@outerlayer/cli 0.22.1 → 0.23.0

package/dist/{cli-U253V422.js → cli-44WGGICQ.js}

@@ -1,36 +1,36 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-ORNJJ7XN.js';
-import './chunk-VSUXCMMH.js';
-import { verifiedTrackerNames, TRACKERS } from './chunk-BET347JZ.js';
-import './chunk-QOALB6ZD.js';
-import './chunk-JRCSET55.js';
-import './chunk-G3IJ3N6F.js';
-import './chunk-EAQSOE62.js';
-import './chunk-F35VMF5M.js';
-import './chunk-USWVXQIH.js';
-import './chunk-QF7WZUU6.js';
-import './chunk-NTRCK4NH.js';
-import { hookFiredMarkerPath, installedCliDistDir } from './chunk-QC72I5GQ.js';
+import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-FX6IHR5C.js';
+import './chunk-XFGL53GU.js';
+import './chunk-VJBFQP3H.js';
+import { verifiedTrackerNames, TRACKERS } from './chunk-C64D7HR3.js';
+import './chunk-ZLZ3XVPI.js';
+import './chunk-GXV73IIS.js';
+import './chunk-BUP5N3X6.js';
+import './chunk-XSPA5ODY.js';
+import './chunk-GOSFARMS.js';
+import './chunk-MQ743JX3.js';
+import './chunk-QS43O4DR.js';
+import { hookFiredMarkerPath, installedCliDistDir } from './chunk-XOEV4FVK.js';
 import './chunk-ZJSNLVCE.js';
-import './chunk-IZSVXRDR.js';
+import './chunk-DXDF43YG.js';
 import './chunk-BKO6JEZI.js';
 import './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
-import './chunk-AEKSX4EY.js';
-import './chunk-DIB2WLBL.js';
-import './chunk-EABW6AJQ.js';
-import './chunk-V7SAQ645.js';
-import './chunk-5OCIHFGE.js';
+import './chunk-CBCKD6DO.js';
+import './chunk-YVZJ6GKF.js';
 import { C, warnDeprecated, API_KEY_FLAG_DEPRECATION, NO_COLOR_FLAG, stripNoColor } from './chunk-ANPNT6PM.js';
+import './chunk-EABW6AJQ.js';
+import { FIRST_VERSION_READING_AGENTS_SKILLS } from './chunk-JKNYTNYD.js';
+import './chunk-HBISTTG3.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { cliInvocation, packageRunnerOf } from './chunk-CRB3POP4.js';
-import { settingsPath, readSettings, SettingsParseError, listHookCandidates, wrapHooks, writeSettings, unwrapHooks, REGISTERED_EVENTS, cliCommand, removeHooks, removeStatusline, cliBinResolvable, mergeHooks, repointWrappedHooks, AUTO_WRAP_EVENTS, mergeStatusline } from './chunk-5QRP3MVS.js';
-import './chunk-W3SWJ2TD.js';
+import { settingsPath, readSettings, SettingsParseError, listHookCandidates, wrapHooks, writeSettings, unwrapHooks, REGISTERED_EVENTS, cliCommand, removeHooks, removeStatusline, cliBinResolvable, mergeHooks, repointWrappedHooks, AUTO_WRAP_EVENTS, mergeStatusline } from './chunk-GNPTU4BM.js';
+import './chunk-VWFOKRYS.js';
 import { cloneIsGoverned } from './chunk-YQR6E6OV.js';
 import { removeJournalHooks, removePreCommitGuardHook } from './chunk-TUSYOL2O.js';
-import './chunk-WFSUUUAN.js';
-import './chunk-7VUK5RFS.js';
+import './chunk-RKOTJQVG.js';
+import './chunk-QZBXLLTV.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
 import './chunk-OW52QLK3.js';
@@ -3651,14 +3651,17 @@ function apiKeyOption() {
   return new Option("--api-key <key>", `deprecated: use \`${cliInvocation()} login\` or OUTERLAYER_API_KEY`).hideHelp();
 }
 async function installStarterPackInRepo() {
-  const { installStarterPack, formatStarterPackOutput } = await import('./starter-pack-5EQYGSJF.js');
+  const { installStarterPack, formatStarterPackOutput } = await import('./starter-pack-55EFILC5.js');
   const cwd = process.cwd();
   let repoRoot = cwd;
   try {
     repoRoot = execFileSync("git", ["rev-parse", "--show-toplevel"], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || cwd;
   } catch {
   }
-  const result = installStarterPack({ repoRoot });
+  const { declareAgentsMdLayout, isAgentsMdLayout, skillsBaseFor } = await import('./layout-UOJQGEPW.js');
+  const fresh = !isAgentsMdLayout(repoRoot) && !existsSync(join(repoRoot, ".outerlayer"));
+  const result = installStarterPack({ repoRoot, base: fresh ? ".agents/skills" : skillsBaseFor(repoRoot) });
+  if (fresh) declareAgentsMdLayout(repoRoot);
   return { result, output: formatStarterPackOutput(result) };
 }
 function formatInitOutput(result, opts = {}) {
@@ -3781,8 +3784,8 @@ ${starter.output}`),
