@outerlayer/cli 0.19.1 → 0.22.0

package/dist/{cli-EXX2R73G.js → cli-NMGVZQPB.js}

@@ -1,40 +1,42 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-HOKXGFDR.js';
-import './chunk-TWF3RICI.js';
-import { verifiedTrackerNames, TRACKERS } from './chunk-FBTGMSQF.js';
-import './chunk-IF2OSI5T.js';
-import './chunk-CG36IONK.js';
+import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-4JHVPFH6.js';
+import './chunk-VSUXCMMH.js';
+import { verifiedTrackerNames, TRACKERS } from './chunk-2HT2XGJX.js';
+import './chunk-QOALB6ZD.js';
+import './chunk-JRCSET55.js';
 import './chunk-G3IJ3N6F.js';
-import './chunk-BM63HB2M.js';
-import { hookFiredMarkerPath, installedCliDistDir } from './chunk-PSN33ERW.js';
-import './chunk-DSF2FWAZ.js';
-import './chunk-BKO6JEZI.js';
-import './chunk-QNLX477Q.js';
-import './chunk-YVZJ6GKF.js';
-import './chunk-6X4SQ5MY.js';
-import './chunk-GOSFARMS.js';
-import { C, warnDeprecated, API_KEY_FLAG_DEPRECATION, NO_COLOR_FLAG, stripNoColor } from './chunk-ANPNT6PM.js';
-import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
-import { settingsPath, readSettings, SettingsParseError, listHookCandidates, wrapHooks, writeSettings, unwrapHooks, REGISTERED_EVENTS, cliCommand, removeHooks, removeStatusline, cliBinResolvable, mergeHooks, repointWrappedHooks, AUTO_WRAP_EVENTS, mergeStatusline } from './chunk-5QRP3MVS.js';
-import './chunk-7UWVLZXD.js';
-import './chunk-FVMYKL6L.js';
+import './chunk-EAQSOE62.js';
+import './chunk-F35VMF5M.js';
+import './chunk-USWVXQIH.js';
+import './chunk-VWLOQ6FI.js';
 import './chunk-NTRCK4NH.js';
+import { hookFiredMarkerPath, installedCliDistDir } from './chunk-6IO62VJS.js';
 import './chunk-ZJSNLVCE.js';
+import './chunk-IZSVXRDR.js';
+import './chunk-BKO6JEZI.js';
+import './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
-import './chunk-G2YNJIGF.js';
-import './chunk-NNLA7LLQ.js';
+import './chunk-AEKSX4EY.js';
+import './chunk-DIB2WLBL.js';
 import './chunk-EABW6AJQ.js';
+import './chunk-V7SAQ645.js';
+import './chunk-5OCIHFGE.js';
+import { C, warnDeprecated, API_KEY_FLAG_DEPRECATION, NO_COLOR_FLAG, stripNoColor } from './chunk-ANPNT6PM.js';
+import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { cliInvocation, packageRunnerOf } from './chunk-CRB3POP4.js';
+import { settingsPath, readSettings, SettingsParseError, listHookCandidates, wrapHooks, writeSettings, unwrapHooks, REGISTERED_EVENTS, cliCommand, removeHooks, removeStatusline, cliBinResolvable, mergeHooks, repointWrappedHooks, AUTO_WRAP_EVENTS, mergeStatusline } from './chunk-5QRP3MVS.js';
+import './chunk-W3SWJ2TD.js';
 import { cloneIsGoverned } from './chunk-YQR6E6OV.js';
 import { removeJournalHooks, removePreCommitGuardHook } from './chunk-TUSYOL2O.js';
 import './chunk-WFSUUUAN.js';
 import './chunk-7VUK5RFS.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
-import './chunk-M2ZWWTWZ.js';
-import './chunk-N2PXGQRL.js';
-import './chunk-BQXFBI7T.js';
+import './chunk-KDHYLBRR.js';
+import './chunk-KIGSGZBB.js';
+import './chunk-V7MQKOZY.js';
+import './chunk-GISNHSYL.js';
 import './chunk-Z5GEFMRW.js';
 import { EventEmitter } from 'events';
 import childProcess, { execFileSync } from 'child_process';
@@ -3649,7 +3651,7 @@ function apiKeyOption() {
   return new Option("--api-key <key>", `deprecated: use \`${cliInvocation()} login\` or OUTERLAYER_API_KEY`).hideHelp();
 }
 async function installStarterPackInRepo() {
-  const { installStarterPack, formatStarterPackOutput } = await import('./starter-pack-6LQVLBIA.js');
+  const { installStarterPack, formatStarterPackOutput } = await import('./starter-pack-5EQYGSJF.js');
   const cwd = process.cwd();
   let repoRoot = cwd;
   try {
@@ -3779,8 +3781,8 @@ ${starter.output}`),
   }
 }
 async function realConnectDepsForCwd() {
-  const { realConnectDeps } = await import('./connect-cmd-UNYKGDAL.js');
-  const { resolveRepoIdentity } = await import('./dist-WO7NOJNG.js');
+  const { realConnectDeps } = await import('./connect-cmd-ZFOK6HEL.js');
+  const { resolveRepoIdentity } = await import('./dist-7IH56ELA.js');
   return {
     ...realConnectDeps(),
     home: homeFromEnv(),
@@ -3843,7 +3845,7 @@ states under Starter files.
 `
   ).action(async (opts) => {
     if (opts.update || opts.dryRun) {
-      const { runInitUpdate, formatInitUpdate, updateFlagProblem } = await import('./init-update-7DVAKWW3.js');
+      const { runInitUpdate, formatInitUpdate, updateFlagProblem } = await import('./init-update-YB3PODDH.js');
       const problem = updateFlagProblem(opts);
       if (problem !== void 0) {
         fail(problem);
@@ -3857,7 +3859,7 @@ states under Starter files.
     }
     let starterTemplate;
     if (opts.template !== void 0) {
-      const { assertKnownTemplate, StarterPackError } = await import('./starter-pack-6LQVLBIA.js');
+      const { assertKnownTemplate, StarterPackError } = await import('./starter-pack-5EQYGSJF.js');
       try {
         assertKnownTemplate(opts.template);
       } catch (err) {
@@ -3890,12 +3892,12 @@ states under Starter files.
         if (changed.length > 0 && !opts.json) process.stdout.write(`Removed the claude function from ${changed.join(", ")}.
