@outerlayer/cli 0.18.0 → 0.19.1

package/CHANGELOG.md

@@ -1,5 +1,38 @@
 # @outerlayer/cli
 
+## 0.19.1
+
+### Patch Changes
+
+- 331130f: A session start that removes an earlier CLI's copies also puts back `.outerlayer-pin.json` when that CLI rewrote it, so `git status` is clean afterwards. A staged change to the pin is left alone.
+
+  `outerlayer init --local --shell-function` adds the `claude` shell function, and `--local --no-shell-function` removes it. `--local` used to skip both flags without a word.
+
+## 0.19.0
+
+### Minor Changes
+
+- 5153995: Add `outerlayer emit step <name>`. An agent reports that it started a step, such as "Review round 2", and the work item's Activity tab shows it.
+
+  The name is 1 to 80 characters on one line. If the gateway cannot be reached, the command queues the step with the time you ran it and exits 0, and `outerlayer sync` sends it later. If the gateway refuses the step, the command prints the reason and exits 1.
+
+- 3d15dba: On a laptop, `outerlayer claude` starts Claude Code with your control plane attached, without writing its files into your repository. It keeps a copy of the control plane under `~/.outerlayer/context/` and starts Claude Code with that copy added.
+
+  A governed repository can now commit its own `CLAUDE.md`, `AGENTS.md` and skills. `outerlayer init` can add a `claude` function to your zsh or bash startup file, so plain `claude` starts the same way. A session that did not start through `outerlayer claude` says the shared instructions are missing.
+
+  `outerlayer context materialize` and the pre-commit guard are removed. A session start removes the files, the exclude block and the guard that an earlier CLI added to a checkout.
+
+- 3210eaa: `outerlayer work logs` prints the runner's log for a host attempt. A runner now sends that log with every release, and gives a reason when a build command dies of a signal it did not send.
+
+### Patch Changes
+
+- ff302c8: The build skill says a pull request closes a GitHub issue, and that a person completes a Linear or Jira issue in its tracker after merge.
+- de29d22: `outerlayer context emit` deletes a generated file whose source is gone, so every orphan `--check` reports is one a plain emit clears. Before, `--check` reported these files and emit left them, so the check kept failing.
+
+  Neither form reads inside a nested git repository, a submodule, or a governed clone any more. Generated files there belong to that tree, not to the repository being emitted.
+
+- 13ee333: Update the bundled `@noble/hashes` library from 1.8 to 2.4. The CLI's pricing code depends on it. Token costs the CLI reports are unchanged.
+
 ## 0.18.0
 
