@outerlayer/cli 0.19.0 → 0.20.0

package/dist/{chunk-NFIR3GEE.js → chunk-PSN33ERW.js}

@@ -624,11 +624,11 @@ async function missingControlPlane(cwd, sessionId, home, env) {
   const dirs = findGitDirs(cwd);
   if (dirs === void 0) return void 0;
   if (existsSync(join(dirs.gitCommonDir, "outerlayer", "materialized.json")) || hasExcludeBlock(dirs.gitCommonDir)) {
-    const { cleanupEarlierCopies } = await import('./context-cleanup-HSVYDGMI.js');
+    const { cleanupEarlierCopies } = await import('./context-cleanup-CHEWNYU6.js');
     cleanupEarlierCopies(dirs);
   }
   if (!contextPossiblyGoverned(cwd, home)) return void 0;
-  const { governanceOf } = await import('./control-plane-launch-NYVDJESK.js');
+  const { governanceOf } = await import('./control-plane-launch-34LNRJWR.js');
   if (await governanceOf({ cwd, env, home }) !== "governed") return void 0;
   recordMissingContext(dirs, sessionId, home);
   const launcher = `${cliInvocation()} claude`;

package/dist/{chunk-7SJPQWBM.js → chunk-R22NZSGA.js}

@@ -4,7 +4,7 @@ import { uploadSpooledSteps } from './chunk-KYS3TQAG.js';
 import { LaunchFilter } from './chunk-ESVW4MJY.js';
 import { RepoFilter } from './chunk-TBT347UY.js';
 import { migrateLegacyArtifactSidecars, planArtifactUpload, artifactsStatePath, sanitizeTerminal, acquireArtifactSpoolLock, artifactBlobsDir, resolveArtifactTurnIndex, isArtifactTombstoned, ARTIFACT_RETRY_MAX_AGE_MS, writeArtifactSpoolState, reclaimUnneededArtifactBlobs, neededArtifactShas } from './chunk-G3IJ3N6F.js';
-import { writeSyncStatus, spoolDir } from './chunk-NFIR3GEE.js';
+import { writeSyncStatus, spoolDir } from './chunk-PSN33ERW.js';
 import { hookExecSpoolPath } from './chunk-F7CU5ABH.js';
 import { applyReportedCost } from './chunk-BKO6JEZI.js';
 import { setCustomScrubbers, setLocalIdentity, tailTranscript, enrichSessionRepo, scanAll, setRepoRoot, resolveRepoIdentity, sessionIdFromPath, scrubDeep, SOURCE_ADAPTERS } from './chunk-QNLX477Q.js';
@@ -14,10 +14,10 @@ import { defaultFetch } from './chunk-FVMYKL6L.js';
 import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-NTRCK4NH.js';
 import { readLatestProvenanceForSession, readContextProvenance } from './chunk-ZJSNLVCE.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
-import { CAPTURE_TIERS, inferArtifactKind, bannedPathsForTier, downconvertSession, isHumanUserTurn, turnCountBound, EVENT_TYPES } from './chunk-7VUK5RFS.js';
 import { readCloudConfig, cloudConfigPath, writeCloudConfig } from './chunk-EABW6AJQ.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
 import { removeJournalHooks } from './chunk-TUSYOL2O.js';
+import { CAPTURE_TIERS, inferArtifactKind, bannedPathsForTier, downconvertSession, isHumanUserTurn, turnCountBound, EVENT_TYPES } from './chunk-7VUK5RFS.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { signerFor, signRunnerRequest } from './chunk-M2ZWWTWZ.js';
 import { dirname, basename, join } from 'path';

package/dist/{chunk-XSZD4AZ6.js → chunk-XZ4H4X5F.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { WorkCommandError, postJson } from './chunk-HPJNLETG.js';
+import { WorkCommandError, postJson } from './chunk-FBTGMSQF.js';
 import { composeDelivery } from './chunk-LLM3I5YU.js';
-import { defaultGitRunner, materializeContext, isStagingWriteFault, lookupGoverningSource } from './chunk-452TM7J4.js';
+import { defaultGitRunner, materializeContext, isStagingWriteFault, lookupGoverningSource } from './chunk-EAEELQVQ.js';
 import { signingFetchFor } from './chunk-FVMYKL6L.js';
 import { SHIM_SCRIPT } from './chunk-G2YNJIGF.js';
 import { readDegraded, readContextManifest, readSourceCache } from './chunk-YQR6E6OV.js';