 `);
       }
-      const shell = !opts.remove && opts.shellFunction !== void 0 ? (await import('./init-cmd-Z4O4PPLZ.js')).applyShellFunctionFlag(opts.shellFunction, { home: homeFromEnv(), shellPath: process.env.SHELL }) : void 0;
+      const shell = !opts.remove && opts.shellFunction !== void 0 ? (await import('./init-cmd-IXDL2ZSL.js')).applyShellFunctionFlag(opts.shellFunction, { home: homeFromEnv(), shellPath: process.env.SHELL }) : void 0;
       if (opts.json) writeJson(shell === void 0 ? outcome.result : { ...outcome.result, shellFunction: { outcome: shell.outcome, reason: shell.reason } });
       else process.stdout.write(outcome.text + (shell?.text ?? ""));
       return;
     }
-    const { runInitCommand } = await import('./init-cmd-Z4O4PPLZ.js');
+    const { runInitCommand } = await import('./init-cmd-IXDL2ZSL.js');
     const code = await runInitCommand(
       { json: opts.json, factory: opts.factory, shellFunction: opts.shellFunction },
       {
@@ -3907,7 +3909,7 @@ states under Starter files.
           return { ok, text, detail };
         },
         runAgentSetup: async () => {
-          const { runAgentSetup } = await import('./agent-setup-AM42SA2D.js');
+          const { runAgentSetup } = await import('./agent-setup-XAJH6MPW.js');
           return runAgentSetup({ cwd: process.cwd() });
         },
         runDoctorChecks: gatherDoctorChecks,
@@ -3916,7 +3918,7 @@ states under Starter files.
           shellPath: process.env.SHELL,
           interactive: Boolean(process.stdin.isTTY && process.stderr.isTTY) && opts.json !== true,
           ask: async () => {
-            const { promptOnTerminal } = await import('./connect-cmd-UNYKGDAL.js');
+            const { promptOnTerminal } = await import('./connect-cmd-ZFOK6HEL.js');
             const answer = await promptOnTerminal({
               message: `Should plain claude start Claude Code through ${cliInvocation()} claude? That is how a session in a governed repository gets its control plane. It adds one block to your zsh or bash startup file.`,
               options: [
@@ -3955,7 +3957,7 @@ linked (true, false, or null when it could not be checked) and, when false,
 linkUrl.
 `
   ).action(async (opts) => {
-    const { runConnectCommand } = await import('./connect-cmd-UNYKGDAL.js');
+    const { runConnectCommand } = await import('./connect-cmd-ZFOK6HEL.js');
     const code = await runConnectCommand({ factory: opts.factory, json: opts.json }, await realConnectDepsForCwd(), {
       stdout: process.stdout,
       stderr: process.stderr
@@ -3994,7 +3996,7 @@ Every later command reads the saved file, so none of them needs a key on
 its command line. A saved key is checked for real on the first \`sync\`.
 `
   ).action(async (opts) => {
-    const { runLoginCommand, realLoginDeps } = await import('./login-browser-DX35MARZ.js');
+    const { runLoginCommand, realLoginDeps } = await import('./login-browser-BN5UKPHS.js');
     const code = await runLoginCommand(
       {
         browser: opts.browser !== false,
@@ -4018,7 +4020,7 @@ dashboard cannot be reached the local copy is still deleted and the exit
 code is 1: revoke the token on /profile/security.
 `
   ).action(async () => {
-    const { runLogoutCommand, realLogoutDeps } = await import('./logout-cmd-5V5MMBSY.js');
+    const { runLogoutCommand, realLogoutDeps } = await import('./logout-cmd-RZFWTNYD.js');
     const code = await runLogoutCommand(realLogoutDeps());
     if (code !== 0) process.exitCode = code;
   });
@@ -4033,7 +4035,7 @@ code is 1: revoke the token on /profile/security.
       else fail(found.reason);
       return;
     }
-    const { runSync, SyncConfigError, SyncTransportError } = await import('./sync-cmd-VXOUFS4I.js');
+    const { runSync, SyncConfigError, SyncTransportError } = await import('./sync-cmd-TQQIR4PN.js');
     try {
       const result = await runSync({
         url: opts.url,
@@ -4064,7 +4066,7 @@ code is 1: revoke the token on /profile/security.
     if (invokedCommandToken(argv) === "watch") {
       warnDeprecated(`\`${cliInvocation()} watch\` is now \`${cliInvocation()} daemon\`; the old name will be removed in a future release.`);
     }
-    const { runWatch } = await import('./watch-OH645CV2.js');
+    const { runWatch } = await import('./watch-4JES4PCS.js');
     await runWatch({ once: opts.once });
   });
   program2.command("hook <event>", { hidden: true }).description("capture-hook fast path, installed by `init`").action(() => {
@@ -4075,27 +4077,57 @@ code is 1: revoke the token on /profile/security.
   });
   program2.command("claude [args...]").description("start Claude Code with the repository's control plane attached").allowUnknownOption().helpOption(false).action(() => {
   });
-  program2.command("broker-relay", { hidden: true }).description("relay a build's loopback connections to the runner's tunnel and destinations").requiredOption("--port <port>", "the loopback port to listen on").requiredOption("--socket <path>", "the runner's tunnel socket").option("--forward <port=socket>", "also relay a loopback port to a destination's socket; repeatable", (value, previous) => [...previous, value], []).action(async (opts) => {
-    const { startRelay } = await import('./relay-L76HDX72.js');
+  const brokerRelay = program2.command("broker-relay", { hidden: true }).description("relay a build's loopback connections to the runner's tunnel and destinations").enablePositionalOptions().option("--port <port>", "the loopback port to listen on").option("--socket <path>", "the runner's tunnel socket").option("--join <path>", "the socket the runner's joining process connects to").option("--lease-watchdog", "exit when the runner's lease expiry passes; needs --join").option("--forward <port=target>", "also relay a loopback port to a destination; repeatable", (value, previous) => [...previous, value], []).action(async (opts) => {
+    const { startRelay, startSessionRelay } = await import('./relay-PSZ4LGMW.js');
+    const { TARGET_TUNNEL, targetOfPath } = await import('./relay-protocol-K7KP2SPI.js');
     const port = Number(opts.port);
     if (!Number.isInteger(port) || port < 1 || port > 65535) {
-      fail(`--port must be a port number, not ${opts.port}`);
+      fail(opts.port === void 0 ? "--port is required" : `--port must be a port number, not ${opts.port}`);
+      return;
+    }
+    if (opts.socket === void 0 === (opts.join === void 0)) {
+      fail("give one of --socket and --join");
       return;
     }
     const forwards = [];
     for (const spec of opts.forward) {
       const eq = spec.indexOf("=");
       const forwardPort = Number(spec.slice(0, eq));
-      if (eq === -1 || !Number.isInteger(forwardPort) || forwardPort < 1 || forwardPort > 65535 || eq === spec.length - 1) {
-        fail(`--forward must be <port>=<socket path>, not ${spec}`);