   }
 }
 async function realConnectDepsForCwd() {
-  const { realConnectDeps } = await import('./connect-cmd-ZFOK6HEL.js');
-  const { resolveRepoIdentity } = await import('./dist-7IH56ELA.js');
+  const { realConnectDeps } = await import('./connect-cmd-6DUTUK63.js');
+  const { resolveRepoIdentity } = await import('./dist-SOH3O24Y.js');
   return {
     ...realConnectDeps(),
     home: homeFromEnv(),
@@ -3800,7 +3803,7 @@ function buildProgram(argv = process.argv) {
   program2.name(cliInvocation()).description("OuterLayer \u2014 see what your coding agents actually do").enablePositionalOptions().version(resolveVersion()).hook("preAction", (_root, command) => {
     if (command.opts().apiKey !== void 0) warnDeprecated(API_KEY_FLAG_DEPRECATION);
   }).option(NO_COLOR_FLAG, "disable color (NO_COLOR=1 does the same)").addHelpText("after", SUPPORT_TEXT);
-  program2.command("init").description("Connect this repository, install hooks and agent skills, run doctor").option("--user", "install into user settings [default]").option("--project", "install into project settings (./.claude/settings.json)").option("--org", "print a managed-settings.json snippet for MDM/GPO rollout").option("--remove", "uninstall OuterLayer hooks").option("--local", "install the hooks only: no connect step and no network call").option("--factory <org/factory>", `the factory to connect this repository to (see \`${cliInvocation()} connect\`)`).option("--gitignore", "also add .outerlayer/ to .gitignore (project scope)").option("--template <name>", "install the starter skills and a policy file (only: default)").option("--update", "update the files init wrote that you have not edited, and write missing ones").option("--dry-run", "with --update: print the plan and write nothing").option("--no-wrap-hooks", "leave PreToolUse/PostToolUse hooks unwrapped").option("--statusline", "install the status-line segment [default]").option("--no-statusline", "leave the statusLine slot untouched").option("--shell-function", "make plain claude run `outerlayer claude` (edits ~/.zshrc or ~/.bashrc)").option("--no-shell-function", "do not set up the shell function, and remove it if it is there").option("--json", "machine-readable JSON output").addHelpText(
+  program2.command("init").description("Connect this repository, install hooks and agent skills, run doctor").option("--user", "install into user settings [default]").option("--project", "install into project settings (./.claude/settings.json)").option("--org", "print a managed-settings.json snippet for MDM/GPO rollout").option("--remove", "uninstall OuterLayer hooks").option("--local", "install the hooks only: no connect step and no network call").option("--factory <org/factory>", `the factory to connect this repository to (see \`${cliInvocation()} connect\`)`).option("--gitignore", "also add .outerlayer/ to .gitignore (project scope)").option("--template <name>", "install the starter skills and a policy file (only: default)").option("--update", "update the files init wrote that you have not edited, and write missing ones").option("--dry-run", "with --update: print the plan and write nothing").option("--no-skills-link", "do not link .claude/skills to .agents/skills").option("--control-plane", "with --update: this is a control plane; older CLIs keep .claude/skills/").option("--no-wrap-hooks", "leave PreToolUse/PostToolUse hooks unwrapped").option("--statusline", "install the status-line segment [default]").option("--no-statusline", "leave the statusLine slot untouched").option("--shell-function", "make plain claude run `outerlayer claude` (edits ~/.zshrc or ~/.bashrc)").option("--no-shell-function", "do not set up the shell function, and remove it if it is there").option("--json", "machine-readable JSON output").addHelpText(
     "after",
     `
 In a repository, init runs four steps: connect the repository to a
@@ -3811,20 +3814,20 @@ login it skips the connect step and says to run \`${cliInvocation()} login\`. Wi
 skipped or failed. The exit code is 1 when a step failed.