package/dist/{chunk-VRRGENS4.js → chunk-Z7K3L4FC.js}

@@ -2,6 +2,7 @@
 import { createRequire } from 'node:module';
 import { readContextManifest, removeContextManifest } from './chunk-YQR6E6OV.js';
 import { removePreCommitGuardHook } from './chunk-TUSYOL2O.js';
+import { CONTEXT_PIN_FILENAME } from './chunk-WFSUUUAN.js';
 import { execFileSync } from 'child_process';
 import { existsSync, unlinkSync, lstatSync, readdirSync, rmdirSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import { join, dirname, isAbsolute } from 'path';
@@ -92,6 +93,34 @@ function trackedPaths(repoRoot) {
     return void 0;
   }
 }
+function isPin(text) {
+  try {
+    const value = JSON.parse(text);
+    if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+    const { schemaVersion, sha, ...rest } = value;
+    return Object.keys(rest).length === 0 && typeof schemaVersion === "number" && typeof sha === "string" && /^[0-9a-f]{40}$/.test(sha);
+  } catch {
+    return false;
+  }
+}
+function pinMayDiffer(repoRoot, args) {
+  try {
+    execFileSync("git", ["diff", "--quiet", ...args, "--", CONTEXT_PIN_FILENAME], { cwd: repoRoot, stdio: "ignore", timeout: 5e3 });
+    return false;
+  } catch {
+    return true;
+  }
+}
+function restorePin(repoRoot) {
+  try {
+    if (!isPin(readFileSync(join(repoRoot, CONTEXT_PIN_FILENAME), "utf8"))) return false;
+    if (pinMayDiffer(repoRoot, ["--cached"]) || !pinMayDiffer(repoRoot, [])) return false;
+    execFileSync("git", ["checkout", "--", CONTEXT_PIN_FILENAME], { cwd: repoRoot, stdio: "ignore", timeout: 5e3 });
+    return true;
+  } catch {
+    return false;
+  }
+}
 function pruneEmptyDirs(start, root) {
   let current = start;
   while (current !== root && current.startsWith(root)) {
@@ -106,7 +135,7 @@ function pruneEmptyDirs(start, root) {
 }
 function cleanupEarlierCopies(input) {
   const { repoRoot, gitCommonDir } = input;
-  const result = { removedFiles: [], excludeRemoved: false, guardRemoved: false };
+  const result = { removedFiles: [], excludeRemoved: false, guardRemoved: false, pinRestored: false };
   if (!hasEarlierCopies(gitCommonDir)) return result;
   let complete = true;
   try {
@@ -132,6 +161,7 @@ function cleanupEarlierCopies(input) {
     return result;
   }
   if (!complete) return result;
+  result.pinRestored = restorePin(repoRoot);
   try {
     result.guardRemoved = removePreCommitGuardHook(repoRoot).removed;
     result.excludeRemoved = removeContextExcludes(gitCommonDir).changed;

package/dist/{chunk-BWSUPRDK.js → chunk-ZX4I2MEK.js}

@@ -4,6 +4,6 @@ import { createRequire } from 'node:module';
 createRequire(import.meta.url);
 
 // src/runner/protocol.ts
-var RUNNER_PROTOCOL = 20;
+var RUNNER_PROTOCOL = 21;
 
 export { RUNNER_PROTOCOL };

package/dist/{claude-launcher-FPPHZPMR.js → claude-launcher-J5M44PFS.js}

@@ -88,7 +88,7 @@ async function runClaudeLauncher(args, deps = {}) {
       return 1;
     }
   } else {
-    const { resolveLaunchPlane } = await import('./control-plane-launch-NYVDJESK.js');
+    const { resolveLaunchPlane } = await import('./control-plane-launch-34LNRJWR.js');
     const plane = await resolveLaunchPlane({ cwd, env, home: homeFromEnv(env), fetchImpl: deps.fetchImpl, stderr });
     if (plane.kind === "none") return run(claude, args, env, cwd, stderr);
     if (plane.kind === "refused") {