+      const portOk = eq !== -1 && Number.isInteger(forwardPort) && forwardPort >= 1 && forwardPort <= 65535 && eq !== spec.length - 1;
+      if (!portOk || opts.join !== void 0 && targetOfPath(`/${spec.slice(eq + 1)}`) === void 0) {
+        fail(`--forward must be <port>=<${opts.join === void 0 ? "socket path" : "target"}>, not ${spec}`);
         return;
       }
-      forwards.push({ port: forwardPort, socketPath: spec.slice(eq + 1) });
+      forwards.push({ port: forwardPort, spec: spec.slice(eq + 1) });
+    }
+    if (opts.join !== void 0) {
+      await startSessionRelay({
+        joinPath: opts.join,
+        ...opts.leaseWatchdog === true ? { onLeaseExpired: () => process.exit(0) } : {},
+        ports: [{ port, target: TARGET_TUNNEL }, ...forwards.map((forward) => ({ port: forward.port, target: forward.spec }))]
+      });
+      return;
+    }
+    await startRelay({ port, socketPath: opts.socket, forwards: forwards.map((forward) => ({ port: forward.port, socketPath: forward.spec })) });
+  });
+  brokerRelay.command("join").description("carry the runner's session to the relay over standard input and output").option("--socket <path>", "the relay's joining socket", "/run/outerlayer-relay/join.sock").action(async (opts) => {
+    const { joinRelay } = await import('./relay-PSZ4LGMW.js');
+    try {
+      await joinRelay({ socketPath: opts.socket, input: process.stdin, output: process.stdout });
+    } catch (err) {
+      fail(`could not join the relay at ${opts.socket}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  });
+  program2.command("receive-files", { hidden: true }).description("unpack a tar stream from standard input into a folder of a container build").requiredOption("--into <dir>", "the folder to fill: /outerlayer/job, /outerlayer/judge, or a folder beneath one").option("--replace", "empty the folder first").action(async (opts) => {
+    const { receiveFiles } = await import('./receive-files-T2BIUBQL.js');
+    try {
+      await receiveFiles(process.stdin, { into: opts.into, replace: opts.replace === true });
+    } catch (err) {
+      fail(err instanceof Error ? err.message : "the files could not be received");
     }
-    await startRelay({ port, socketPath: opts.socket, forwards });
   });
   program2.command("vm-exec", { hidden: true }).description("run a command in a microVM build's guest through its exec agent").requiredOption("--socket <path>", "the Unix socket Firecracker serves the build's vsock device on").option("--user <user>", "the user to run as", "").option("--cwd <dir>", "the working directory", "/").option("--env <NAME=value>", "an environment value the command line carries; repeatable", (value, previous) => [...previous, value], []).option("--pass <NAME>", "an environment variable whose value is read from this process; repeatable", (value, previous) => [...previous, value], []).argument("<argv...>", "the command and its arguments").action(async (argv2, opts) => {
-    const { runVmExec } = await import('./exec-client-7UMESIE2.js');
+    const { runVmExec } = await import('./exec-client-YIDTWXMZ.js');
     const env = {};
     for (const entry of opts.env) {
       const eq = entry.indexOf("=");
@@ -4119,8 +4151,12 @@ code is 1: revoke the token on /profile/security.
       process.exit(255);
     }
   });
+  program2.command("build-command", { hidden: true }).description("run a container build's command and record its exit code").option("--dir <path>", "the folder for command.log, command.pid and exit-code", "/build/.command").argument("<command...>", "the command to run, after --").action(async (command, opts) => {
+    const { runBuildCommand } = await import('./build-command-ND2ENDBS.js');
+    process.exitCode = await runBuildCommand({ dir: opts.dir, argv: command });
+  });
   program2.command("session-sender", { hidden: true }).description("stream a runner build's sessions to its work item while the build runs").action(async () => {
-    const { runSessionSender } = await import('./session-sender-U2BBUWNO.js');
+    const { runSessionSender } = await import('./session-sender-2G25JYHI.js');
     try {
       await runSessionSender();
     } catch (err) {
@@ -4128,7 +4164,7 @@ code is 1: revoke the token on /profile/security.
     }
   });
   program2.command("vm-init", { hidden: true }).description("lay out a microVM build's guest; the guest helper runs it").action(async () => {
-    const { realGuestHost, runGuestInit } = await import('./guest-init-KPBQOFE5.js');
+    const { realGuestHost, runGuestInit } = await import('./guest-init-TO6HAWIT.js');
     const { readFileSync: readFileSync3 } = await import('fs');
     try {
       runGuestInit(realGuestHost(), readFileSync3("/proc/cmdline", "utf8"));
@@ -4156,7 +4192,7 @@ async function runCli(processArgv) {
   await buildProgram(argv).parseAsync(argv);
 }
 async function compileContext(opts) {
-  const { runEmit, EmitError } = await import('./emit-cmd-W55AEBCA.js');
+  const { runEmit, EmitError } = await import('./emit-cmd-3W5IO5ET.js');
   try {
     const result = runEmit({ cwd: opts.dir, check: opts.check, json: opts.json });
     if (result.exitCode !== 0) process.exitCode = result.exitCode;
@@ -4203,7 +4239,7 @@ Compiling .outerlayer/ moved to \`${cliInvocation()} context emit\`.
       await compileContext({ dir: opts.dir, check: opts.check, json: opts.json });
       return;
     }
-    const { runEmitResult, EmitResultError } = await import('./emit-result-cmd-5NZMLCJK.js');
+    const { runEmitResult, EmitResultError } = await import('./emit-result-cmd-FUE3DXBW.js');
     try {
       const result = await runEmitResult({
         name,
@@ -4253,7 +4289,7 @@ everywhere, bytes and deep link untouched; a still-queued one is cancelled
 locally so it never uploads. One correction can retire several duplicates.
 `
   ).action(async (file, opts) => {
-    const { runEmitArtifact, EmitArtifactError } = await import('./emit-artifact-cmd-XBHM647X.js');
+    const { runEmitArtifact, EmitArtifactError } = await import('./emit-artifact-cmd-R42BE6ID.js');
     let pr;
     if (opts.pr !== void 0) {
       pr = parseTrackerNumber(opts.pr);
@@ -4312,7 +4348,7 @@ recent events with their ids. --find <text> searches all of them.
 item that session was launched for is used automatically.
 `
   ).action(async (opts) => {
-    const { runEmitFinding, refuseRemovedFindingFlags, EmitFindingError } = await import('./emit-finding-cmd-7JHVRYOP.js');
+    const { runEmitFinding, refuseRemovedFindingFlags, EmitFindingError } = await import('./emit-finding-cmd-ZS5JEGGM.js');
     try {
       refuseRemovedFindingFlags(opts);
       const result = await runEmitFinding({
@@ -4379,7 +4415,7 @@ the whole batch. "untimed": true records one with no time on purpose.
 that session was launched for is used automatically.