 ### Minor Changes

package/README.md

@@ -90,7 +90,8 @@ content:
   `release` marks it done. `outerlayer work comment` posts one comment on a
   work item's general thread or a criterion thread — the detected session id
   rides along the same way it does for `emit`, only ever narrowing what the
-  comment may do; `outerlayer work threads` reads them back. A runner key
+  comment may do; `outerlayer work threads` reads them back. `outerlayer work logs`
+  reads the runner's log for a host attempt. A runner key
   needs `git.read` and `work.read` to
   list and read items, and `work.claim` to claim, renew or release — `work.claim`
   is not granted to a dashboard role by default, since a claim is a host's
@@ -103,7 +104,11 @@ content:
   credential.
 - **`outerlayer runner start`** lists, claims, renews and releases work
   items the same way `work claim`/`renew`/`release` do, on the schedule its
-  config sets — it sends nothing about the job it runs beyond that; the
+  config sets. Each release also carries the runner's own log for the attempt:
+  the lines the runner logged for that item, and the tail of the stage log when
+  the attempt ended in provision, sync, cleanup or report. It is scrubbed with
+  the same patterns as the build's session, capped at 64 KiB and always sent.
+  The runner sends nothing else about the job it runs; the
   agent it starts is a separate process with its own credentials, from the
   `runner` block, never the copy-out daemon's. It also sends a heartbeat at
   the end of every poll: the host, the CLI version, the poll interval, the
@@ -240,6 +245,11 @@ content:
   credited the member who asked for the build. The runner sets that author in
   the build's environment and adds the `Co-authored-by` line with git hooks it
   writes into the build's own directory.
+- **`outerlayer claude`** asks your gateway which repository governs the
+  current one (`GET /v1/context/source`, with your API key). When one does, it
+  runs `git fetch` of that control plane into a cache under
+  `~/.outerlayer/context` and starts Claude Code with the files attached.
+  Nothing is written into your working tree.
 - **`outerlayer runner start` with `builtin:container` hooks** also asks your
   gateway which repository governs the item's repository (`GET
   /v1/context/source`, signed with the host key), after the recipe's
@@ -327,6 +337,13 @@ content:
   declared proof kind, from the JSON file you name. The anchoring is the same
   as `emit finding`. Nothing but the file's content and the item number is
   sent.
+- **`outerlayer emit step <name>`** sends the step's name, the time you ran the
+  command, a random id for the step and the item number
+  (`POST /v1/work-items/steps`). The item is `--item`, or the item the
+  recorded session was launched for. When the gateway cannot be reached, the
+  same four values, the factory id and the directory are kept in
+  `~/.outerlayer/spool/steps.jsonl`, and `outerlayer sync` sends them later.
+  Nothing from the session itself is sent.
 - **`outerlayer mcp serve`** is the stdio MCP server your editor spawns. It
   forwards every JSON-RPC message the editor sends to the gateway and returns
   the reply.
@@ -391,9 +408,11 @@ before it gives up.
 | `outerlayer emit artifact <file> --caption <text> [--for <criterion-id>] [--pr <n>]` | Upload a proof artifact — screenshot, recording, report, or log — with its caption. Inside a recorded session it spools locally and ships on the next `sync`; otherwise it uploads immediately, anchored to a pull request or the current checkout. `--replaces` retires artifacts an earlier run uploaded. A JUnit XML file bound with `--for` proves a criterion that declares `test` proof; `--test <name[=path:line]>` binds only the named tests. |
 | `outerlayer emit <name> --result <pass\|fail> [--link <url>] [--body <text>\|--body-file <path>] --item <number>` | Record one named check's outcome on a work item. A check that ran carries the run URL as its proof (`--link`); a judgment you are making yourself carries one sentence (`--body`, or `--body-file` to read it from a file — `-` reads standard input). A `fail` needs at least one of the two; a `pass` needs neither. `--item` names the work item by the number printed when the item was created — always required, in or out of a recorded session; a session records checks on its own item like any other, stored as the session's, but cannot clear a person's fail. Prints the recorded check's id. Who recorded it comes from your API key, never from what you send. |
 | `outerlayer work comment --item <n> [--criterion <id>] --body <text> [--artifact <id>] [--pass\|--fail\|--attach\|--ready]` | Post one comment on a work item's general thread, or on one acceptance criterion's own thread with `--criterion`. `--pass`/`--fail` need a person's own credential and apply to the whole item, so they work on the general thread only and the gateway refuses them with `--criterion`; `--attach` makes the named artifact that criterion's current proof; `--ready` hands a thread back to a person. The detected session id rides along automatically, only ever narrowing what the comment may do. |
+| `outerlayer work logs --item <n> [--attempt <claim id>]` | Print the runner's log for a host attempt on a work item: the newest attempt a runner made, or the one `--attempt` names (an `id` from `claims` in `work status --json`). The log is what the runner did around the agent, with secrets removed on the host. Exits 1 for an attempt that is still running or that an older runner released without a log. |
 | `outerlayer work threads --item <n>` | Read a work item's threads back — the general thread first, then one per criterion with proof or a comment, each with its `waitingOn`. |
 | `outerlayer emit finding --id <id> --category <context\|flaky-test\|tooling\|environment\|defect\|other> --title <text> --file <path> --where <label> [--line <n>] [--item <number>] [--cause <text>] [--detail <text>] [--suggestion <text>] [--command <text>] [--error <text>] [--test <name>] [--symbol <name>] [--started-at <event> --ended-at <event>] [--problem <id> … --link-reason <text> \| --new] …` | Record one problem you hit in the factory. `--category` is one of `context` (an instruction that is wrong, broken or missing), `flaky-test`, `tooling`, `environment`, `defect` (a bug outside your own change) or `other`. A `context` finding also needs `--rule-path` and `--rule-relation` (`wrong`, `broken` or `missing`), and `--rule-quote` unless the relation is `missing`. `--cause`, `--detail`, `--suggestion`, `--command`, `--error` (the first error line), `--test` and `--symbol` carry what a fix needs. Every finding joins a factory-level problem: when a key of the finding matches a known problem it joins that problem; otherwise nothing is stored, the closest problems are printed, and the command exits with code 3. Run it again with `--problem <id> --link-reason <text>` (repeat `--problem` for each problem the finding reports) or with `--new`. Without `--started-at`, it prints the session's recent events with ids and times; name the event where you hit the problem and the one where you got past it with `--started-at` and `--ended-at`. Findings are informational; nothing reads one to pass or fail the work. `--item` names the work item; without it, inside a recorded session, the item that session was launched for is used automatically. Re-emitting the same `--id` on the item replaces that finding and keeps its problems. |
 | `outerlayer emit findings <file> [--item <number>]` | Record a whole batch at once, read from a JSON file (`-` for standard input) with `"schemaVersion": 3` — the same shape and validation as `emit finding`, one record per id. A finding's `startedAt` and `endedAt` may be event ids. The findings that match a key are stored; those that need a choice are listed with their candidates and not stored, and the exit code is 3. Anchored the same way: `--item`, else a recorded session's own item. |
+| `outerlayer emit step <name> [--item <number>]` | Report that you started a step. The name is free text, 1 to 80 characters on one line. The work item's Activity tab shows the step with the time you ran the command. A step has a start and nothing else, so run it again at the start of the next step. `--item` names the work item; without it, inside a recorded session, the item that session was launched for is used. If the gateway cannot be reached, or answers with a 5xx, the step is queued in `~/.outerlayer/spool/steps.jsonl`, the command exits 0, and `outerlayer sync` sends it later with its original time. If the gateway refuses the step, the command prints why and exits 1. |
 | `outerlayer emit criteria <file> [--item <number>]` | Record a work item's acceptance criteria as one list, read from a JSON file (`-` for standard input): `{"criteria": [{"id": "AC-1", "text": "Given …", "proof": null}]}`. An `id` is 1 to 64 characters of `A-Z a-z 0-9 . _ : -`, the same id `emit artifact --for` binds evidence to. `proof` is `video`, `screenshot`, `report`, `log`, `test`, `file` or `null` (any bound artifact proves it). The list holds 1 to 200 criteria, each `text` at most 2,000 characters, with no id twice. It is validated before anything is sent. This list is the only source for the item's Criteria tab. Once an item has a list, only a person can replace it: run the command outside an agent session, with your own login. Anchored the same way as `emit findings`: `--item`, else a recorded session's own item. |
 | `outerlayer mcp install [--transport stdio\|http] [--url] [--name] [--command]` | Write (or update) an `mcpServers` entry in `.mcp.json` for the OuterLayer gateway. Default `stdio`: the client spawns `outerlayer mcp serve`, which reads the API key from `~/.outerlayer/config.json` (or `OUTERLAYER_API_KEY`) each time it connects, so a reconnect picks up a newly saved or rotated key. `--transport http` writes a direct `POST /v1/mcp` entry referencing `${OUTERLAYER_API_KEY}`, resolved by the client from the environment it was launched with. Never writes an API key. Pass `--url`/`--app-id` for self-host. |
 | `outerlayer mcp serve [--url] [--app-id]` | Stdio MCP server bridging stdin/stdout JSON-RPC to the gateway's `POST /v1/mcp`. What the stdio `.mcp.json` entry runs; exits 1 with a clear message when no API key is configured. |