 
 The agent setup step installs the starter skills and the \`outerlayer\` skill
-into .outerlayer/skills/, writes .outerlayer/config.json for Claude Code when
-there is none, runs \`${cliInvocation()} context emit\` so the skills appear in
-.claude/skills/, and adds the outerlayer and outerlayer-docs MCP servers to
-.mcp.json. Nothing you wrote is changed: an existing config, policy, edited
-skill, MCP entry or root CLAUDE.md and AGENTS.md is left as it is, and a
-hand-written file the emit would replace is kept and listed. The files are
-left uncommitted.
+into .agents/skills/, writes AGENTS.md when there is no AGENTS.md or
+CLAUDE.md, writes .outerlayer/config.json with "layout": 2 when there is
+none, links .claude/skills to ../.agents/skills, and adds the outerlayer and
+outerlayer-docs MCP servers to .mcp.json. Nothing is generated, so nothing
+needs \`` + cliInvocation() + ` context emit\`. --no-skills-link leaves out the link.
+Nothing you wrote is changed. A repository still in the earlier layout keeps
+its files in .outerlayer/ and is compiled as before until --update moves it.
+The files are left uncommitted.
 The step is skipped outside a git repository and in a repository whose
 context comes from a control plane, where it arrives at session start.
 
 --local installs only the hooks: no connect step, no agent setup and no
 network call. Add \`--template default\` to also write the starter skills and
-a policy file into .outerlayer/ without compiling them; \`${cliInvocation()} context
-emit\` does that.
+a policy file, with nothing to compile.
 
 Idempotent: settings are backed up before any write, and a second run
 changes nothing. Wrapping adds one spawn per hook firing; undo it with
@@ -3832,26 +3835,29 @@ changes nothing. Wrapping adds one spawn per hook firing; undo it with
 replaced.
 
 Three of the starter skills are copied once and are yours to edit. The
-others are rewritten from this CLI on every \`context emit\`.
+others are rewritten from this CLI by \`init --update\`, or by \`context emit\`
+in a repository that has not moved.
 
---update brings the files init wrote once up to this CLI's version: the
-template skills, the policy, the two starter checks and the two MCP
-entries. A file still equal to a version an earlier release wrote is
-replaced, and a missing one is written. A file you edited is never
-touched. It then runs \`${cliInvocation()} context emit\` and leaves the changes
+--update first moves a repository in the earlier layout to AGENTS.md,
+.agents/skills/ and .mcp.json: it removes each file that holds exactly what
+\`` + cliInvocation() + ` context emit\` writes, moves the sources, links .claude/skills
+and sets "layout": 2. A file you edited is kept and listed. It then brings
+the files init wrote once up to this CLI's version: the template skills, the
+policy, the two starter checks and the two MCP entries. A file still equal
+to a version an earlier release wrote is replaced, and a missing one is
+written. A file you edited is never touched. The changes are left
 uncommitted. --dry-run prints the plan, with a command to compare each
-edited file, and writes nothing. \`${cliInvocation()} doctor\` reports the same
-states under Starter files.
-`
+edited file, and writes nothing. --control-plane makes no link and says
+what CLIs older than ${FIRST_VERSION_READING_AGENTS_SKILLS} do. \`` + cliInvocation() + " doctor` reports the same\nstates under Starter files.\n"
   ).action(async (opts) => {
     if (opts.update || opts.dryRun) {
-      const { runInitUpdate, formatInitUpdate, updateFlagProblem } = await import('./init-update-YFPIQS5G.js');
+      const { runInitUpdate, formatInitUpdate, updateFlagProblem } = await import('./init-update-UZIJ2FMU.js');
       const problem = updateFlagProblem(opts);
       if (problem !== void 0) {
         fail(problem);
         return;
       }
-      const result = runInitUpdate({ cwd: process.cwd(), dryRun: opts.dryRun === true });
+      const result = runInitUpdate({ cwd: process.cwd(), dryRun: opts.dryRun === true, skillsLink: opts.skillsLink !== false, controlPlane: opts.controlPlane === true });
       if (opts.json) writeJson(result);
       else process.stdout.write(formatInitUpdate(result));
       if (result.status === "failed") process.exitCode = 1;
@@ -3859,7 +3865,7 @@ states under Starter files.
     }
     let starterTemplate;
     if (opts.template !== void 0) {
-      const { assertKnownTemplate, StarterPackError } = await import('./starter-pack-5EQYGSJF.js');
+      const { assertKnownTemplate, StarterPackError } = await import('./starter-pack-55EFILC5.js');
       try {
         assertKnownTemplate(opts.template);
       } catch (err) {
@@ -3892,12 +3898,12 @@ states under Starter files.
         if (changed.length > 0 && !opts.json) process.stdout.write(`Removed the claude function from ${changed.join(", ")}.