 `
   ).action(async (file, opts) => {
-    const { runEmitFindings, EmitFindingError } = await import('./emit-finding-cmd-7JHVRYOP.js');
+    const { runEmitFindings, EmitFindingError } = await import('./emit-finding-cmd-ZS5JEGGM.js');
     try {
       const result = await runEmitFindings({
         file,
@@ -4414,7 +4450,7 @@ command, the command exits 0, and \`sync\` sends it later. If the gateway refuse
 the step, the command prints why and exits 1.
 `
   ).action(async (name, opts) => {
-    const { runEmitStep, EmitStepError } = await import('./emit-step-cmd-347XNGPQ.js');
+    const { runEmitStep, EmitStepError } = await import('./emit-step-cmd-T7PRA44X.js');
     try {
       await runEmitStep({
         name,
@@ -4432,7 +4468,7 @@ the step, the command prints why and exits 1.
       throw err;
     }
   });
-  emitCmd.command("criteria <file>").description("Record a work item's acceptance criteria from a JSON file (- for stdin)").option("--item <number>", "work item to record on directly, by its number in this factory").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
+  emitCmd.command("criteria <file>").description("Record a work item's acceptance criteria from a JSON or acceptance .md file").option("--item <number>", "work item to record on directly, by its number in this factory").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
     "after",
     `
   ${cliInvocation()} emit criteria criteria.json --item 412
@@ -4450,9 +4486,14 @@ Once an item has a list, only a person can replace it: run the command outside a
 agent session, with your own login. A key bound to no member cannot replace it either.
 --item names the work item; without it, inside a recorded session, the item that
 session was launched for is used automatically.
+
+A file ending in .md is read as an acceptance file, such as acceptance/412-login.md:
+each list item that opens with an id in backticks is a criterion, its text is the rest
+of the item, and a (proof: <kind>) annotation names its proof.
+  ${cliInvocation()} emit criteria acceptance/412-login.md --item 412
 `
   ).action(async (file, opts) => {
-    const { runEmitCriteria, EmitCriteriaError } = await import('./emit-criteria-cmd-CRTYEF7D.js');
+    const { runEmitCriteria, EmitCriteriaError } = await import('./emit-criteria-cmd-MQZE7W4Y.js');
     try {
       const result = await runEmitCriteria({
         file,
@@ -4476,9 +4517,9 @@ function registerSpecCommands(program2) {
   const specCmd = program2.command("spec").description("Find, file and edit the issue a spec lives in, in your factory's tracker");
   const credentialOptions = (command) => command.option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)");
   const run = async (action) => {
-    const { WorkCommandError } = await import('./work-cmd-5I3J2XQQ.js');
+    const { WorkCommandError } = await import('./work-cmd-L6WMPAA2.js');
     try {
-      await action(await import('./spec-cmd-FVLJOFGC.js'));
+      await action(await import('./spec-cmd-LBVXM6XS.js'));
     } catch (err) {
       if (err instanceof WorkCommandError) {
         fail(err.message);
@@ -4502,11 +4543,12 @@ function registerSpecCommands(program2) {
 }
 function registerWorkCommands(program2) {
   const workCmd = program2.command("work").description("Start, remove, or read what the factory is working on (the Work page)");
-  workCmd.command("build").description("Start work on an item: a host builds it, or with --local you do").option("--issue <number>", "issue number, or a Linear/Jira key like ENG-123 (adds it to Work first)").option(TRACKER_OPTION_FLAG, "tracker for a keyed --issue \u2014 required if more than one is connected").option("--item <number>", "the item's own number inside this factory \u2014 must already exist").option("--local", "you build it in a session you start; no host takes it").option("--repo <owner/name>", "repository \u2014 the checkout's remote for a number, never guessed for a key").option("--note <text>", "a short note stored with the request").option("--session-id <id>", "session id to record as-is, skipping detection").option("--retry <count>", "retries after a gateway answer worth trying again").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
+  workCmd.command("build").description("Start work on an item: a host builds it, or with --local you do").option("--issue <number>", "issue number, or a Linear/Jira key like ENG-123 (adds it to Work first)").option(TRACKER_OPTION_FLAG, "tracker for a keyed --issue \u2014 required if more than one is connected").option("--item <number>", "the item's own number inside this factory \u2014 must already exist").option("--local", "you build it in a session you start; no host takes it").option("--repo <owner/name>", "repository \u2014 the checkout's remote for a number, never guessed for a key").option("--note <text>", "a short note for people to read; the agent never sees it").option("--instructions <text>", "text the build's agent receives, up to 2000 characters; not with --local").option("--session-id <id>", "session id to record as-is, skipping detection").option("--retry <count>", "retries after a gateway answer worth trying again").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
     "after",
     `
   ${cliInvocation()} work build --issue 42                       # a host builds it
   ${cliInvocation()} work build --item 7                         # retry an item already on Work
+  ${cliInvocation()} work build --issue 42 --instructions "skip the docs"  # the agent reads this
   ${cliInvocation()} work build --issue 42 --local               # you build it
   ${cliInvocation()} work build --issue ENG-123 --tracker linear # a Linear issue
 
@@ -4519,7 +4561,7 @@ takes it, and prints the line that starts your session on it. That
 session links itself and holds the item's lease while it works.
 `
   ).action(async (opts) => {
-    const { runWorkBuild, WorkCommandError } = await import('./work-cmd-5I3J2XQQ.js');
+    const { runWorkBuild, WorkCommandError } = await import('./work-cmd-L6WMPAA2.js');
     try {
       await runWorkBuild(opts);
     } catch (err) {
@@ -4542,7 +4584,7 @@ renews that session's own 20-minute lease, unless --no-lease or
 --ended is given, or another worker already holds a live one.
 `
   ).action(async (number, opts) => {
-    const { runWorkLinkSession, WorkCommandError } = await import('./work-cmd-5I3J2XQQ.js');
+    const { runWorkLinkSession, WorkCommandError } = await import('./work-cmd-L6WMPAA2.js');
     try {
       await runWorkLinkSession({ ...opts, number, noLease: opts.lease === false, logFailures: opts.logFailures === true });
     } catch (err) {
@@ -4566,8 +4608,8 @@ criterion's new proof; --ready hands the thread back to a person. At
 most one action flag may be given.
 `
   ).action(async (opts) => {
-    const { runWorkComment, WorkCommentCommandError } = await import('./work-comment-cmd-UCCPWUSR.js');
-    const { WorkCommandError } = await import('./work-cmd-5I3J2XQQ.js');
+    const { runWorkComment, WorkCommentCommandError } = await import('./work-comment-cmd-SNTDCPGH.js');
+    const { WorkCommandError } = await import('./work-cmd-L6WMPAA2.js');
     try {
       await runWorkComment(opts);
     } catch (err) {
@@ -4588,8 +4630,8 @@ criterion that carries proof or a comment, each with who is waiting
 on whom next.