package/dist/{agent-setup-RBTEACYU.js → agent-setup-AM42SA2D.js}

@@ -1,28 +1,27 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { keepHandWritten, runAgentSetup } from './chunk-RAZTWYZN.js';
-import './chunk-47TTLEDX.js';
+export { keepHandWritten, runAgentSetup } from './chunk-CGGPS7SI.js';
+import './chunk-5VML45HH.js';
 import './chunk-YVZJ6GKF.js';
-import './chunk-F4XSVQJ4.js';
+import './chunk-6X4SQ5MY.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-W5VPCONO.js';
-import './chunk-LXAY4A2G.js';
-import './chunk-T4Y6SCG3.js';
-import './chunk-ZRL6HKBY.js';
-import './chunk-52NC2FIU.js';
-import './chunk-MNTSH4CL.js';
-import './chunk-X5N6KC6V.js';
-import './chunk-N3CUDFCW.js';
+import './chunk-EAEELQVQ.js';
+import './chunk-7UWVLZXD.js';
+import './chunk-FVMYKL6L.js';
+import './chunk-NTRCK4NH.js';
+import './chunk-ZJSNLVCE.js';
+import './chunk-BJ3KTMDH.js';
+import './chunk-NNLA7LLQ.js';
 import './chunk-EABW6AJQ.js';
+import './chunk-CRB3POP4.js';
+import './chunk-YQR6E6OV.js';
+import './chunk-WFSUUUAN.js';
+import './chunk-7VUK5RFS.js';
+import './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
 import './chunk-M2ZWWTWZ.js';
 import './chunk-N2PXGQRL.js';
 import './chunk-BQXFBI7T.js';
-import './chunk-XCCLFVXM.js';
-import './chunk-ZJSNLVCE.js';
-import './chunk-BJ3KTMDH.js';
-import './chunk-CRB3POP4.js';
-import './chunk-VNVZDWO3.js';
 import './chunk-Z5GEFMRW.js';
 
 createRequire(import.meta.url);

package/dist/{artifact-link-cmd-AVM2EKTV.js → artifact-link-cmd-OWRI5AJX.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { sanitizeTerminal, readEffectiveArtifactSpoolState } from './chunk-MQJSXHV7.js';
-import './chunk-N3CUDFCW.js';
+import { sanitizeTerminal, readEffectiveArtifactSpoolState } from './chunk-G3IJ3N6F.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
+import './chunk-7VUK5RFS.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-13T00:18:48.455Z+4c5e4a3","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-13T20:24:21.442Z+3c40b5d","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{builder-DUI2ZH2H.js → builder-C4QNTYMS.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-S26M3YBJ.js';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-3UZTIRLF.js';
 import './chunk-7RQ73DLO.js';
 import './chunk-CX22S5BA.js';
-import './chunk-BMYGAGBJ.js';
-import './chunk-N3CUDFCW.js';
+import './chunk-QNLX477Q.js';
+import './chunk-7VUK5RFS.js';
 import './chunk-N2PXGQRL.js';
 import './chunk-BQXFBI7T.js';
 import './chunk-Z5GEFMRW.js';