package/dist/{cli-HROW5T7X.js → cli-MKF7TU7X.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-5TN7GLYX.js';
+import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-HOKXGFDR.js';
 import './chunk-TWF3RICI.js';
-import { verifiedTrackerNames, TRACKERS } from './chunk-HPJNLETG.js';
+import { verifiedTrackerNames, TRACKERS } from './chunk-FBTGMSQF.js';
 import './chunk-IF2OSI5T.js';
 import './chunk-CG36IONK.js';
 import './chunk-G3IJ3N6F.js';
 import './chunk-BM63HB2M.js';
-import { hookFiredMarkerPath, installedCliDistDir } from './chunk-NFIR3GEE.js';
+import { hookFiredMarkerPath, installedCliDistDir } from './chunk-PSN33ERW.js';
 import './chunk-DSF2FWAZ.js';
 import './chunk-BKO6JEZI.js';
 import './chunk-QNLX477Q.js';
@@ -17,19 +17,19 @@ import './chunk-GOSFARMS.js';
 import { C, warnDeprecated, API_KEY_FLAG_DEPRECATION, NO_COLOR_FLAG, stripNoColor } from './chunk-ANPNT6PM.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { settingsPath, readSettings, SettingsParseError, listHookCandidates, wrapHooks, writeSettings, unwrapHooks, REGISTERED_EVENTS, cliCommand, removeHooks, removeStatusline, cliBinResolvable, mergeHooks, repointWrappedHooks, AUTO_WRAP_EVENTS, mergeStatusline } from './chunk-5QRP3MVS.js';
-import './chunk-IXYZUUYQ.js';
+import './chunk-7UWVLZXD.js';
 import './chunk-FVMYKL6L.js';
 import './chunk-NTRCK4NH.js';
 import './chunk-ZJSNLVCE.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
 import './chunk-G2YNJIGF.js';
 import './chunk-NNLA7LLQ.js';
-import './chunk-WFSUUUAN.js';
-import './chunk-7VUK5RFS.js';
 import './chunk-EABW6AJQ.js';
 import { cliInvocation, packageRunnerOf } from './chunk-CRB3POP4.js';
 import { cloneIsGoverned } from './chunk-YQR6E6OV.js';
 import { removeJournalHooks, removePreCommitGuardHook } from './chunk-TUSYOL2O.js';
+import './chunk-WFSUUUAN.js';
+import './chunk-7VUK5RFS.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
 import './chunk-M2ZWWTWZ.js';
@@ -3843,7 +3843,7 @@ states under Starter files.
 `
   ).action(async (opts) => {
     if (opts.update || opts.dryRun) {
-      const { runInitUpdate, formatInitUpdate, updateFlagProblem } = await import('./init-update-LWX5MPPR.js');
+      const { runInitUpdate, formatInitUpdate, updateFlagProblem } = await import('./init-update-7DVAKWW3.js');
       const problem = updateFlagProblem(opts);
       if (problem !== void 0) {
         fail(problem);
@@ -3890,11 +3890,12 @@ states under Starter files.
         if (changed.length > 0 && !opts.json) process.stdout.write(`Removed the claude function from ${changed.join(", ")}.
 `);
       }
-      if (opts.json) writeJson(outcome.result);
-      else process.stdout.write(outcome.text);
+      const shell = !opts.remove && opts.shellFunction !== void 0 ? (await import('./init-cmd-Z4O4PPLZ.js')).applyShellFunctionFlag(opts.shellFunction, { home: homeFromEnv(), shellPath: process.env.SHELL }) : void 0;
+      if (opts.json) writeJson(shell === void 0 ? outcome.result : { ...outcome.result, shellFunction: { outcome: shell.outcome, reason: shell.reason } });
+      else process.stdout.write(outcome.text + (shell?.text ?? ""));
       return;
     }
-    const { runInitCommand } = await import('./init-cmd-HSMRID6A.js');
+    const { runInitCommand } = await import('./init-cmd-Z4O4PPLZ.js');
     const code = await runInitCommand(
       { json: opts.json, factory: opts.factory, shellFunction: opts.shellFunction },
       {
@@ -3906,7 +3907,7 @@ states under Starter files.
           return { ok, text, detail };
         },
         runAgentSetup: async () => {
-          const { runAgentSetup } = await import('./agent-setup-TPR4BBFV.js');
+          const { runAgentSetup } = await import('./agent-setup-AM42SA2D.js');
           return runAgentSetup({ cwd: process.cwd() });
         },
         runDoctorChecks: gatherDoctorChecks,
@@ -4026,13 +4027,13 @@ code is 1: revoke the token on /profile/security.
     "\nIncremental: only sessions newer than the last checkpoint ship. The tier\nis applied on this machine before anything leaves it; `--dry-run` prints\nexactly what would. The hook-triggered background sync runs `--quiet`.\nExit 2 means the server rejected at least one session.\n"
   ).action(async (opts) => {
     if (opts.link !== void 0) {
-      const { lookupArtifactLink } = await import('./artifact-link-cmd-W7XF5BFB.js');
+      const { lookupArtifactLink } = await import('./artifact-link-cmd-OWRI5AJX.js');
       const found = lookupArtifactLink(opts.link);
       if (found.ok) process.stdout.write(found.url + "\n");
       else fail(found.reason);
       return;
     }
-    const { runSync, SyncConfigError, SyncTransportError } = await import('./sync-cmd-G7GF4UTW.js');
+    const { runSync, SyncConfigError, SyncTransportError } = await import('./sync-cmd-VXOUFS4I.js');
     try {
       const result = await runSync({
         url: opts.url,
@@ -4063,7 +4064,7 @@ code is 1: revoke the token on /profile/security.
     if (invokedCommandToken(argv) === "watch") {
       warnDeprecated(`\`${cliInvocation()} watch\` is now \`${cliInvocation()} daemon\`; the old name will be removed in a future release.`);
     }
-    const { runWatch } = await import('./watch-EVM5GSMP.js');
+    const { runWatch } = await import('./watch-OH645CV2.js');
     await runWatch({ once: opts.once });
   });
   program2.command("hook <event>", { hidden: true }).description("capture-hook fast path, installed by `init`").action(() => {