 `
   ).action(async (opts) => {
-    const { runWorkThreads, WorkCommentCommandError } = await import('./work-comment-cmd-UCCPWUSR.js');
-    const { WorkCommandError } = await import('./work-cmd-5I3J2XQQ.js');
+    const { runWorkThreads, WorkCommentCommandError } = await import('./work-comment-cmd-SNTDCPGH.js');
+    const { WorkCommandError } = await import('./work-cmd-L6WMPAA2.js');
     try {
       await runWorkThreads(opts);
     } catch (err) {
@@ -4613,8 +4655,8 @@ still running, or that an older runner released, has no log and the
 command exits 1.
 `
   ).action(async (opts) => {
-    const { runWorkLogs, WorkLogsCommandError } = await import('./work-logs-cmd-7352CJPG.js');
-    const { WorkCommandError } = await import('./work-cmd-5I3J2XQQ.js');
+    const { runWorkLogs, WorkLogsCommandError } = await import('./work-logs-cmd-3S7IAVII.js');
+    const { WorkCommandError } = await import('./work-cmd-L6WMPAA2.js');
     try {
       await runWorkLogs(opts);
     } catch (err) {
@@ -4625,6 +4667,30 @@ command exits 1.
       throw err;
     }
   });
+  workCmd.command("stop").description("Stop the host build running on a work item").requiredOption("--item <number>", "the item's number inside this factory").option("--note <text>", "why the build is stopped (up to 500 characters); kept with the attempt").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
+    "after",
+    `
+  ${cliInvocation()} work stop --item 7
+  ${cliInvocation()} work stop --item 7 --note "wrong branch"
+
+Asks the host that holds the item's build to end it. The host reads the
+request at its next heartbeat, so the build may run a little longer. The
+item is not built again until a new build request. Exits 1 when no host
+build is running for the item.
+`
+  ).action(async (opts) => {
+    const { runWorkStop, WorkStopCommandError } = await import('./work-stop-cmd-WR7ESS4Z.js');
+    const { WorkCommandError } = await import('./work-cmd-L6WMPAA2.js');
+    try {
+      await runWorkStop(opts);
+    } catch (err) {
+      if (err instanceof WorkStopCommandError || err instanceof WorkCommandError) {
+        fail(err.message);
+        return;
+      }
+      throw err;
+    }
+  });
   workCmd.command("remove").description("Withdraw a source's addition \u2014 never deletes the item").option("--item <number>", "the item's number inside this factory").option("--issue <number>", "issue number or Linear/Jira key (default: named by --item instead)").option(TRACKER_OPTION_FLAG, "tracker for a keyed --issue, when both hold the key").option("--repo <owner/name>", "repository for an issue number (default: the checkout's remote)").requiredOption("--reason <text>", "why this source is no longer working on it").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
     "after",
     `
@@ -4635,7 +4701,7 @@ deletes anything \u2014 the item is removed from Work only once no
 live addition remains on it.
 `
   ).action(async (opts) => {
-    const { runWorkRemove, WorkCommandError } = await import('./work-cmd-5I3J2XQQ.js');
+    const { runWorkRemove, WorkCommandError } = await import('./work-cmd-L6WMPAA2.js');
     try {
       await runWorkRemove(opts);
     } catch (err) {
@@ -4647,7 +4713,7 @@ live addition remains on it.
     }
   });
   workCmd.command("status").description("Show one item's stage, gate ledger, and additions").option("--item <number>", "the item's number inside this factory").option("--issue <number>", "issue number, or a Linear/Jira key like ENG-123").option(TRACKER_OPTION_FLAG, "tracker for a keyed --issue, when both hold the key").option("--repo <owner/name>", "repository for an issue number (default: the checkout's remote)").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").action(async (opts) => {
-    const { runWorkStatus, WorkCommandError } = await import('./work-cmd-5I3J2XQQ.js');
+    const { runWorkStatus, WorkCommandError } = await import('./work-cmd-L6WMPAA2.js');
     try {
       await runWorkStatus(opts);
     } catch (err) {
@@ -4659,7 +4725,7 @@ live addition remains on it.
     }
   });
   workCmd.command("list").description("List live work items for this factory").option("--stage <spec|build|review>", "filter by stage").option("--section <attention|waiting|flowing>", "filter by Queue section").option("--repo <owner/name>", "repository (default: the current checkout's remote)").option("--unclaimed", "only items with no live lease").option("--claimed", "only items with a live lease, held by a host or a local session").option("--startable", "only items a host can start: a build request, no open PR, no live lease").option("--needs <amend>", "only items with a thread waiting on an agent").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").action(async (opts) => {
-    const { runWorkList, WorkCommandError } = await import('./work-cmd-5I3J2XQQ.js');
+    const { runWorkList, WorkCommandError } = await import('./work-cmd-L6WMPAA2.js');
     try {
       await runWorkList(opts);
     } catch (err) {
@@ -4680,7 +4746,7 @@ by a different key is refused; claiming again with the same key extends
 it. --host is a label only.
 `
   ).action(async (opts) => {
-    const { runWorkClaim, WorkCommandError } = await import('./work-claim-cmd-ZRPSHMPT.js');
+    const { runWorkClaim, WorkCommandError } = await import('./work-claim-cmd-XG6O7B63.js');
     try {
       await runWorkClaim(opts);
     } catch (err) {
@@ -4700,7 +4766,7 @@ Extends the live lease this API key holds. Refused with a 410 if the
 lease has expired, or a 403 if a different key holds it.
 `
   ).action(async (opts) => {
-    const { runWorkRenew, WorkCommandError } = await import('./work-claim-cmd-ZRPSHMPT.js');
+    const { runWorkRenew, WorkCommandError } = await import('./work-claim-cmd-XG6O7B63.js');
     try {
       await runWorkRenew(opts);
     } catch (err) {
@@ -4732,7 +4798,7 @@ applies to a host's lease only. A later tool call in the session
 takes the lease again.
 `
   ).action(async (opts) => {
-    const { runWorkRelease, WorkCommandError } = await import('./work-claim-cmd-ZRPSHMPT.js');
+    const { runWorkRelease, WorkCommandError } = await import('./work-claim-cmd-XG6O7B63.js');
     try {
       await runWorkRelease(opts);
     } catch (err) {
@@ -4759,7 +4825,7 @@ Idempotent: declaring the same pull request twice is a no-op.
 needs your own login; an agent session or a factory key is refused.
 `
   ).action(async (number, opts) => {
-    const { runWorkPr, WorkPrCommandError } = await import('./work-pr-cmd-H4OQR26N.js');
+    const { runWorkPr, WorkPrCommandError } = await import('./work-pr-cmd-22T6FG4T.js');
     try {
       await runWorkPr({ ...opts, number });
     } catch (err) {
@@ -4784,8 +4850,8 @@ login, then declares the pull request on the item, as \`work pr\` does.
 Run it again after a change to the title or description.