 `);
       }
-      const shell = !opts.remove && opts.shellFunction !== void 0 ? (await import('./init-cmd-W5VV62ZN.js')).applyShellFunctionFlag(opts.shellFunction, { home: homeFromEnv(), shellPath: process.env.SHELL }) : void 0;
+      const shell = !opts.remove && opts.shellFunction !== void 0 ? (await import('./init-cmd-VPFIDY64.js')).applyShellFunctionFlag(opts.shellFunction, { home: homeFromEnv(), shellPath: process.env.SHELL }) : void 0;
       if (opts.json) writeJson(shell === void 0 ? outcome.result : { ...outcome.result, shellFunction: { outcome: shell.outcome, reason: shell.reason } });
       else process.stdout.write(outcome.text + (shell?.text ?? ""));
       return;
     }
-    const { runInitCommand } = await import('./init-cmd-W5VV62ZN.js');
+    const { runInitCommand } = await import('./init-cmd-VPFIDY64.js');
     const code = await runInitCommand(
       { json: opts.json, factory: opts.factory, shellFunction: opts.shellFunction },
       {
@@ -3909,8 +3915,8 @@ states under Starter files.
           return { ok, text, detail };
         },
         runAgentSetup: async () => {
-          const { runAgentSetup } = await import('./agent-setup-LTSLXPS3.js');
-          return runAgentSetup({ cwd: process.cwd() });
+          const { runAgentSetup } = await import('./agent-setup-SNDCEHG2.js');
+          return runAgentSetup({ cwd: process.cwd(), skillsLink: opts.skillsLink !== false });
         },
         runDoctorChecks: gatherDoctorChecks,
         shell: {
@@ -3918,7 +3924,7 @@ states under Starter files.
           shellPath: process.env.SHELL,
           interactive: Boolean(process.stdin.isTTY && process.stderr.isTTY) && opts.json !== true,
           ask: async () => {
-            const { promptOnTerminal } = await import('./connect-cmd-ZFOK6HEL.js');
+            const { promptOnTerminal } = await import('./connect-cmd-6DUTUK63.js');
             const answer = await promptOnTerminal({
               message: `Should plain claude start Claude Code through ${cliInvocation()} claude? That is how a session in a governed repository gets its control plane. It adds one block to your zsh or bash startup file.`,
               options: [
@@ -3957,7 +3963,7 @@ linked (true, false, or null when it could not be checked) and, when false,
 linkUrl.
 `
   ).action(async (opts) => {
-    const { runConnectCommand } = await import('./connect-cmd-ZFOK6HEL.js');
+    const { runConnectCommand } = await import('./connect-cmd-6DUTUK63.js');
     const code = await runConnectCommand({ factory: opts.factory, json: opts.json }, await realConnectDepsForCwd(), {
       stdout: process.stdout,
       stderr: process.stderr
@@ -3996,7 +4002,7 @@ Every later command reads the saved file, so none of them needs a key on
 its command line. A saved key is checked for real on the first \`sync\`.
 `
   ).action(async (opts) => {
-    const { runLoginCommand, realLoginDeps } = await import('./login-browser-BN5UKPHS.js');
+    const { runLoginCommand, realLoginDeps } = await import('./login-browser-4OMZFP3U.js');
     const code = await runLoginCommand(
       {
         browser: opts.browser !== false,
@@ -4020,7 +4026,7 @@ dashboard cannot be reached the local copy is still deleted and the exit
 code is 1: revoke the token on /profile/security.
 `
   ).action(async () => {
-    const { runLogoutCommand, realLogoutDeps } = await import('./logout-cmd-RZFWTNYD.js');
+    const { runLogoutCommand, realLogoutDeps } = await import('./logout-cmd-5V5MMBSY.js');
     const code = await runLogoutCommand(realLogoutDeps());
     if (code !== 0) process.exitCode = code;
   });
@@ -4029,13 +4035,13 @@ code is 1: revoke the token on /profile/security.