@@ -4119,7 +4120,7 @@ code is 1: revoke the token on /profile/security.
     }
   });
   program2.command("session-sender", { hidden: true }).description("stream a runner build's sessions to its work item while the build runs").action(async () => {
-    const { runSessionSender } = await import('./session-sender-GGIY5OAX.js');
+    const { runSessionSender } = await import('./session-sender-U2BBUWNO.js');
     try {
       await runSessionSender();
     } catch (err) {
@@ -4155,7 +4156,7 @@ async function runCli(processArgv) {
   await buildProgram(argv).parseAsync(argv);
 }
 async function compileContext(opts) {
-  const { runEmit, EmitError } = await import('./emit-cmd-7SP3I6UZ.js');
+  const { runEmit, EmitError } = await import('./emit-cmd-W55AEBCA.js');
   try {
     const result = runEmit({ cwd: opts.dir, check: opts.check, json: opts.json });
     if (result.exitCode !== 0) process.exitCode = result.exitCode;
@@ -4202,7 +4203,7 @@ Compiling .outerlayer/ moved to \`${cliInvocation()} context emit\`.
       await compileContext({ dir: opts.dir, check: opts.check, json: opts.json });
       return;
     }
-    const { runEmitResult, EmitResultError } = await import('./emit-result-cmd-RUICOKWQ.js');
+    const { runEmitResult, EmitResultError } = await import('./emit-result-cmd-5NZMLCJK.js');
     try {
       const result = await runEmitResult({
         name,
@@ -4252,7 +4253,7 @@ everywhere, bytes and deep link untouched; a still-queued one is cancelled
 locally so it never uploads. One correction can retire several duplicates.
 `
   ).action(async (file, opts) => {
-    const { runEmitArtifact, EmitArtifactError } = await import('./emit-artifact-cmd-O6SCM7TV.js');
+    const { runEmitArtifact, EmitArtifactError } = await import('./emit-artifact-cmd-XBHM647X.js');
     let pr;
     if (opts.pr !== void 0) {
       pr = parseTrackerNumber(opts.pr);
@@ -4311,7 +4312,7 @@ recent events with their ids. --find <text> searches all of them.
 item that session was launched for is used automatically.
 `
   ).action(async (opts) => {
-    const { runEmitFinding, refuseRemovedFindingFlags, EmitFindingError } = await import('./emit-finding-cmd-AJPKHIOV.js');
+    const { runEmitFinding, refuseRemovedFindingFlags, EmitFindingError } = await import('./emit-finding-cmd-7JHVRYOP.js');
     try {
       refuseRemovedFindingFlags(opts);
       const result = await runEmitFinding({
@@ -4378,7 +4379,7 @@ the whole batch. "untimed": true records one with no time on purpose.
 that session was launched for is used automatically.
 `
   ).action(async (file, opts) => {
-    const { runEmitFindings, EmitFindingError } = await import('./emit-finding-cmd-AJPKHIOV.js');
+    const { runEmitFindings, EmitFindingError } = await import('./emit-finding-cmd-7JHVRYOP.js');
     try {
       const result = await runEmitFindings({
         file,
@@ -4431,7 +4432,7 @@ the step, the command prints why and exits 1.
       throw err;
     }
   });
-  emitCmd.command("criteria <file>").description("Record a work item's acceptance criteria from a JSON file (- for stdin)").option("--item <number>", "work item to record on directly, by its number in this factory").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
+  emitCmd.command("criteria <file>").description("Record a work item's acceptance criteria from a JSON or acceptance .md file").option("--item <number>", "work item to record on directly, by its number in this factory").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
     "after",
     `
   ${cliInvocation()} emit criteria criteria.json --item 412
@@ -4449,9 +4450,14 @@ Once an item has a list, only a person can replace it: run the command outside a
 agent session, with your own login. A key bound to no member cannot replace it either.
 --item names the work item; without it, inside a recorded session, the item that
 session was launched for is used automatically.
+
+A file ending in .md is read as an acceptance file, such as acceptance/412-login.md:
+each list item that opens with an id in backticks is a criterion, its text is the rest
+of the item, and a (proof: <kind>) annotation names its proof.
+  ${cliInvocation()} emit criteria acceptance/412-login.md --item 412
 `
   ).action(async (file, opts) => {
-    const { runEmitCriteria, EmitCriteriaError } = await import('./emit-criteria-cmd-LQNERZRV.js');
+    const { runEmitCriteria, EmitCriteriaError } = await import('./emit-criteria-cmd-UNMWHOUY.js');
     try {
       const result = await runEmitCriteria({
         file,
@@ -4475,9 +4481,9 @@ function registerSpecCommands(program2) {
   const specCmd = program2.command("spec").description("Find, file and edit the issue a spec lives in, in your factory's tracker");
   const credentialOptions = (command) => command.option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)");
   const run = async (action) => {
-    const { WorkCommandError } = await import('./work-cmd-5EPPD33Y.js');
+    const { WorkCommandError } = await import('./work-cmd-5I3J2XQQ.js');
     try {
-      await action(await import('./spec-cmd-SIZBRN7D.js'));
+      await action(await import('./spec-cmd-FVLJOFGC.js'));
     } catch (err) {
       if (err instanceof WorkCommandError) {
         fail(err.message);
@@ -4518,7 +4524,7 @@ takes it, and prints the line that starts your session on it. That
 session links itself and holds the item's lease while it works.
 `
   ).action(async (opts) => {