 `
   ).action(async (opts) => {
-    const { runWorkOpenPr, WorkOpenPrCommandError } = await import('./work-open-pr-cmd-LSH4VHJM.js');
-    const { WorkCommandError } = await import('./work-cmd-5I3J2XQQ.js');
+    const { runWorkOpenPr, WorkOpenPrCommandError } = await import('./work-open-pr-cmd-E3WMO5XT.js');
+    const { WorkCommandError } = await import('./work-cmd-L6WMPAA2.js');
     try {
       await runWorkOpenPr(opts);
     } catch (err) {
@@ -4801,9 +4867,9 @@ function registerRunnerCommands(program2) {
   const runnerCmd = program2.command("runner").description("Take work from the implement and amend queues on this machine");
   const configOption = "the cloud config file to run against (default: ~/.outerlayer/config.json)";
   runnerCmd.command("start").description("Run the loop: claim work, run it, report, clean up, repeat").option("--config <path>", configOption).action(async (opts) => {
-    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-CLSGABD5.js');
-    const { start, RunnerStartError } = await import('./loop-TPUYUMSY.js');
-    const { RunnerAlreadyRunningError } = await import('./pidfile-3DM4OBKO.js');
+    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-7Q52COZ3.js');
+    const { start, RunnerStartError } = await import('./loop-ZDW6TRAA.js');
+    const { RunnerAlreadyRunningError } = await import('./pidfile-IF3TCL5A.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     try {
       const { realUpdateDeps } = await import('./real-deps-KNNBQC75.js');
@@ -4817,8 +4883,8 @@ function registerRunnerCommands(program2) {
     }
   });
   runnerCmd.command("check").description("Validate the config, the hooks and the key, and print the effective settings").option("--config <path>", configOption).action(async (opts) => {
-    const { defaultRunnerConfigPath } = await import('./config-CLSGABD5.js');
-    const { runRunnerCheck } = await import('./check-W2JGXN3B.js');
+    const { defaultRunnerConfigPath } = await import('./config-7Q52COZ3.js');
+    const { runRunnerCheck } = await import('./check-3YHMJQ3P.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const result = await runRunnerCheck(configPath);
     if (!result.ok) {
@@ -4834,8 +4900,8 @@ function registerRunnerCommands(program2) {
 `);
   });
   runnerCmd.command("install").description("Put this CLI in the runner's install layout; --service adds its service").option("--config <path>", configOption).option("--service", "set up the service that keeps the runner running").option("--print", "with --service, print the unit and set up nothing").option("--user <account>", "with --service, the account the service runs as").option("--replace", "replace a unit or launcher file this command did not write").option("--allow-downgrade", "install this CLI even when it is older than the version the runner runs").option("--unit-name <name>", "with --service, the unit's name, to run a second runner beside the first").action(async (opts) => {
-    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-CLSGABD5.js');
-    const { runRunnerInstall, RunnerInstallError, launcherSummary, restartNote } = await import('./install-cmd-QDOTR4OM.js');
+    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-7Q52COZ3.js');
+    const { runRunnerInstall, RunnerInstallError, launcherSummary, restartNote } = await import('./install-cmd-Q7RJGFUO.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     if (opts.service !== true) {
       for (const flag of ["print", "user", "unitName"]) {
@@ -4847,7 +4913,7 @@ function registerRunnerCommands(program2) {
     }
     try {
       if (opts.service === true) {
-        const { installServiceCommand } = await import('./command-ZQNEPDS6.js');
+        const { installServiceCommand } = await import('./command-GE62AJZY.js');
         const result2 = await installServiceCommand({
           configPath,
           print: opts.print,
@@ -4902,8 +4968,8 @@ To keep it running, run ${C.yellow}${cliInvocation()} runner install --service${
       fail(`pass --service: \`${cliInvocation()} runner uninstall --service\` removes the runner's service.`);
       return;
     }
-    const { defaultRunnerConfigPath } = await import('./config-CLSGABD5.js');
-    const { uninstallServiceCommand } = await import('./command-ZQNEPDS6.js');
+    const { defaultRunnerConfigPath } = await import('./config-7Q52COZ3.js');
+    const { uninstallServiceCommand } = await import('./command-GE62AJZY.js');
     const result = await uninstallServiceCommand({ configPath: opts.config ?? defaultRunnerConfigPath(), unitName: opts.unitName, home: homeFromEnv() });
     if (result.ok) for (const line of result.lines) process.stdout.write(`${C.green}\u2713${C.reset} ${line}
 `);
@@ -4930,12 +4996,12 @@ already in runner.env is used.
   printf '%s' "$CLAUDE_CODE_OAUTH_TOKEN" | ${cliInvocation()} runner init --agent claude --factory <org>/<factory>
 `
   ).action(async (opts) => {
-    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-CLSGABD5.js');
-    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-XG47KCI4.js');
-    const { obtainRunnerKey, runnerKeyLogin } = await import('./runner-key-5FOWCW7J.js');
-    const { detectMachine } = await import('./machine-TRHBT5NE.js');
-    const { chooseVm, runVmInit, VmInitError } = await import('./init-V6FOMD2V.js');
-    const { AGENT_COMMANDS, credentialFromStdin, isAgentName, restartForCredential, RunnerEnvError } = await import('./runner-env-FRZFFHDF.js');
+    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-7Q52COZ3.js');
+    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-2CRAVIUU.js');
+    const { obtainRunnerKey, runnerKeyLogin } = await import('./runner-key-HMYLP6WN.js');
+    const { detectMachine } = await import('./machine-JCOHLASP.js');
+    const { chooseVm, runVmInit, VmInitError } = await import('./init-AHDZCMDC.js');
+    const { AGENT_COMMANDS, credentialFromStdin, isAgentName, restartForCredential, RunnerEnvError } = await import('./runner-env-LDOBJESN.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     if (opts.agent !== void 0 && !isAgentName(opts.agent)) {
       fail(`--agent ${opts.agent}: runner init writes commands for ${Object.keys(AGENT_COMMANDS).join(", ")}. For another agent, leave --agent out and edit runner.commands.`);
@@ -4949,7 +5015,7 @@ already in runner.env is used.
     try {
       let credential;
       if (agent !== void 0) {
-        const { readPipedKey } = await import('./login-browser-DX35MARZ.js');
+        const { readPipedKey } = await import('./login-browser-BN5UKPHS.js');
         credential = credentialFromStdin(
           await readPipedKey(process.stdin, {
             onWaiting: () => process.stderr.write(`runner init is waiting for Claude's credential on stdin; close stdin to use the one already in runner.env
@@ -4966,7 +5032,7 @@ already in runner.env is used.
