { chooseVm, runVmInit, VmInitError } = await import('./init-LWHDMZQG.js');
+    const { AGENT_COMMANDS, credentialFromStdin, isAgentName, restartForCredential, RunnerEnvError } = await import('./runner-env-FRZFFHDF.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     if (opts.agent !== void 0 && !isAgentName(opts.agent)) {
       fail(`--agent ${opts.agent}: runner init writes commands for ${Object.keys(AGENT_COMMANDS).join(", ")}. For another agent, leave --agent out and edit runner.commands.`);
@@ -4918,7 +4948,7 @@ already in runner.env is used.
     try {
       let credential;
       if (agent !== void 0) {
-        const { readPipedKey } = await import('./login-browser-O63QZN7D.js');
+        const { readPipedKey } = await import('./login-browser-DX35MARZ.js');
         credential = credentialFromStdin(
           await readPipedKey(process.stdin, {
             onWaiting: () => process.stderr.write(`runner init is waiting for Claude's credential on stdin; close stdin to use the one already in runner.env
@@ -5054,7 +5084,7 @@ ${C.yellow}The runner will not update itself: ${installErr.message}${C.reset}
       let serviceUp = false;
       let restart;
       if (installedLayout) {
-        const { installServiceCommand } = await import('./command-H5CILO4S.js');
+        const { installServiceCommand } = await import('./command-OEAV7BVX.js');
         const service = await installServiceCommand({
           configPath,
           entryPath: process.argv[1] ?? "",
@@ -5098,12 +5128,12 @@ Next:
     "after",
     "\nA repository governed by a control plane builds the control plane's image, at the commit\nthe gateway has stored for it. A repository that governs itself fetches the head of its\ndefault branch into the runner's cache. Either way it reads .devcontainer/devcontainer.json\nand builds the image with the devcontainer CLI. Settings\nthat reach the host or widen the container's privileges are ignored and listed. The\nimage holds this CLI and a pinned Claude Code. Nothing runs inside the image.\n"
   ).action(async (opts) => {
-    const { defaultRunnerConfigPath } = await import('./config-FXDG4NPJ.js');
+    const { defaultRunnerConfigPath } = await import('./config-CLSGABD5.js');
     const { buildRepositoryImage, RecipeError } = await import('./build-TQ6X5PYN.js');
     const { currentCliBuild } = await import('./cli-build-K56DK4DS.js');
-    const { createDockerHost } = await import('./docker-RC3PRX3Q.js');
-    const { builderSpec } = await import('./builder-DUI2ZH2H.js');
-    const { loadRunnerConfig } = await import('./config-FXDG4NPJ.js');
+    const { createDockerHost } = await import('./docker-BFU3AQGY.js');
+    const { builderSpec } = await import('./builder-C4QNTYMS.js');
+    const { loadRunnerConfig } = await import('./config-CLSGABD5.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const loaded = (() => {
       try {
@@ -5114,7 +5144,7 @@ Next:
     })();
     const memory = loaded?.build?.memory ?? "8g";
     try {
-      const { imageTargetFor } = await import('./governing-source-BUU4IABS.js');
+      const { imageTargetFor } = await import('./governing-source-V5EEGPTA.js');
       const target = await imageTargetFor({ config: loaded, repository: opts.repository, fetchImpl: fetch });
       if (!target.ok) {
         if (opts.json) {
@@ -5177,16 +5207,16 @@ Next:
     }
   });
   runnerCmd.command("stop").description("Take no more work; wait for running jobs to finish, then exit").option("--config <path>", "the cloud config file naming the runner to stop").option("--now", "end running jobs immediately, with outcome stopped").action(async (opts) => {
-    const { defaultRunnerConfigPath } = await import('./config-FXDG4NPJ.js');
-    const { requestStop } = await import('./loop-UGI2BJOT.js');
+    const { defaultRunnerConfigPath } = await import('./config-CLSGABD5.js');
+    const { requestStop } = await import('./loop-SYYPVFYW.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     await requestStop(configPath, Boolean(opts.now));
   });
   runnerCmd.command("status").description("List running jobs; with --recent, finished ones too").option("--config <path>", "the cloud config file naming the runner to inspect").option("--recent", "also list finished jobs, newest first, capped at 20").option("--json", "machine-readable JSON output").action(async (opts) => {
-    const { defaultRunnerConfigPath, loadRunnerConfig } = await import('./config-FXDG4NPJ.js');