     "\nIncremental: only sessions newer than the last checkpoint ship. The tier\nis applied on this machine before anything leaves it; `--dry-run` prints\nexactly what would. The hook-triggered background sync runs `--quiet`.\nExit 2 means the server rejected at least one session.\n"
   ).action(async (opts) => {
     if (opts.link !== void 0) {
-      const { lookupArtifactLink } = await import('./artifact-link-cmd-OWRI5AJX.js');
+      const { lookupArtifactLink } = await import('./artifact-link-cmd-LEI6EOZE.js');
       const found = lookupArtifactLink(opts.link);
       if (found.ok) process.stdout.write(found.url + "\n");
       else fail(found.reason);
       return;
     }
-    const { runSync, SyncConfigError, SyncTransportError } = await import('./sync-cmd-W2FPY3T5.js');
+    const { runSync, SyncConfigError, SyncTransportError } = await import('./sync-cmd-NSVXOYFJ.js');
     try {
       const result = await runSync({
         url: opts.url,
@@ -4066,7 +4072,7 @@ code is 1: revoke the token on /profile/security.
     if (invokedCommandToken(argv) === "watch") {
       warnDeprecated(`\`${cliInvocation()} watch\` is now \`${cliInvocation()} daemon\`; the old name will be removed in a future release.`);
     }
-    const { runWatch } = await import('./watch-WLH5ZUZU.js');
+    const { runWatch } = await import('./watch-NQVZWPBJ.js');
     await runWatch({ once: opts.once });
   });
   program2.command("hook <event>", { hidden: true }).description("capture-hook fast path, installed by `init`").action(() => {
@@ -4156,7 +4162,7 @@ code is 1: revoke the token on /profile/security.
     process.exitCode = await runBuildCommand({ dir: opts.dir, argv: command });
   });
   program2.command("session-sender", { hidden: true }).description("stream a runner build's sessions to its work item while the build runs").action(async () => {
-    const { runSessionSender } = await import('./session-sender-BK6TGNVO.js');
+    const { runSessionSender } = await import('./session-sender-EKKZ5DEU.js');
     try {
       await runSessionSender();
     } catch (err) {
@@ -4164,7 +4170,7 @@ code is 1: revoke the token on /profile/security.
     }
   });
   program2.command("vm-init", { hidden: true }).description("lay out a microVM build's guest; the guest helper runs it").action(async () => {
-    const { realGuestHost, runGuestInit } = await import('./guest-init-DF7V5D2R.js');
+    const { realGuestHost, runGuestInit } = await import('./guest-init-HWSE7W6L.js');
     const { readFileSync: readFileSync3 } = await import('fs');
     try {
       runGuestInit(realGuestHost(), readFileSync3("/proc/cmdline", "utf8"));
@@ -4172,6 +4178,14 @@ code is 1: revoke the token on /profile/security.
       fail(`vm-init failed: ${err instanceof Error ? err.message : String(err)}`);
     }
   });
+  program2.command("vm-forward", { hidden: true }).description("pipe a guest port to another; vm-init runs it").requiredOption("--listen <host:port>", "the address to listen on").requiredOption("--to <host:port>", "the address to pipe each connection to").action(async (opts) => {
+    const { startBridgeForward } = await import('./bridge-QFN3KJP6.js');
+    try {
+      await startBridgeForward(opts);
+    } catch (err) {
+      fail(`vm-forward failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  });
   registerEmitCommands(program2);
   registerImportCommands(program2);
   registerHooksCommands(program2);
@@ -4192,7 +4206,7 @@ async function runCli(processArgv) {
   await buildProgram(argv).parseAsync(argv);
 }
 async function compileContext(opts) {
-  const { runEmit, EmitError } = await import('./emit-cmd-3W5IO5ET.js');
+  const { runEmit, EmitError } = await import('./emit-cmd-WQH2NK7H.js');
   try {
     const result = runEmit({ cwd: opts.dir, check: opts.check, json: opts.json });
     if (result.exitCode !== 0) process.exitCode = result.exitCode;
@@ -4239,7 +4253,7 @@ Compiling .outerlayer/ moved to \`${cliInvocation()} context emit\`.
       await compileContext({ dir: opts.dir, check: opts.check, json: opts.json });
       return;
     }
-    const { runEmitResult, EmitResultError } = await import('./emit-result-cmd-JHEUFTPX.js');
+    const { runEmitResult, EmitResultError } = await import('./emit-result-cmd-WPKG5YAS.js');
     try {
       const result = await runEmitResult({
         name,
@@ -4289,7 +4303,7 @@ everywhere, bytes and deep link untouched; a still-queued one is cancelled
 locally so it never uploads. One correction can retire several duplicates.
 `
   ).action(async (file, opts) => {
-    const { runEmitArtifact, EmitArtifactError } = await import('./emit-artifact-cmd-YLZ5WLSF.js');
+    const { runEmitArtifact, EmitArtifactError } = await import('./emit-artifact-cmd-XCZ3ALLV.js');
     let pr;
     if (opts.pr !== void 0) {
       pr = parseTrackerNumber(opts.pr);
@@ -4348,7 +4362,7 @@ recent events with their ids. --find <text> searches all of them.
 item that session was launched for is used automatically.