         const chunks = [];
         for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
         const result2 = runRunnerInit(configPath, { machine, configFromStdin: Buffer.concat(chunks).toString("utf8"), requireContainer: true });
-        const { ensureHostKey: ensureHostKey2 } = await import('./host-key-U4B5QETR.js');
+        const { ensureHostKey: ensureHostKey2 } = await import('./host-key-2LXQDSBO.js');
         const hostKey2 = await ensureHostKey2(configPath);
         process.stdout.write(`host key ${hostKey2.fingerprint}
 hooks: ${result2.hooks}
@@ -5025,7 +5091,7 @@ hooks: ${result2.hooks}
       const prepared = prepareRunnerInit(configPath, { machine, allowProcess, agent, credential, keyFromLogin: makeKey !== void 0 });
       const created = makeKey === void 0 ? void 0 : await makeKey();
       const result = writeRunnerInit(prepared, created);
-      const { ensureHostKey } = await import('./host-key-U4B5QETR.js');
+      const { ensureHostKey } = await import('./host-key-2LXQDSBO.js');
       const hostKey = await ensureHostKey(configPath);
       if (created !== void 0) {
         process.stdout.write(`${C.green}\u2713${C.reset} saved the runner key in ${result.configPath}
@@ -5053,7 +5119,7 @@ ${C.yellow}${result.note}${C.reset}
 To isolate builds in containers instead, run ${C.yellow}${cliInvocation()} runner init --vm${C.reset}.
 `);
       }
-      const { runRunnerInstall, RunnerInstallError, RunnerDowngradeError, launcherSummary } = await import('./install-cmd-QDOTR4OM.js');
+      const { runRunnerInstall, RunnerInstallError, RunnerDowngradeError, launcherSummary } = await import('./install-cmd-Q7RJGFUO.js');
       let installedLayout = false;
       let noService = "it starts the runner from the install layout, which needs a CLI installed with npm";
       try {
@@ -5085,7 +5151,7 @@ ${C.yellow}The runner will not update itself: ${installErr.message}${C.reset}
       let serviceUp = false;
       let restart;
       if (installedLayout) {
-        const { installServiceCommand } = await import('./command-ZQNEPDS6.js');
+        const { installServiceCommand } = await import('./command-GE62AJZY.js');
         const service = await installServiceCommand({
           configPath,
           entryPath: process.argv[1] ?? "",
@@ -5129,12 +5195,12 @@ Next:
     "after",
     "\nA repository governed by a control plane builds the control plane's image, at the commit\nthe gateway has stored for it. A repository that governs itself fetches the head of its\ndefault branch into the runner's cache. Either way it reads .devcontainer/devcontainer.json\nand builds the image with the devcontainer CLI. Settings\nthat reach the host or widen the container's privileges are ignored and listed. The\nimage holds this CLI and a pinned Claude Code. Nothing runs inside the image.\n"
   ).action(async (opts) => {
-    const { defaultRunnerConfigPath } = await import('./config-CLSGABD5.js');
-    const { buildRepositoryImage, RecipeError } = await import('./build-TQ6X5PYN.js');
+    const { defaultRunnerConfigPath } = await import('./config-7Q52COZ3.js');
+    const { buildRepositoryImage, RecipeError } = await import('./build-GTMEADQD.js');
     const { currentCliBuild } = await import('./cli-build-K56DK4DS.js');
-    const { createDockerHost } = await import('./docker-BFU3AQGY.js');
-    const { builderSpec } = await import('./builder-C4QNTYMS.js');
-    const { loadRunnerConfig } = await import('./config-CLSGABD5.js');
+    const { createDockerHost } = await import('./docker-2OVBKVRK.js');
+    const { builderSpec } = await import('./builder-OAUSTZHL.js');
+    const { loadRunnerConfig } = await import('./config-7Q52COZ3.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const loaded = (() => {
       try {
@@ -5145,7 +5211,11 @@ Next:
     })();
     const memory = loaded?.build?.memory ?? "8g";
     try {
-      const { imageTargetFor } = await import('./governing-source-HAA4OW57.js');
+      const { ensureRunnerIdentity } = await import('./runner-identity-RWCBTY2A.js');
+      await ensureRunnerIdentity(configPath, { log: (line) => console.error(line) }).catch((err) => {
+        console.error(`the runner's Docker identity could not be stored: ${err instanceof Error ? err.message : String(err)}`);
+      });
+      const { imageTargetFor } = await import('./governing-source-TORXL4I4.js');
       const target = await imageTargetFor({ config: loaded, repository: opts.repository, fetchImpl: fetch });
       if (!target.ok) {
         if (opts.json) {
@@ -5208,22 +5278,22 @@ Next:
     }
   });
   runnerCmd.command("stop").description("Take no more work; wait for running jobs to finish, then exit").option("--config <path>", "the cloud config file naming the runner to stop").option("--now", "end running jobs immediately, with outcome stopped").action(async (opts) => {
-    const { defaultRunnerConfigPath } = await import('./config-CLSGABD5.js');
-    const { requestStop } = await import('./loop-TPUYUMSY.js');
+    const { defaultRunnerConfigPath } = await import('./config-7Q52COZ3.js');
+    const { requestStop } = await import('./loop-ZDW6TRAA.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     await requestStop(configPath, Boolean(opts.now));
   });
   runnerCmd.command("status").description("List running jobs; with --recent, finished ones too").option("--config <path>", "the cloud config file naming the runner to inspect").option("--recent", "also list finished jobs, newest first, capped at 20").option("--json", "machine-readable JSON output").action(async (opts) => {
-    const { defaultRunnerConfigPath, loadRunnerConfig } = await import('./config-CLSGABD5.js');
-    const { jobsDir, runnerDir } = await import('./paths-7XP63OAX.js');
-    const { listJobFiles, runnerProcessState } = await import('./loop-TPUYUMSY.js');
-    const { renderStatus } = await import('./status-BINH7MBG.js');
-    const { readHousekeepingRecord } = await import('./record-3WP6V2K5.js');
+    const { defaultRunnerConfigPath, loadRunnerConfig } = await import('./config-7Q52COZ3.js');
+    const { jobsDir, runnerDir } = await import('./paths-N3LU4O2Z.js');
+    const { listJobFiles, runnerProcessState } = await import('./loop-ZDW6TRAA.js');
+    const { renderStatus } = await import('./status-QZB2GWXJ.js');
+    const { readHousekeepingRecord } = await import('./record-73PQE77B.js');
     const path2 = await import('path');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const all = listJobFiles(configPath);
     const housekeeping = readHousekeepingRecord(runnerDir(configPath));
-    const { readPendingUpdate } = await import('./pending-532ABZYC.js');
+    const { readPendingUpdate } = await import('./pending-GRCV3ZR4.js');
     const pendingUpdate = readPendingUpdate(runnerDir(configPath));
     let host = "unknown";
     let concurrency = 1;
@@ -5237,7 +5307,7 @@ Next:
     const service = await (async () => {
       if (process.platform !== "linux" || !existsSync("/run/systemd/system")) return void 0;
       const { inspectService, realInspectProbes } = await import('./inspect-6UYAAXH7.js');
-      const { DEFAULT_UNIT_NAME } = await import('./install-4SEFIIW2.js');
+      const { DEFAULT_UNIT_NAME } = await import('./install-CZUIW2AF.js');
       const facts = inspectService(DEFAULT_UNIT_NAME, path2.dirname(configPath), realInspectProbes());
       return facts === void 0 ? void 0 : { unit: facts.unit, running: facts.mainPid !== void 0, delegated: facts.delegate };
     })();
@@ -5272,9 +5342,9 @@ Next:
     );
   });
   runnerCmd.command("logs").argument("<item>", "the work item's number in the factory").description("Print the newest attempt's log for one item").option("--config <path>", "the cloud config file naming the runner to inspect").option("-f, --follow", "keep printing as the log grows").action(async (itemArg, opts) => {
-    const { defaultRunnerConfigPath } = await import('./config-CLSGABD5.js');
-    const { listJobFiles } = await import('./loop-TPUYUMSY.js');
-    const { newestAttempt, logPathFor, tail, RunnerLogsError } = await import('./logs-AMLKC3VP.js');
+    const { defaultRunnerConfigPath } = await import('./config-7Q52COZ3.js');
+    const { listJobFiles } = await import('./loop-ZDW6TRAA.js');
+    const { newestAttempt, logPathFor, tail, RunnerLogsError } = await import('./logs-RJPYTVQE.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const item = parseTrackerNumber(itemArg);
     if (item === void 0) {
@@ -5500,7 +5570,7 @@ Self-host deployments also need --app-id: without a key service to resolve the
 caller from the bearer token, the gateway answers 401 without that header.