package/dist/{check-5C4YDZYV.js → check-W2JGXN3B.js}

@@ -1,39 +1,41 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-QQM2UJ6T.js';
+import { probeCredentials } from './chunk-F2KXHIFI.js';
+import './chunk-B6SCN5NY.js';
+import './chunk-MTP2QEVO.js';
+import './chunk-S5PCA3SN.js';
 import './chunk-3JVYMD4G.js';
-import './chunk-I2UOAV7X.js';
 import './chunk-YETTWTAY.js';
-import './chunk-3OFZM4X6.js';
 import './chunk-SADUQSO4.js';
-import './chunk-KDVIU23F.js';
-import './chunk-MTP2QEVO.js';
-import './chunk-S5PCA3SN.js';
-import './chunk-UYOYTKE2.js';
+import './chunk-I2UOAV7X.js';
+import './chunk-BWSUPRDK.js';
+import './chunk-JHGEBPLE.js';
 import './chunk-XNGMQ27R.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-FUB7LRUE.js';
-import './chunk-AMFWYESY.js';
-import './chunk-YYYRBYWG.js';
-import './chunk-GOBOJMOJ.js';
-import './chunk-JF42URPU.js';
+import './chunk-R22NZSGA.js';
+import './chunk-KYS3TQAG.js';
 import './chunk-ESVW4MJY.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-GEMQLBMW.js';
+import './chunk-YYYRBYWG.js';
+import './chunk-AMFWYESY.js';
 import './chunk-TBT347UY.js';
-import './chunk-NL4XPC7W.js';
-import './chunk-Y5MXET4M.js';
-import './chunk-L2USZT6T.js';
-import './chunk-S26M3YBJ.js';
+import './chunk-PIZRPNKR.js';
+import './chunk-7YP7T6GV.js';
+import './chunk-LW7G5TJB.js';
+import './chunk-3ZR7Y23Y.js';
+import './chunk-OGFGZQA3.js';
+import './chunk-VMJPFQNE.js';
+import './chunk-3UZTIRLF.js';
 import './chunk-GGOMT6KF.js';
 import './chunk-X5H2WYMB.js';
-import './chunk-6CHIYEZZ.js';
-import './chunk-SWCTGCSC.js';
-import './chunk-WGAUY5LE.js';
+import './chunk-XZ4H4X5F.js';
+import './chunk-QEFKA2QD.js';
 import { parseRunnerEnv } from './chunk-6MZSX4M7.js';
-import './chunk-KK4VBOH6.js';
-import './chunk-WBT5X3NH.js';
-import './chunk-IP7BIBXJ.js';
-import './chunk-S76AYB4M.js';
-import './chunk-MQJSXHV7.js';
-import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-XGP3VYOG.js';
+import './chunk-FBTGMSQF.js';
+import './chunk-IF2OSI5T.js';
+import './chunk-CG36IONK.js';
+import './chunk-G3IJ3N6F.js';
+import './chunk-BM63HB2M.js';
+import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-P53VEAOF.js';
 import './chunk-UXYLWVTQ.js';
 import './chunk-7RQ73DLO.js';
 import './chunk-3CWUOFV6.js';
@@ -41,36 +43,35 @@ import './chunk-QOZKPLVJ.js';
 import './chunk-CX22S5BA.js';
 import './chunk-ECODQ7II.js';
 import './chunk-JBJTC3UU.js';
-import './chunk-OGFGZQA3.js';
+import './chunk-PSN33ERW.js';
 import './chunk-F7CU5ABH.js';
 import './chunk-BKO6JEZI.js';
-import './chunk-BMYGAGBJ.js';
-import './chunk-NACDBXUG.js';
+import './chunk-QNLX477Q.js';
 import './chunk-GOSFARMS.js';
 import './chunk-ANPNT6PM.js';
 import './chunk-T2Q7ISPE.js';
 import './chunk-WZBHBH3J.js';
 import './chunk-5QRP3MVS.js';
-import './chunk-W5VPCONO.js';
-import './chunk-LXAY4A2G.js';
-import './chunk-T4Y6SCG3.js';
-import './chunk-ZRL6HKBY.js';
-import './chunk-52NC2FIU.js';
-import './chunk-MNTSH4CL.js';
-import './chunk-X5N6KC6V.js';
-import './chunk-N3CUDFCW.js';
+import './chunk-LLM3I5YU.js';
+import './chunk-EAEELQVQ.js';
+import './chunk-7UWVLZXD.js';
+import './chunk-FVMYKL6L.js';
+import './chunk-NTRCK4NH.js';
+import './chunk-ZJSNLVCE.js';
+import './chunk-BJ3KTMDH.js';
+import './chunk-G2YNJIGF.js';
+import './chunk-NNLA7LLQ.js';
 import './chunk-EABW6AJQ.js';
+import './chunk-CRB3POP4.js';
+import './chunk-YQR6E6OV.js';
+import './chunk-TUSYOL2O.js';
+import './chunk-WFSUUUAN.js';
+import './chunk-7VUK5RFS.js';
+import './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
 import './chunk-M2ZWWTWZ.js';
 import './chunk-N2PXGQRL.js';
 import './chunk-BQXFBI7T.js';
-import './chunk-ULSIJGLS.js';
-import './chunk-G2YNJIGF.js';
-import './chunk-XCCLFVXM.js';
-import './chunk-ZJSNLVCE.js';
-import './chunk-BJ3KTMDH.js';
-import './chunk-CRB3POP4.js';
-import './chunk-VNVZDWO3.js';
 import './chunk-Z5GEFMRW.js';
 import { readFileSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-S26M3YBJ.js → chunk-3UZTIRLF.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { parseSize } from './chunk-7RQ73DLO.js';
 import { BUILDKIT_IMAGE } from './chunk-CX22S5BA.js';
-import { compareVersions } from './chunk-BMYGAGBJ.js';
+import { compareVersions } from './chunk-QNLX477Q.js';
 import { runnerDir } from './chunk-N2PXGQRL.js';
 import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-BQXFBI7T.js';
 import { createHash } from 'crypto';