+    const { defaultRunnerConfigPath, loadRunnerConfig } = await import('./config-CLSGABD5.js');
     const { jobsDir, runnerDir } = await import('./paths-7XP63OAX.js');
-    const { listJobFiles, runnerProcessState } = await import('./loop-UGI2BJOT.js');
-    const { renderStatus } = await import('./status-TKCLLKFG.js');
+    const { listJobFiles, runnerProcessState } = await import('./loop-SYYPVFYW.js');
+    const { renderStatus } = await import('./status-NAK6DYSF.js');
     const { readHousekeepingRecord } = await import('./record-3WP6V2K5.js');
     const path2 = await import('path');
     const configPath = opts.config ?? defaultRunnerConfigPath();
@@ -5206,7 +5236,7 @@ Next:
     const service = await (async () => {
       if (process.platform !== "linux" || !existsSync("/run/systemd/system")) return void 0;
       const { inspectService, realInspectProbes } = await import('./inspect-6UYAAXH7.js');
-      const { DEFAULT_UNIT_NAME } = await import('./install-CBWIEF3R.js');
+      const { DEFAULT_UNIT_NAME } = await import('./install-4SEFIIW2.js');
       const facts = inspectService(DEFAULT_UNIT_NAME, path2.dirname(configPath), realInspectProbes());
       return facts === void 0 ? void 0 : { unit: facts.unit, running: facts.mainPid !== void 0, delegated: facts.delegate };
     })();
@@ -5241,8 +5271,8 @@ Next:
     );
   });
   runnerCmd.command("logs").argument("<item>", "the work item's number in the factory").description("Print the newest attempt's log for one item").option("--config <path>", "the cloud config file naming the runner to inspect").option("-f, --follow", "keep printing as the log grows").action(async (itemArg, opts) => {
-    const { defaultRunnerConfigPath } = await import('./config-FXDG4NPJ.js');
-    const { listJobFiles } = await import('./loop-UGI2BJOT.js');
+    const { defaultRunnerConfigPath } = await import('./config-CLSGABD5.js');
+    const { listJobFiles } = await import('./loop-SYYPVFYW.js');
     const { newestAttempt, logPathFor, tail, RunnerLogsError } = await import('./logs-AMLKC3VP.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const item = parseTrackerNumber(itemArg);
@@ -5277,32 +5307,22 @@ function registerHooksCommands(program2) {
     "after",
     "\n`init` auto-wraps PreToolUse/PostToolUse hooks; these subcommands cover the\nrest: manual re-scans, other events, and undo.\n"
   );
-  hooksCmd.command("install-git").description("Install the commit-guard git hook in this repo").option("--print", "print the hook scripts instead of installing").addHelpText(
+  hooksCmd.command("install-git").description("Remove the git hooks an earlier version installed in this repo").addHelpText(
     "after",
-    "\nThe same install `init` performs. `--print` writes the script to stdout for\nrepositories that manage hooks in-tree (husky and friends).\n"
-  ).action((opts) => {
-    if (opts.print) {
-      for (const [name, script] of managedHookScripts()) {
-        process.stdout.write(`# ==== ${name} ====
-${script}
-`);
-      }
-      return;
-    }
+    "\nEarlier versions installed a pre-commit guard and commit journal hooks. This removes\nthe ones OuterLayer wrote and leaves any hook it did not write untouched.\n"
+  ).action(() => {
     const removal = removeJournalHooks(process.cwd());
     if (removal.removed) {
       process.stdout.write(`${C.green}\u2713${C.reset} removed the commit journal hooks an earlier version installed \u2192 ${removal.path}
 `);
     }
-    const guard = installPreCommitGuardHook(process.cwd());
-    const report = formatGuardInstallOutput(guard);
-    if (report.error !== void 0) {
-      fail(report.error);
-      return;
+    const guard = removePreCommitGuardHook(process.cwd());
+    if (guard.removed) {
+      process.stdout.write(`${C.green}\u2713${C.reset} removed the pre-commit guard an earlier version installed \u2192 ${guard.path}
+`);
     }
-    for (const line of report.lines) process.stdout.write(`${line}
+    if (!removal.removed && !guard.removed) process.stdout.write(`${C.dim}No git hooks from an earlier version were found.${C.reset}
 `);
-    if (report.exitCode !== void 0) process.exitCode = report.exitCode;
   });
   hooksCmd.command("status").description("List hook entries in user and project settings, marking the wrapped ones").option("--json", "machine-readable JSON output").action((opts) => {
     const report = [];
@@ -5501,7 +5521,7 @@ caller from the bearer token, the gateway answers 401 without that header.