-    const { runWorkBuild, WorkCommandError } = await import('./work-cmd-5EPPD33Y.js');
+    const { runWorkBuild, WorkCommandError } = await import('./work-cmd-5I3J2XQQ.js');
     try {
       await runWorkBuild(opts);
     } catch (err) {
@@ -4541,7 +4547,7 @@ renews that session's own 20-minute lease, unless --no-lease or
 --ended is given, or another worker already holds a live one.
 `
   ).action(async (number, opts) => {
-    const { runWorkLinkSession, WorkCommandError } = await import('./work-cmd-5EPPD33Y.js');
+    const { runWorkLinkSession, WorkCommandError } = await import('./work-cmd-5I3J2XQQ.js');
     try {
       await runWorkLinkSession({ ...opts, number, noLease: opts.lease === false, logFailures: opts.logFailures === true });
     } catch (err) {
@@ -4565,8 +4571,8 @@ criterion's new proof; --ready hands the thread back to a person. At
 most one action flag may be given.
 `
   ).action(async (opts) => {
-    const { runWorkComment, WorkCommentCommandError } = await import('./work-comment-cmd-2ACOZQAE.js');
-    const { WorkCommandError } = await import('./work-cmd-5EPPD33Y.js');
+    const { runWorkComment, WorkCommentCommandError } = await import('./work-comment-cmd-UCCPWUSR.js');
+    const { WorkCommandError } = await import('./work-cmd-5I3J2XQQ.js');
     try {
       await runWorkComment(opts);
     } catch (err) {
@@ -4587,8 +4593,8 @@ criterion that carries proof or a comment, each with who is waiting
 on whom next.
 `
   ).action(async (opts) => {
-    const { runWorkThreads, WorkCommentCommandError } = await import('./work-comment-cmd-2ACOZQAE.js');
-    const { WorkCommandError } = await import('./work-cmd-5EPPD33Y.js');
+    const { runWorkThreads, WorkCommentCommandError } = await import('./work-comment-cmd-UCCPWUSR.js');
+    const { WorkCommandError } = await import('./work-cmd-5I3J2XQQ.js');
     try {
       await runWorkThreads(opts);
     } catch (err) {
@@ -4612,8 +4618,8 @@ still running, or that an older runner released, has no log and the
 command exits 1.
 `
   ).action(async (opts) => {
-    const { runWorkLogs, WorkLogsCommandError } = await import('./work-logs-cmd-QDD2NMJL.js');
-    const { WorkCommandError } = await import('./work-cmd-5EPPD33Y.js');
+    const { runWorkLogs, WorkLogsCommandError } = await import('./work-logs-cmd-7352CJPG.js');
+    const { WorkCommandError } = await import('./work-cmd-5I3J2XQQ.js');
     try {
       await runWorkLogs(opts);
     } catch (err) {
@@ -4624,6 +4630,30 @@ command exits 1.
       throw err;
     }
   });
+  workCmd.command("stop").description("Stop the host build running on a work item").requiredOption("--item <number>", "the item's number inside this factory").option("--note <text>", "why the build is stopped (up to 500 characters); kept with the attempt").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
+    "after",
+    `
+  ${cliInvocation()} work stop --item 7
+  ${cliInvocation()} work stop --item 7 --note "wrong branch"
+
+Asks the host that holds the item's build to end it. The host reads the
+request at its next heartbeat, so the build may run a little longer. The
+item is not built again until a new build request. Exits 1 when no host
+build is running for the item.
+`
+  ).action(async (opts) => {
+    const { runWorkStop, WorkStopCommandError } = await import('./work-stop-cmd-CRDHXQVW.js');
+    const { WorkCommandError } = await import('./work-cmd-5I3J2XQQ.js');
+    try {
+      await runWorkStop(opts);
+    } catch (err) {
+      if (err instanceof WorkStopCommandError || err instanceof WorkCommandError) {
+        fail(err.message);
+        return;
+      }
+      throw err;
+    }
+  });
   workCmd.command("remove").description("Withdraw a source's addition \u2014 never deletes the item").option("--item <number>", "the item's number inside this factory").option("--issue <number>", "issue number or Linear/Jira key (default: named by --item instead)").option(TRACKER_OPTION_FLAG, "tracker for a keyed --issue, when both hold the key").option("--repo <owner/name>", "repository for an issue number (default: the checkout's remote)").requiredOption("--reason <text>", "why this source is no longer working on it").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
     "after",
     `
@@ -4634,7 +4664,7 @@ deletes anything \u2014 the item is removed from Work only once no
 live addition remains on it.
 `
   ).action(async (opts) => {
-    const { runWorkRemove, WorkCommandError } = await import('./work-cmd-5EPPD33Y.js');
+    const { runWorkRemove, WorkCommandError } = await import('./work-cmd-5I3J2XQQ.js');
     try {
       await runWorkRemove(opts);
     } catch (err) {
@@ -4646,7 +4676,7 @@ live addition remains on it.
     }
   });
   workCmd.command("status").description("Show one item's stage, gate ledger, and additions").option("--item <number>", "the item's number inside this factory").option("--issue <number>", "issue number, or a Linear/Jira key like ENG-123").option(TRACKER_OPTION_FLAG, "tracker for a keyed --issue, when both hold the key").option("--repo <owner/name>", "repository for an issue number (default: the checkout's remote)").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").action(async (opts) => {
-    const { runWorkStatus, WorkCommandError } = await import('./work-cmd-5EPPD33Y.js');
+    const { runWorkStatus, WorkCommandError } = await import('./work-cmd-5I3J2XQQ.js');
     try {
       await runWorkStatus(opts);
     } catch (err) {