package/dist/{chunk-Y5MXET4M.js → chunk-3ZR7Y23Y.js}

@@ -1,24 +1,25 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { createDockerHost, childEnvironment, spawnRun } from './chunk-L2USZT6T.js';
-import { builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, JUDGE_DIR, MAX_REPORT_BYTES } from './chunk-S26M3YBJ.js';
+import { currentCliBuild } from './chunk-OGFGZQA3.js';
+import { createDockerHost, childEnvironment, spawnRun } from './chunk-VMJPFQNE.js';
+import { builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, HASH_ARGV, parseProgramHash, JUDGE_PROGRAM, containerExecArgs, JUDGE_DIR, MAX_REPORT_BYTES } from './chunk-3UZTIRLF.js';
 import { execCapture } from './chunk-GGOMT6KF.js';
 import { GUEST_CID } from './chunk-X5H2WYMB.js';
-import { describeCallFailure, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, sharedSkillNames, shimScript } from './chunk-6CHIYEZZ.js';
-import { WorkCommandError } from './chunk-KK4VBOH6.js';
+import { describeCallFailure, controlPlaneTokenFailure, refusalCode, resolveGoverningSource, removeStagedContext, stageGovernedContext, pinnedSourceOf, commandWithShim, shimScript } from './chunk-XZ4H4X5F.js';
+import { WorkCommandError } from './chunk-FBTGMSQF.js';
 import { hostAllowed } from './chunk-UXYLWVTQ.js';
 import { parseDuKilobytes } from './chunk-7RQ73DLO.js';
 import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-3CWUOFV6.js';
 import { RecipeError } from './chunk-QOZKPLVJ.js';
 import { CLAUDE_CODE_VERSION, firecrackerArch, MICROVM_ARCHES, DEFAULT_BASE_IMAGE, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GUEST_ASSETS_VERSION } from './chunk-CX22S5BA.js';
 import { startTimeOf, isSameProcess } from './chunk-JBJTC3UU.js';
-import { currentCliBuild } from './chunk-OGFGZQA3.js';
-import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-BMYGAGBJ.js';
-import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-X5N6KC6V.js';
-import { downconvertSession } from './chunk-N3CUDFCW.js';
+import { setCustomScrubbers, setLocalIdentity, setRepoRoot, parseTranscript, scrubDeep, scrubText } from './chunk-QNLX477Q.js';
+import { sharedSkillNames, skillConflictMessage } from './chunk-LLM3I5YU.js';
+import { versionAtLeast, MINIMUM_CLAUDE_VERSION } from './chunk-G2YNJIGF.js';
+import { orderSessions, extractFacts, sessionsToTimeline } from './chunk-WFSUUUAN.js';
+import { downconvertSession } from './chunk-7VUK5RFS.js';
 import { rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, deliveryDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, RUNNER_DIR_MODE, SHIM_DIR, vmAssetsDir } from './chunk-N2PXGQRL.js';
 import { repositoriesOf, primaryOf, RELAY_PORT, repositoryPath, CHECKOUT_DIR, lifecycleWorkdir, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING, checkoutPath, JOB_MOUNT } from './chunk-BQXFBI7T.js';
-import { versionAtLeast, MINIMUM_CLAUDE_VERSION } from './chunk-G2YNJIGF.js';
 import { readFileSync, existsSync, mkdirSync, chmodSync, truncateSync, rmSync, writeFileSync, readdirSync, lstatSync, copyFileSync, accessSync, constants, statSync, rmdirSync, renameSync, unlinkSync, openSync, closeSync, mkdtempSync, createWriteStream, createReadStream } from 'fs';
 import { join, dirname, basename } from 'path';
 import { spawnSync, spawn } from 'child_process';
@@ -731,7 +732,7 @@ async function deliveryRefusal(input, staged) {
   const ownNames = new Set(own.stdout.split("\n").map((name) => name.trim()));
   const clash = sharedSkillNames(join(staged.dir, "tree")).find((name) => ownNames.has(name));
   if (clash === void 0) return void 0;
-  return `context_skill_conflict: .claude/skills/${clash} in ${input.repository} has the same name as the shared skill ${clash} from ${staged.repository}, and would replace it in this build; rename or remove it from the repository`;
+  return `context_skill_conflict: ${skillConflictMessage({ skill: clash, repository: input.repository, controlPlane: staged.repository })}, and would replace it in this build; rename or remove it from the repository`;
 }
 async function deliver(input, staged) {
   const dir = deliveryDir(staged.repository, staged.sha);