     "after",
     "\nWhat the stdio .mcp.json entry spawns. Reads newline-delimited JSON-RPC 2.0 on\nstdin and writes responses on stdout. The API key comes from OUTERLAYER_API_KEY\nor ~/.outerlayer/config.json at start-up; with neither the command exits 1 and\nprints why, which the MCP client shows as the connect error.\n"
   ).action(async (opts) => {
-    const { runMcpServe, handleMcpServeError } = await import('./mcp-serve-cmd-DOTY5FKY.js');
+    const { runMcpServe, handleMcpServeError } = await import('./mcp-serve-cmd-N3UTY6EE.js');
     try {
       await runMcpServe({ url: opts.url, appId: opts.appId });
     } catch (err) {
@@ -5512,7 +5532,7 @@ caller from the bearer token, the gateway answers 401 without that header.
 function registerImportCommands(program2) {
   const importCmd = program2.command("import").description("Import an existing config format into .outerlayer/");
   importCmd.command("ruler").description("Port a .ruler/ tree into the equivalent .outerlayer/ tree").option("--dir <path>", "repo root to read from (default: cwd)").option("--json", "machine-readable JSON output").addHelpText("after", "\nRuler: https://github.com/intellectronica/ruler. Mostly a rename.\n").action(async (opts) => {
-    const { runImportRuler, ImportRulerError } = await import('./import-ruler-cmd-KJMWL5V6.js');
+    const { runImportRuler, ImportRulerError } = await import('./import-ruler-cmd-5P6JOXQN.js');
     try {
       const result = runImportRuler({ cwd: opts.dir, json: opts.json });
       if (result.exitCode !== 0) process.exitCode = result.exitCode;
@@ -5528,7 +5548,7 @@ function registerImportCommands(program2) {
     "after",
     "\nInstalls the four maintained skills (outerlayer-evidence, outerlayer-amend,\nouterlayer-findings, outerlayer-cli) and an AGENTS.md snippet teaching agents to run\n`emit artifact`. A skill that differs from this CLI's bundle is rewritten to it, and the output says so.\n"
   ).action(async (opts) => {
-    const { runImportCapture, ImportCaptureError } = await import('./import-capture-cmd-ZO6KGHI2.js');
+    const { runImportCapture, ImportCaptureError } = await import('./import-capture-cmd-KKFFOGWP.js');
     try {
       runImportCapture({ cwd: opts.dir, json: opts.json });
     } catch (err) {
@@ -5540,59 +5560,14 @@ function registerImportCommands(program2) {
     }
   });
 }
-function formatContextMaterializeOutput(result) {
-  switch (result.status) {
-    case "not-a-repo":
-      return { stdout: [], stderr: [`${C.red}\u2717${C.reset} not inside a git repository.`], exitCode: 1 };
-    case "self":
-      return { stdout: [`${C.dim}This repository is self-sourced \u2014 nothing to materialize.${C.reset}`], stderr: [] };
-    case "materialized": {
-      const stdout = [`${C.green}\u2713${C.reset} Materialized context at ${C.dim}${result.sha?.slice(0, 7)}${C.reset}`];
-      if (result.message) stdout.push(`${C.yellow}!${C.reset} ${result.message}`);
-      return { stdout, stderr: [] };
-    }
-    case "debounced": {
-      const stdout = [`${C.green}\u2713${C.reset} Already current at ${C.dim}${result.sha?.slice(0, 7)}${C.reset} (verification: ${result.verification})`];
-      if (result.message) stdout.push(`${C.yellow}!${C.reset} ${result.message}`);
-      return { stdout, stderr: [] };
-    }
-    case "adoption-conflict":
-      return { stdout: [`${C.yellow}!${C.reset} ${result.message}`], stderr: [], exitCode: 1 };