@@ -4658,7 +4688,7 @@ live addition remains on it.
     }
   });
   workCmd.command("list").description("List live work items for this factory").option("--stage <spec|build|review>", "filter by stage").option("--section <attention|waiting|flowing>", "filter by Queue section").option("--repo <owner/name>", "repository (default: the current checkout's remote)").option("--unclaimed", "only items with no live lease").option("--claimed", "only items with a live lease, held by a host or a local session").option("--startable", "only items a host can start: a build request, no open PR, no live lease").option("--needs <amend>", "only items with a thread waiting on an agent").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").action(async (opts) => {
-    const { runWorkList, WorkCommandError } = await import('./work-cmd-5EPPD33Y.js');
+    const { runWorkList, WorkCommandError } = await import('./work-cmd-5I3J2XQQ.js');
     try {
       await runWorkList(opts);
     } catch (err) {
@@ -4679,7 +4709,7 @@ by a different key is refused; claiming again with the same key extends
 it. --host is a label only.
 `
   ).action(async (opts) => {
-    const { runWorkClaim, WorkCommandError } = await import('./work-claim-cmd-3J3QW56U.js');
+    const { runWorkClaim, WorkCommandError } = await import('./work-claim-cmd-DRQCHCOK.js');
     try {
       await runWorkClaim(opts);
     } catch (err) {
@@ -4699,7 +4729,7 @@ Extends the live lease this API key holds. Refused with a 410 if the
 lease has expired, or a 403 if a different key holds it.
 `
   ).action(async (opts) => {
-    const { runWorkRenew, WorkCommandError } = await import('./work-claim-cmd-3J3QW56U.js');
+    const { runWorkRenew, WorkCommandError } = await import('./work-claim-cmd-DRQCHCOK.js');
     try {
       await runWorkRenew(opts);
     } catch (err) {
@@ -4731,7 +4761,7 @@ applies to a host's lease only. A later tool call in the session
 takes the lease again.
 `
   ).action(async (opts) => {
-    const { runWorkRelease, WorkCommandError } = await import('./work-claim-cmd-3J3QW56U.js');
+    const { runWorkRelease, WorkCommandError } = await import('./work-claim-cmd-DRQCHCOK.js');
     try {
       await runWorkRelease(opts);
     } catch (err) {
@@ -4783,8 +4813,8 @@ login, then declares the pull request on the item, as \`work pr\` does.
 Run it again after a change to the title or description.
 `
   ).action(async (opts) => {
-    const { runWorkOpenPr, WorkOpenPrCommandError } = await import('./work-open-pr-cmd-XNCEI4ZM.js');
-    const { WorkCommandError } = await import('./work-cmd-5EPPD33Y.js');
+    const { runWorkOpenPr, WorkOpenPrCommandError } = await import('./work-open-pr-cmd-LSH4VHJM.js');
+    const { WorkCommandError } = await import('./work-cmd-5I3J2XQQ.js');
     try {
       await runWorkOpenPr(opts);
     } catch (err) {
@@ -4801,7 +4831,7 @@ function registerRunnerCommands(program2) {
   const configOption = "the cloud config file to run against (default: ~/.outerlayer/config.json)";
   runnerCmd.command("start").description("Run the loop: claim work, run it, report, clean up, repeat").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-CLSGABD5.js');
-    const { start, RunnerStartError } = await import('./loop-SYYPVFYW.js');
+    const { start, RunnerStartError } = await import('./loop-EAZQMAE2.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-3DM4OBKO.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     try {
@@ -4817,7 +4847,7 @@ function registerRunnerCommands(program2) {
   });
   runnerCmd.command("check").description("Validate the config, the hooks and the key, and print the effective settings").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-CLSGABD5.js');
-    const { runRunnerCheck } = await import('./check-UWQAL2MN.js');
+    const { runRunnerCheck } = await import('./check-BR5D27CX.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const result = await runRunnerCheck(configPath);
     if (!result.ok) {
@@ -4846,7 +4876,7 @@ function registerRunnerCommands(program2) {
     }
     try {
       if (opts.service === true) {
-        const { installServiceCommand } = await import('./command-OEAV7BVX.js');
+        const { installServiceCommand } = await import('./command-ZQNEPDS6.js');
         const result2 = await installServiceCommand({
           configPath,
           print: opts.print,
@@ -4902,7 +4932,7 @@ To keep it running, run ${C.yellow}${cliInvocation()} runner install --service${
       return;
     }
     const { defaultRunnerConfigPath } = await import('./config-CLSGABD5.js');
-    const { uninstallServiceCommand } = await import('./command-OEAV7BVX.js');
+    const { uninstallServiceCommand } = await import('./command-ZQNEPDS6.js');
     const result = await uninstallServiceCommand({ configPath: opts.config ?? defaultRunnerConfigPath(), unitName: opts.unitName, home: homeFromEnv() });
     if (result.ok) for (const line of result.lines) process.stdout.write(`${C.green}\u2713${C.reset} ${line}
 `);
@@ -4930,10 +4960,10 @@ already in runner.env is used.
 `
   ).action(async (opts) => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-CLSGABD5.js');
-    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-MOINY2DD.js');
-    const { obtainRunnerKey, runnerKeyLogin } = await import('./runner-key-276SJU5R.js');
-    const { detectMachine } = await import('./machine-6X63G2KH.js');
-    const { chooseVm, runVmInit, VmInitError } = await import('./init-LWHDMZQG.js');