package/dist/{chunk-47TTLEDX.js → chunk-5VML45HH.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { C } from './chunk-ANPNT6PM.js';
-import { retiredSkillPaths, removeRetiredSkills } from './chunk-T4Y6SCG3.js';
-import { maintainedFilesForExistingSkills, loadMaintainedFiles, writeMaintainedFiles } from './chunk-MNTSH4CL.js';
-import { emitTree, parseOuterlayerConfig, classifyTree, generatedHeaderSource, CONTEXT_PIN_FILENAME, normalizePath } from './chunk-X5N6KC6V.js';
+import { retiredSkillPaths, removeRetiredSkills } from './chunk-7UWVLZXD.js';
+import { maintainedFilesForExistingSkills, loadMaintainedFiles, writeMaintainedFiles } from './chunk-NNLA7LLQ.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { existsSync, readFileSync, mkdirSync, writeFileSync, copyFileSync, readdirSync } from 'fs';
+import { emitTree, parseOuterlayerConfig, classifyTree, generatedHeaderSource, CONTEXT_PIN_FILENAME, normalizePath } from './chunk-WFSUUUAN.js';
+import { existsSync, readFileSync, mkdirSync, writeFileSync, copyFileSync, unlinkSync, rmdirSync, readdirSync } from 'fs';
 import { join, dirname, relative, sep } from 'path';
 
 createRequire(import.meta.url);
@@ -32,6 +32,9 @@ function discoverOuterlayerPaths(repoRoot) {
   walk(repoRoot, repoRoot, false, out);
   return out.sort();
 }
+function isForeignTree(dir) {
+  return existsSync(join(dir, ".git")) || existsSync(join(dir, CONTEXT_PIN_FILENAME));
+}
 function walk(dir, repoRoot, insideOuterlayer, out) {
   let entries;
   try {
@@ -44,7 +47,7 @@ function walk(dir, repoRoot, insideOuterlayer, out) {
     const full = join(dir, entry.name);
     if (entry.isDirectory()) {
       if (!insideOuterlayer && SKIP_DIRS.has(entry.name)) continue;
-      if (!insideOuterlayer && existsSync(join(full, CONTEXT_PIN_FILENAME))) continue;
+      if (!insideOuterlayer && isForeignTree(full)) continue;
       walk(full, repoRoot, insideOuterlayer || entry.name === ".outerlayer", out);
     } else if (entry.isFile() && insideOuterlayer) {
       out.push(toRepoRelative(repoRoot, full));
@@ -82,13 +85,14 @@ function writeOutputs(repoRoot, result, maintained) {
   }
   return { files, copies, maintained: [...changedMaintained.created, ...changedMaintained.rewritten] };
 }
-function renderSuccess(targets, files, copies, maintained, retired) {
+function renderSuccess(targets, files, copies, maintained, retired, orphaned) {
   const copySuffix = copies.length > 0 ? `, ${copies.length} ${copies.length === 1 ? "copy" : "copies"}` : "";
   const lines = [
     `${C.green}\u2713${C.reset} emitted ${files.length} file${files.length === 1 ? "" : "s"}${copySuffix} for ${C.dim}${targets.join(", ")}${C.reset}`
   ];
   for (const path of maintained) lines.push(`  ${C.dim}updated ${path} to this CLI's version${C.reset}`);
   for (const path of retired) lines.push(`  ${C.dim}removed ${path}: this skill has a new name${C.reset}`);
+  for (const path of orphaned) lines.push(`  ${C.dim}removed ${path}: its source is gone${C.reset}`);
   return lines.join("\n");
 }
 function renderFailure(errors) {
@@ -132,7 +136,7 @@ function walkAll(dir, repoRoot, out) {
     if (entry.isSymbolicLink()) continue;
     const full = join(dir, entry.name);
     if (entry.isDirectory()) {
-      if (SKIP_DIRS.has(entry.name) || entry.name === ".outerlayer") continue;
+      if (SKIP_DIRS.has(entry.name) || entry.name === ".outerlayer" || isForeignTree(full)) continue;
       walkAll(full, repoRoot, out);
     } else if (entry.isFile()) {
       out.push(toRepoRelative(repoRoot, full));
@@ -155,6 +159,21 @@ function findOrphans(repoRoot, computedFiles, sourcePaths) {
   }
   return orphans;
 }
+function removeOrphans(repoRoot, orphans) {
+  const removed = [];
+  for (const { path } of orphans) {
+    unlinkSync(join(repoRoot, path));
+    removed.push(path);
+    for (let dir = dirname(path); dir !== "."; dir = dirname(dir)) {
+      try {
+        rmdirSync(join(repoRoot, dir));
+      } catch {
+        break;
+      }
+    }
+  }
+  return removed;
+}
 function withholdKept(repoRoot, result, keep) {
   if (keep === void 0) return { result, kept: [] };
   const kept = [];
@@ -187,9 +206,11 @@ function runEmit(opts = {}) {
   const emitted = emitTree(built.input);
   const { result, kept } = withholdKept(cwd, emitted, opts.keep);
   const hasErrors = result.errors.length > 0;
-  if (opts.check) return runCheck(cwd, opts, targets, result, hasErrors, built.sourcePaths, maintained, kept, retired);
+  const outputs = new Set(emitted.files.map((f) => f.path));
+  if (opts.check) return runCheck(cwd, opts, targets, result, hasErrors, outputs, built.sourcePaths, maintained, kept, retired);
   const written = hasErrors ? { files: [], copies: [], maintained: [] } : writeOutputs(cwd, result, maintained);
   const removed = hasErrors ? [] : removeRetiredSkills(cwd);
+  const orphaned = hasErrors ? [] : removeOrphans(cwd, findOrphans(cwd, outputs, built.sourcePaths));
   const exitCode = hasErrors ? 1 : 0;
   const output = opts.json ? JSON.stringify({
     targets,
@@ -197,9 +218,10 @@ function runEmit(opts = {}) {
     copies: written.copies,
     maintained: written.maintained,
     retired: removed,
+    orphaned,
     warnings: result.warnings,
     errors: result.errors
-  }) : hasErrors ? renderFailure(result.errors) : renderSuccess(targets, written.files, written.copies, written.maintained, removed);
+  }) : hasErrors ? renderFailure(result.errors) : renderSuccess(targets, written.files, written.copies, written.maintained, removed, orphaned);
   if (!opts.quiet) {
     if (opts.json) {
       process.stdout.write(output + "\n");
@@ -218,13 +240,14 @@ function runEmit(opts = {}) {
     maintained: written.maintained,
     kept,
     retired: removed,
+    orphaned,
     warnings: result.warnings,
     errors: result.errors,
     output,
     exitCode
   };
 }
-function runCheck(cwd, opts, targets, result, hasErrors, sourcePaths, maintained, kept, retired) {
+function runCheck(cwd, opts, targets, result, hasErrors, outputs, sourcePaths, maintained, kept, retired) {
   const drift = [];
   if (!hasErrors) {
     for (const path of retired) drift.push({ kind: "retired", path });
@@ -232,7 +255,6 @@ function runCheck(cwd, opts, targets, result, hasErrors, sourcePaths, maintained
       const d = compareFile(cwd, file.path, file.content);
       if (d) drift.push(d);
     }
-    const computedFiles = new Set(result.files.map((f) => f.path));
     for (const file of result.files) {
       const d = compareFile(cwd, file.path, file.content);
       if (d) drift.push(d);
@@ -242,7 +264,7 @@ function runCheck(cwd, opts, targets, result, hasErrors, sourcePaths, maintained
       if (d) drift.push(d);
     }
     const retiredPaths = new Set(retired);
-    drift.push(...findOrphans(cwd, computedFiles, sourcePaths).filter((d) => !retiredPaths.has(d.path)));
+    drift.push(...findOrphans(cwd, outputs, sourcePaths).filter((d) => !retiredPaths.has(d.path)));
     drift.sort((a, b) => a.path.localeCompare(b.path) || a.kind.localeCompare(b.kind));
   }
   const exitCode = hasErrors || drift.length > 0 ? 1 : 0;
@@ -258,7 +280,7 @@ function runCheck(cwd, opts, targets, result, hasErrors, sourcePaths, maintained
 `);
     }
   }
-  return { targets, files: [], copies: [], maintained: [], kept, retired: [], warnings: result.warnings, errors: result.errors, drift, output, exitCode };
+  return { targets, files: [], copies: [], maintained: [], kept, retired: [], orphaned: [], warnings: result.warnings, errors: result.errors, drift, output, exitCode };
 }
 