 `
   ).action(async (opts) => {
-    const { runEmitFinding, refuseRemovedFindingFlags, EmitFindingError } = await import('./emit-finding-cmd-S3YMFTZT.js');
+    const { runEmitFinding, refuseRemovedFindingFlags, EmitFindingError } = await import('./emit-finding-cmd-ILIDRMYN.js');
     try {
       refuseRemovedFindingFlags(opts);
       const result = await runEmitFinding({
@@ -4415,7 +4429,7 @@ the whole batch. "untimed": true records one with no time on purpose.
 that session was launched for is used automatically.
 `
   ).action(async (file, opts) => {
-    const { runEmitFindings, EmitFindingError } = await import('./emit-finding-cmd-S3YMFTZT.js');
+    const { runEmitFindings, EmitFindingError } = await import('./emit-finding-cmd-ILIDRMYN.js');
     try {
       const result = await runEmitFindings({
         file,
@@ -4450,7 +4464,7 @@ command, the command exits 0, and \`sync\` sends it later. If the gateway refuse
 the step, the command prints why and exits 1.
 `
   ).action(async (name, opts) => {
-    const { runEmitStep, EmitStepError } = await import('./emit-step-cmd-TUI2T3DS.js');
+    const { runEmitStep, EmitStepError } = await import('./emit-step-cmd-OVMLQSL6.js');
     try {
       await runEmitStep({
         name,
@@ -4493,7 +4507,7 @@ of the item, and a (proof: <kind>) annotation names its proof.
   ${cliInvocation()} emit criteria acceptance/412-login.md --item 412
 `
   ).action(async (file, opts) => {
-    const { runEmitCriteria, EmitCriteriaError } = await import('./emit-criteria-cmd-MF6TVE7C.js');
+    const { runEmitCriteria, EmitCriteriaError } = await import('./emit-criteria-cmd-JE72JHKJ.js');
     try {
       const result = await runEmitCriteria({
         file,
@@ -4517,9 +4531,9 @@ function registerSpecCommands(program2) {
   const specCmd = program2.command("spec").description("Find, file and edit the issue a spec lives in, in your factory's tracker");
   const credentialOptions = (command) => command.option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)");
   const run = async (action) => {
-    const { WorkCommandError } = await import('./work-cmd-KWHAYUYB.js');
+    const { WorkCommandError } = await import('./work-cmd-FMPDXPU6.js');
     try {
-      await action(await import('./spec-cmd-ZNJ3GXWC.js'));
+      await action(await import('./spec-cmd-JDHGNFVJ.js'));
     } catch (err) {
       if (err instanceof WorkCommandError) {
         fail(err.message);
@@ -4561,7 +4575,7 @@ takes it, and prints the line that starts your session on it. That
 session links itself and holds the item's lease while it works.
 `
   ).action(async (opts) => {
-    const { runWorkBuild, WorkCommandError } = await import('./work-cmd-KWHAYUYB.js');
+    const { runWorkBuild, WorkCommandError } = await import('./work-cmd-FMPDXPU6.js');
     try {
       await runWorkBuild(opts);
     } catch (err) {
@@ -4584,7 +4598,7 @@ renews that session's own 20-minute lease, unless --no-lease or
 --ended is given, or another worker already holds a live one.
 `
   ).action(async (number, opts) => {
-    const { runWorkLinkSession, WorkCommandError } = await import('./work-cmd-KWHAYUYB.js');
+    const { runWorkLinkSession, WorkCommandError } = await import('./work-cmd-FMPDXPU6.js');
     try {
       await runWorkLinkSession({ ...opts, number, noLease: opts.lease === false, logFailures: opts.logFailures === true });
     } catch (err) {
@@ -4608,8 +4622,8 @@ criterion's new proof; --ready hands the thread back to a person. At
 most one action flag may be given.
 `
   ).action(async (opts) => {
-    const { runWorkComment, WorkCommentCommandError } = await import('./work-comment-cmd-4CUI7ZDE.js');
-    const { WorkCommandError } = await import('./work-cmd-KWHAYUYB.js');
+    const { runWorkComment, WorkCommentCommandError } = await import('./work-comment-cmd-ZVUE2IUN.js');
+    const { WorkCommandError } = await import('./work-cmd-FMPDXPU6.js');
     try {
       await runWorkComment(opts);
     } catch (err) {
@@ -4630,8 +4644,8 @@ criterion that carries proof or a comment, each with who is waiting
 on whom next.