 `
   ).action(async (opts) => {
-    const { runMcpInstall, handleMcpInstallError, McpInstallError } = await import('./mcp-install-cmd-GGWB3JJ2.js');
+    const { runMcpInstall, handleMcpInstallError, McpInstallError } = await import('./mcp-install-cmd-GD4QUP7Z.js');
     try {
       if (opts.transport !== void 0 && opts.transport !== "stdio" && opts.transport !== "http") {
         throw new McpInstallError(`--transport must be "stdio" or "http", got "${opts.transport}"`);
@@ -5522,7 +5592,7 @@ caller from the bearer token, the gateway answers 401 without that header.
     "after",
     "\nWhat the stdio .mcp.json entry spawns. Reads newline-delimited JSON-RPC 2.0 on\nstdin and writes responses on stdout. The API key comes from OUTERLAYER_API_KEY\nor ~/.outerlayer/config.json at start-up; with neither the command exits 1 and\nprints why, which the MCP client shows as the connect error.\n"
   ).action(async (opts) => {
-    const { runMcpServe, handleMcpServeError } = await import('./mcp-serve-cmd-N3UTY6EE.js');
+    const { runMcpServe, handleMcpServeError } = await import('./mcp-serve-cmd-IULQPVHL.js');
     try {
       await runMcpServe({ url: opts.url, appId: opts.appId });
     } catch (err) {
@@ -5547,9 +5617,9 @@ function registerImportCommands(program2) {
   });
   importCmd.command("capture").description("Install the maintained skills into .outerlayer/").option("--dir <path>", "repo root to write into (default: cwd)").option("--json", "machine-readable JSON output").addHelpText(
     "after",
-    "\nInstalls the four maintained skills (outerlayer-evidence, outerlayer-amend,\nouterlayer-findings, outerlayer-cli) and an AGENTS.md snippet teaching agents to run\n`emit artifact`. A skill that differs from this CLI's bundle is rewritten to it, and the output says so.\n"
+    "\nInstalls the five maintained skills (outerlayer-evidence, outerlayer-amend,\nouterlayer-findings, outerlayer-cli, outerlayer-build) and an AGENTS.md snippet teaching agents to run\n`emit artifact`. A skill that differs from this CLI's bundle is rewritten to it, and the output says so.\n"
   ).action(async (opts) => {
-    const { runImportCapture, ImportCaptureError } = await import('./import-capture-cmd-TK4XY7RD.js');
+    const { runImportCapture, ImportCaptureError } = await import('./import-capture-cmd-Q56DDZVO.js');
     try {
       runImportCapture({ cwd: opts.dir, json: opts.json });
     } catch (err) {
@@ -5565,7 +5635,7 @@ function registerContextCommands(program2) {
   const contextCmd = program2.command("context").description("Compile agent context");
   contextCmd.command("emit").description("Compile .outerlayer/ into each configured target tool's native files").option("--check", "compare against disk, write nothing, exit 1 on drift (CI mode)").option("--dir <path>", "repo root to read from (default: cwd)").option("--json", "machine-readable JSON output").addHelpText(
     "after",
-    '\nTargets come from .outerlayer/config.json only; there is no --target flag.\nMissing or empty config: {"targets": [...]}, e.g. {"targets": ["claude-code"]}.\nKnown targets: claude-code, cursor, codex, copilot, factory.\n\nThe maintained skills (outerlayer-evidence, outerlayer-amend, outerlayer-findings,\nouterlayer-cli) follow this CLI: emit rewrites one that differs from its bundle, and --check\nreports it as drift. A copy under an earlier name (amend, emitting-evidence,\nreporting-findings, outerlayer) is deleted, and --check reports it as retired.\nTemplates (spec, writing-specs, writing-tests, build) are never rewritten or reported.\n\nOrphan detection (--check) only covers header-carrying outputs: every markdown\ntarget file gets a generated-by comment, but .mcp.json and .cursor/mcp.json are\nJSON with no comment syntax, so they can never be flagged as orphaned; missing\nand content drift still apply to them.\n'
+    '\nTargets come from .outerlayer/config.json only; there is no --target flag.\nMissing or empty config: {"targets": [...]}, e.g. {"targets": ["claude-code"]}.\nKnown targets: claude-code, cursor, codex, copilot, factory.\n\nThe maintained skills (outerlayer-evidence, outerlayer-amend, outerlayer-findings,\nouterlayer-cli, outerlayer-build) follow this CLI: emit rewrites one that differs from its bundle, and --check\nreports it as drift. A copy under an earlier name (amend, emitting-evidence,\nreporting-findings, outerlayer) is deleted, and --check reports it as retired.\nTemplates (spec, writing-specs, writing-tests, build) are never rewritten or reported.\n\nOrphan detection (--check) only covers header-carrying outputs: every markdown\ntarget file gets a generated-by comment, but .mcp.json and .cursor/mcp.json are\nJSON with no comment syntax, so they can never be flagged as orphaned; missing\nand content drift still apply to them.\n'
   ).action(async (opts) => {
     await compileContext({ dir: opts.dir, check: opts.check, json: opts.json });
   });