 export { EmitError, runEmit };

package/dist/{chunk-F4XSVQJ4.js → chunk-6X4SQ5MY.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolvePackRoot, loadTemplateFiles, loadMaintainedFiles, TEMPLATE_SKILLS, skillDir, writeMaintainedFiles, MAINTAINED_SKILLS } from './chunk-MNTSH4CL.js';
-import { resolvePackageVersion } from './chunk-RA3O54FC.js';
+import { resolvePackRoot, loadTemplateFiles, loadMaintainedFiles, TEMPLATE_SKILLS, skillDir, writeMaintainedFiles, MAINTAINED_SKILLS } from './chunk-NNLA7LLQ.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
+import { resolvePackageVersion } from './chunk-RA3O54FC.js';
 import { readFileSync, existsSync, mkdirSync, writeFileSync } from 'fs';
 import { join, dirname } from 'path';
 

package/dist/{chunk-T4Y6SCG3.js → chunk-7UWVLZXD.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { skillDir, FORMER_MAINTAINED_NAMES, isMaintainedCopy } from './chunk-MNTSH4CL.js';
-import { emitTree, ALL_TARGET_IDS, classifyTree } from './chunk-X5N6KC6V.js';
+import { skillDir, FORMER_MAINTAINED_NAMES, isMaintainedCopy } from './chunk-NNLA7LLQ.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
+import { emitTree, ALL_TARGET_IDS, classifyTree } from './chunk-WFSUUUAN.js';
 import { readFileSync, existsSync, unlinkSync, rmdirSync, readdirSync } from 'fs';
 import { join, dirname, relative, sep } from 'path';
 