-    default:
-      return { stdout: [`${C.yellow}!${C.reset} ${result.message ?? result.status}`], stderr: [], exitCode: 1 };
-  }
-}
 function registerContextCommands(program2) {
-  const contextCmd = program2.command("context").description("Compile and materialize agent context");
+  const contextCmd = program2.command("context").description("Compile agent context");
   contextCmd.command("emit").description("Compile .outerlayer/ into each configured target tool's native files").option("--check", "compare against disk, write nothing, exit 1 on drift (CI mode)").option("--dir <path>", "repo root to read from (default: cwd)").option("--json", "machine-readable JSON output").addHelpText(
     "after",
     '\nTargets come from .outerlayer/config.json only; there is no --target flag.\nMissing or empty config: {"targets": [...]}, e.g. {"targets": ["claude-code"]}.\nKnown targets: claude-code, cursor, codex, copilot, factory.\n\nThe maintained skills (outerlayer-evidence, outerlayer-amend, outerlayer-findings,\nouterlayer-cli) follow this CLI: emit rewrites one that differs from its bundle, and --check\nreports it as drift. A copy under an earlier name (amend, emitting-evidence,\nreporting-findings, outerlayer) is deleted, and --check reports it as retired.\nTemplates (spec, writing-specs, writing-tests, build) are never rewritten or reported.\n\nOrphan detection (--check) only covers header-carrying outputs: every markdown\ntarget file gets a generated-by comment, but .mcp.json and .cursor/mcp.json are\nJSON with no comment syntax, so they can never be flagged as orphaned; missing\nand content drift still apply to them.\n'
   ).action(async (opts) => {
     await compileContext({ dir: opts.dir, check: opts.check, json: opts.json });
   });
-  contextCmd.command("adopt <stagedDir>", { hidden: true }).description("Copy context the runner staged into this checkout (container builds)").option("--json", "machine-readable JSON output").action(async (stagedDir) => {
-    const { runContextAdopt } = await import('./context-adopt-O5OFXMKI.js');
-    const { exitCode, stdout } = runContextAdopt(stagedDir, process.cwd());
-    process.stdout.write(stdout);
-    process.exitCode = exitCode;
-  });
-  contextCmd.command("materialize").description("Materialize this repository's governed context from its control plane").option("--json", "machine-readable JSON output").addHelpText(
-    "after",
-    "\nThe same flow SessionStart runs automatically, exposed for a manual retry or a\nfirst check outside a session. Writes AGENTS.md, .claude/**, and .outerlayer/**.\n"
-  ).action(async (opts) => {
-    const { materializeContext } = await import('./context-materialize-Y5IJ4MQT.js');
-    const result = await materializeContext({ cwd: process.cwd(), sessionId: `manual-${Date.now()}` });
-    const output = formatContextMaterializeOutput(result);
-    if (output.exitCode !== void 0) process.exitCode = output.exitCode;
-    if (opts.json) {
-      writeJson(result);
-      return;
-    }
-    for (const line of output.stdout) process.stdout.write(`${line}
-`);
-    for (const line of output.stderr) process.stderr.write(`${line}
-`);
-  });
 }
 
-export { buildProgram, formatContextMaterializeOutput, formatGuardInstallOutput, formatInitOutput, runCli };
+export { buildProgram, formatInitOutput, runCli };