 `
   ).action(async (opts) => {
-    const { runWorkThreads, WorkCommentCommandError } = await import('./work-comment-cmd-4CUI7ZDE.js');
-    const { WorkCommandError } = await import('./work-cmd-KWHAYUYB.js');
+    const { runWorkThreads, WorkCommentCommandError } = await import('./work-comment-cmd-ZVUE2IUN.js');
+    const { WorkCommandError } = await import('./work-cmd-FMPDXPU6.js');
     try {
       await runWorkThreads(opts);
     } catch (err) {
@@ -4655,8 +4669,8 @@ still running, or that an older runner released, has no log and the
 command exits 1.
 `
   ).action(async (opts) => {
-    const { runWorkLogs, WorkLogsCommandError } = await import('./work-logs-cmd-AF253WLM.js');
-    const { WorkCommandError } = await import('./work-cmd-KWHAYUYB.js');
+    const { runWorkLogs, WorkLogsCommandError } = await import('./work-logs-cmd-CQH2SYT4.js');
+    const { WorkCommandError } = await import('./work-cmd-FMPDXPU6.js');
     try {
       await runWorkLogs(opts);
     } catch (err) {
@@ -4679,8 +4693,8 @@ item is not built again until a new build request. Exits 1 when no host
 build is running for the item.
 `
   ).action(async (opts) => {
-    const { runWorkStop, WorkStopCommandError } = await import('./work-stop-cmd-FIEKUDGE.js');
-    const { WorkCommandError } = await import('./work-cmd-KWHAYUYB.js');
+    const { runWorkStop, WorkStopCommandError } = await import('./work-stop-cmd-LGWSBSBT.js');
+    const { WorkCommandError } = await import('./work-cmd-FMPDXPU6.js');
     try {
       await runWorkStop(opts);
     } catch (err) {
@@ -4701,7 +4715,7 @@ deletes anything \u2014 the item is removed from Work only once no
 live addition remains on it.
 `
   ).action(async (opts) => {
-    const { runWorkRemove, WorkCommandError } = await import('./work-cmd-KWHAYUYB.js');
+    const { runWorkRemove, WorkCommandError } = await import('./work-cmd-FMPDXPU6.js');
     try {
       await runWorkRemove(opts);
     } catch (err) {
@@ -4713,7 +4727,7 @@ live addition remains on it.
     }
   });
   workCmd.command("status").description("Show one item's stage, gate ledger, and additions").option("--item <number>", "the item's number inside this factory").option("--issue <number>", "issue number, or a Linear/Jira key like ENG-123").option(TRACKER_OPTION_FLAG, "tracker for a keyed --issue, when both hold the key").option("--repo <owner/name>", "repository for an issue number (default: the checkout's remote)").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").action(async (opts) => {
-    const { runWorkStatus, WorkCommandError } = await import('./work-cmd-KWHAYUYB.js');
+    const { runWorkStatus, WorkCommandError } = await import('./work-cmd-FMPDXPU6.js');
     try {
       await runWorkStatus(opts);
     } catch (err) {
@@ -4725,7 +4739,7 @@ live addition remains on it.
     }
   });
   workCmd.command("list").description("List live work items for this factory").option("--stage <spec|build|review>", "filter by stage").option("--section <attention|waiting|flowing>", "filter by Queue section").option("--repo <owner/name>", "repository (default: the current checkout's remote)").option("--unclaimed", "only items with no live lease").option("--claimed", "only items with a live lease, held by a host or a local session").option("--startable", "only items a host can start: a build request, no open PR, no live lease").option("--needs <amend>", "only items with a thread waiting on an agent").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").action(async (opts) => {
-    const { runWorkList, WorkCommandError } = await import('./work-cmd-KWHAYUYB.js');
+    const { runWorkList, WorkCommandError } = await import('./work-cmd-FMPDXPU6.js');
     try {
       await runWorkList(opts);
     } catch (err) {
@@ -4746,7 +4760,7 @@ by a different key is refused; claiming again with the same key extends
 it. --host is a label only.
 `
   ).action(async (opts) => {
-    const { runWorkClaim, WorkCommandError } = await import('./work-claim-cmd-4PLDTEZR.js');
+    const { runWorkClaim, WorkCommandError } = await import('./work-claim-cmd-FPJXQAXP.js');
     try {
       await runWorkClaim(opts);
     } catch (err) {
@@ -4766,7 +4780,7 @@ Extends the live lease this API key holds. Refused with a 410 if the
 lease has expired, or a 403 if a different key holds it.