package/dist/{chunk-N3CUDFCW.js → chunk-7VUK5RFS.js}

@@ -22279,7 +22279,7 @@ var ArtifactTombstoneRecordSchema = external_exports.looseObject({
 });
 external_exports.union([ArtifactSpoolRecordSchema, ArtifactTombstoneRecordSchema]);
 var EMITTED_RESULTS = ["pass", "fail"];
-var RESERVED_EMIT_NAMES = ["artifact", "criteria", "finding", "findings"];
+var RESERVED_EMIT_NAMES = ["artifact", "criteria", "finding", "findings", "step"];
 var EmittedNameSchema = external_exports.string().regex(/^[a-z][a-z0-9._-]{0,63}$/).superRefine((name, ctx) => {
   if (RESERVED_EMIT_NAMES.includes(name)) {
     ctx.addIssue({
@@ -22324,6 +22324,19 @@ external_exports.object({
   item: external_exports.object({ number: external_exports.number().int().positive() }).optional(),
   sessionId: external_exports.string().optional()
 }).superRefine((request, ctx) => refuseDuplicateIds(request.criteria, ctx));
+var STEP_NAME_MAX = 80;
+var CONTROL_CHARACTER = /[\u0000-\u001f\u007f-\u009f\u2028\u2029]/;
+var StepNameSchema = external_exports.string().trim().min(1, "name must not be empty").max(STEP_NAME_MAX, `name must be at most ${STEP_NAME_MAX} characters`).refine((name) => !CONTROL_CHARACTER.test(name), {
+  message: "name must be one line, with no line break or control character"
+});
+var StepBodySchema = external_exports.object({
+  /** Minted by the CLI once per step; the same id on the same item is the same step. */
+  clientStepId: external_exports.string().uuid(),
+  name: StepNameSchema,
+  item: external_exports.object({ number: external_exports.number().int().positive() }),
+  /** When the agent started the step. The gateway clamps it to the receive time. */
+  startedAt: external_exports.string().datetime({ offset: true })
+});
 var FINDING_CATEGORIES = ["context", "flaky-test", "tooling", "environment", "defect", "other"];
 var FINDING_RULE_RELATIONS = ["wrong", "broken", "missing"];
 var FINDING_ID_MAX_LENGTH = 64;
@@ -22531,4 +22544,4 @@ xmlchars/xmlns/1.0/ed3.js:
    *)
 */
 
-export { ARTIFACT_KINDS, ARTIFACT_MAX_CAPTION_LENGTH, ARTIFACT_MAX_FILENAME_LENGTH, ARTIFACT_MAX_REPLACES_TARGETS, ArtifactCriterionIdSchema, ArtifactSpoolRecordSchema, ArtifactTombstoneRecordSchema, BUCKET_MODEL_MAX_LENGTH, CAPTURE_TIERS, CriteriaListSchema, EMITTED_RESULTS, EMITTED_RESULT_MAX_BODY_LENGTH, EMITTED_RESULT_MAX_LINK_LENGTH, EVENT_TYPES, EmittedNameSchema, FindingBatchSchema, FindingsResponseSchema, INPUT_BAND_BOUNDARIES, RESERVED_EMIT_NAMES, SAME_PROBLEM_RULES, SCHEMA_VERSION, SPEED_MAX_LENGTH, bannedPathsForTier, bindTests, downconvertSession, inferArtifactKind, inputBandOf, isHumanUserTurn, mediaTypeForArtifactPath, parseAgentSession, parseJunit, parseTestSelector, turnCountBound };
+export { ARTIFACT_KINDS, ARTIFACT_MAX_CAPTION_LENGTH, ARTIFACT_MAX_FILENAME_LENGTH, ARTIFACT_MAX_REPLACES_TARGETS, ArtifactCriterionIdSchema, ArtifactSpoolRecordSchema, ArtifactTombstoneRecordSchema, BUCKET_MODEL_MAX_LENGTH, CAPTURE_TIERS, CriteriaListSchema, EMITTED_RESULTS, EMITTED_RESULT_MAX_BODY_LENGTH, EMITTED_RESULT_MAX_LINK_LENGTH, EVENT_TYPES, EmittedNameSchema, FindingBatchSchema, FindingsResponseSchema, INPUT_BAND_BOUNDARIES, RESERVED_EMIT_NAMES, SAME_PROBLEM_RULES, SCHEMA_VERSION, SPEED_MAX_LENGTH, StepBodySchema, StepNameSchema, bannedPathsForTier, bindTests, downconvertSession, inferArtifactKind, inputBandOf, isHumanUserTurn, mediaTypeForArtifactPath, parseAgentSession, parseJunit, parseTestSelector, turnCountBound };

package/dist/{chunk-SWCTGCSC.js → chunk-7YP7T6GV.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_UNIT_NAME } from './chunk-WGAUY5LE.js';
+import { DEFAULT_UNIT_NAME } from './chunk-QEFKA2QD.js';
 import { parseRunnerEnv } from './chunk-6MZSX4M7.js';
 import { RUNNER_FILE_MODE } from './chunk-N2PXGQRL.js';
 import { existsSync, readFileSync, writeFileSync, renameSync, rmSync } from 'fs';