+    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-XG47KCI4.js');
+    const { obtainRunnerKey, runnerKeyLogin } = await import('./runner-key-5FOWCW7J.js');
+    const { detectMachine } = await import('./machine-TRHBT5NE.js');
+    const { chooseVm, runVmInit, VmInitError } = await import('./init-V6FOMD2V.js');
     const { AGENT_COMMANDS, credentialFromStdin, isAgentName, restartForCredential, RunnerEnvError } = await import('./runner-env-FRZFFHDF.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     if (opts.agent !== void 0 && !isAgentName(opts.agent)) {
@@ -5084,7 +5114,7 @@ ${C.yellow}The runner will not update itself: ${installErr.message}${C.reset}
       let serviceUp = false;
       let restart;
       if (installedLayout) {
-        const { installServiceCommand } = await import('./command-OEAV7BVX.js');
+        const { installServiceCommand } = await import('./command-ZQNEPDS6.js');
         const service = await installServiceCommand({
           configPath,
           entryPath: process.argv[1] ?? "",
@@ -5144,7 +5174,7 @@ Next:
     })();
     const memory = loaded?.build?.memory ?? "8g";
     try {
-      const { imageTargetFor } = await import('./governing-source-V5EEGPTA.js');
+      const { imageTargetFor } = await import('./governing-source-HAA4OW57.js');
       const target = await imageTargetFor({ config: loaded, repository: opts.repository, fetchImpl: fetch });
       if (!target.ok) {
         if (opts.json) {
@@ -5208,15 +5238,15 @@ Next:
   });
   runnerCmd.command("stop").description("Take no more work; wait for running jobs to finish, then exit").option("--config <path>", "the cloud config file naming the runner to stop").option("--now", "end running jobs immediately, with outcome stopped").action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-CLSGABD5.js');
-    const { requestStop } = await import('./loop-SYYPVFYW.js');
+    const { requestStop } = await import('./loop-EAZQMAE2.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     await requestStop(configPath, Boolean(opts.now));
   });
   runnerCmd.command("status").description("List running jobs; with --recent, finished ones too").option("--config <path>", "the cloud config file naming the runner to inspect").option("--recent", "also list finished jobs, newest first, capped at 20").option("--json", "machine-readable JSON output").action(async (opts) => {
     const { defaultRunnerConfigPath, loadRunnerConfig } = await import('./config-CLSGABD5.js');
     const { jobsDir, runnerDir } = await import('./paths-7XP63OAX.js');
-    const { listJobFiles, runnerProcessState } = await import('./loop-SYYPVFYW.js');
-    const { renderStatus } = await import('./status-NAK6DYSF.js');
+    const { listJobFiles, runnerProcessState } = await import('./loop-EAZQMAE2.js');
+    const { renderStatus } = await import('./status-BINH7MBG.js');
     const { readHousekeepingRecord } = await import('./record-3WP6V2K5.js');
     const path2 = await import('path');
     const configPath = opts.config ?? defaultRunnerConfigPath();
@@ -5272,7 +5302,7 @@ Next:
   });
   runnerCmd.command("logs").argument("<item>", "the work item's number in the factory").description("Print the newest attempt's log for one item").option("--config <path>", "the cloud config file naming the runner to inspect").option("-f, --follow", "keep printing as the log grows").action(async (itemArg, opts) => {
     const { defaultRunnerConfigPath } = await import('./config-CLSGABD5.js');
-    const { listJobFiles } = await import('./loop-SYYPVFYW.js');
+    const { listJobFiles } = await import('./loop-EAZQMAE2.js');
     const { newestAttempt, logPathFor, tail, RunnerLogsError } = await import('./logs-AMLKC3VP.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const item = parseTrackerNumber(itemArg);
@@ -5532,7 +5562,7 @@ caller from the bearer token, the gateway answers 401 without that header.
 function registerImportCommands(program2) {
   const importCmd = program2.command("import").description("Import an existing config format into .outerlayer/");
   importCmd.command("ruler").description("Port a .ruler/ tree into the equivalent .outerlayer/ tree").option("--dir <path>", "repo root to read from (default: cwd)").option("--json", "machine-readable JSON output").addHelpText("after", "\nRuler: https://github.com/intellectronica/ruler. Mostly a rename.\n").action(async (opts) => {
-    const { runImportRuler, ImportRulerError } = await import('./import-ruler-cmd-5P6JOXQN.js');
+    const { runImportRuler, ImportRulerError } = await import('./import-ruler-cmd-T6LLO6Q7.js');
     try {
       const result = runImportRuler({ cwd: opts.dir, json: opts.json });
       if (result.exitCode !== 0) process.exitCode = result.exitCode;
@@ -5548,7 +5578,7 @@ function registerImportCommands(program2) {
     "after",
     "\nInstalls the four maintained skills (outerlayer-evidence, outerlayer-amend,\nouterlayer-findings, outerlayer-cli) and an AGENTS.md snippet teaching agents to run\n`emit artifact`. A skill that differs from this CLI's bundle is rewritten to it, and the output says so.\n"
   ).action(async (opts) => {
-    const { runImportCapture, ImportCaptureError } = await import('./import-capture-cmd-KKFFOGWP.js');
+    const { runImportCapture, ImportCaptureError } = await import('./import-capture-cmd-TK4XY7RD.js');
     try {
       runImportCapture({ cwd: opts.dir, json: opts.json });
     } catch (err) {

package/dist/{command-OEAV7BVX.js → command-ZQNEPDS6.js}

@@ -5,16 +5,16 @@ import { runRunnerInstall, launcherSummary, restartNote } from './chunk-MLAAT4S6
 import './chunk-I2UOAV7X.js';
 import './chunk-VYAL7PUE.js';
 import { currentLink, execStartCommand } from './chunk-AMFWYESY.js';
-import { detectMachine } from './chunk-UVG35MWF.js';
-import './chunk-7KSSBQTS.js';
+import { detectMachine } from './chunk-LW7G5TJB.js';
+import './chunk-3ZR7Y23Y.js';
 import './chunk-OGFGZQA3.js';
 import './chunk-VMJPFQNE.js';
 import './chunk-3UZTIRLF.js';
 import './chunk-GGOMT6KF.js';
 import './chunk-X5H2WYMB.js';
-import './chunk-XSZD4AZ6.js';
+import './chunk-XZ4H4X5F.js';
 import { installService, uninstallService, realTaskScheduler } from './chunk-QEFKA2QD.js';
-import './chunk-HPJNLETG.js';
+import './chunk-FBTGMSQF.js';
 import './chunk-IF2OSI5T.js';
 import './chunk-CG36IONK.js';
 import './chunk-G3IJ3N6F.js';
@@ -34,19 +34,19 @@ import './chunk-GOSFARMS.js';
 import './chunk-ANPNT6PM.js';
 import './chunk-WZBHBH3J.js';
 import './chunk-LLM3I5YU.js';
-import './chunk-452TM7J4.js';
-import './chunk-IXYZUUYQ.js';
+import './chunk-EAEELQVQ.js';
+import './chunk-7UWVLZXD.js';
 import './chunk-FVMYKL6L.js';
 import './chunk-NTRCK4NH.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-BJ3KTMDH.js';
 import './chunk-G2YNJIGF.js';
 import './chunk-NNLA7LLQ.js';
-import './chunk-WFSUUUAN.js';
-import './chunk-7VUK5RFS.js';
 import './chunk-EABW6AJQ.js';
 import './chunk-CRB3POP4.js';
 import './chunk-YQR6E6OV.js';
+import './chunk-WFSUUUAN.js';
+import './chunk-7VUK5RFS.js';
 import './chunk-VNVZDWO3.js';
 import './chunk-RA3O54FC.js';
 import './chunk-M2ZWWTWZ.js';

package/dist/connect-cmd-UNYKGDAL.js

@@ -8,9 +8,9 @@ import './chunk-GOSFARMS.js';
 import './chunk-ANPNT6PM.js';
 import './chunk-NTRCK4NH.js';
 import './chunk-BJ3KTMDH.js';
-import './chunk-7VUK5RFS.js';
 import './chunk-EABW6AJQ.js';
 import './chunk-CRB3POP4.js';
+import './chunk-7VUK5RFS.js';
 import './chunk-VNVZDWO3.js';
 import './chunk-Z5GEFMRW.js';