 `
   ).action(async (opts) => {
-    const { runWorkRenew, WorkCommandError } = await import('./work-claim-cmd-4PLDTEZR.js');
+    const { runWorkRenew, WorkCommandError } = await import('./work-claim-cmd-FPJXQAXP.js');
     try {
       await runWorkRenew(opts);
     } catch (err) {
@@ -4798,7 +4812,7 @@ applies to a host's lease only. A later tool call in the session
 takes the lease again.
 `
   ).action(async (opts) => {
-    const { runWorkRelease, WorkCommandError } = await import('./work-claim-cmd-4PLDTEZR.js');
+    const { runWorkRelease, WorkCommandError } = await import('./work-claim-cmd-FPJXQAXP.js');
     try {
       await runWorkRelease(opts);
     } catch (err) {
@@ -4825,7 +4839,7 @@ Idempotent: declaring the same pull request twice is a no-op.
 needs your own login; an agent session or a factory key is refused.
 `
   ).action(async (number, opts) => {
-    const { runWorkPr, WorkPrCommandError } = await import('./work-pr-cmd-V5G4CPMG.js');
+    const { runWorkPr, WorkPrCommandError } = await import('./work-pr-cmd-EHFTEVJO.js');
     try {
       await runWorkPr({ ...opts, number });
     } catch (err) {
@@ -4850,8 +4864,8 @@ login, then declares the pull request on the item, as \`work pr\` does.
 Run it again after a change to the title or description.
 `
   ).action(async (opts) => {
-    const { runWorkOpenPr, WorkOpenPrCommandError } = await import('./work-open-pr-cmd-JETE6HRL.js');
-    const { WorkCommandError } = await import('./work-cmd-KWHAYUYB.js');
+    const { runWorkOpenPr, WorkOpenPrCommandError } = await import('./work-open-pr-cmd-YY2OGJOI.js');
+    const { WorkCommandError } = await import('./work-cmd-FMPDXPU6.js');
     try {
       await runWorkOpenPr(opts);
     } catch (err) {
@@ -4868,7 +4882,7 @@ function registerRunnerCommands(program2) {
   const configOption = "the cloud config file to run against (default: ~/.outerlayer/config.json)";
   runnerCmd.command("start").description("Run the loop: claim work, run it, report, clean up, repeat").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-H4QS332G.js');
-    const { start, RunnerStartError } = await import('./loop-6WENRS5S.js');
+    const { start, RunnerStartError } = await import('./loop-JPW2QJ64.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-G2J5WBQS.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     try {
@@ -4884,7 +4898,7 @@ function registerRunnerCommands(program2) {
   });
   runnerCmd.command("check").description("Validate the config, the hooks and the key, and print the effective settings").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-H4QS332G.js');
-    const { runRunnerCheck } = await import('./check-UYKEMQNR.js');
+    const { runRunnerCheck } = await import('./check-3CGLWMHM.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const result = await runRunnerCheck(configPath);
     if (!result.ok) {
@@ -4913,7 +4927,7 @@ function registerRunnerCommands(program2) {
     }
     try {
       if (opts.service === true) {
-        const { installServiceCommand } = await import('./command-IQTPFSXY.js');
+        const { installServiceCommand } = await import('./command-4FAP2D3P.js');
         const result2 = await installServiceCommand({
           configPath,
           print: opts.print,
@@ -4969,7 +4983,7 @@ To keep it running, run ${C.yellow}${cliInvocation()} runner install --service${
       return;
     }
     const { defaultRunnerConfigPath } = await import('./config-H4QS332G.js');
-    const { uninstallServiceCommand } = await import('./command-IQTPFSXY.js');
+    const { uninstallServiceCommand } = await import('./command-4FAP2D3P.js');
     const result = await uninstallServiceCommand({ configPath: opts.config ?? defaultRunnerConfigPath(), unitName: opts.unitName, home: homeFromEnv() });
     if (result.ok) for (const line of result.lines) process.stdout.write(`${C.green}\u2713${C.reset} ${line}
 `);
@@ -4997,10 +5011,10 @@ already in runner.env is used.
 `
   ).action(async (opts) => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-H4QS332G.js');
-    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-VZE72CR4.js');
-    const { obtainRunnerKey, runnerKeyLogin } = await import('./runner-key-QT7GKGEE.js');
-    const { detectMachine } = await import('./machine-M4MQBV5A.js');
-    const { chooseVm, runVmInit, VmInitError } = await import('./init-ZZZPYGUH.js');
+    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-WQ62BXDN.js');
+    const { obtainRunnerKey, runnerKeyLogin } = await import('./runner-key-BPP5XRYR.js');
+    const { detectMachine } = await import('./machine-PGDRWPI2.js');
+    const { chooseVm, runVmInit, VmInitError } = await import('./init-HAAHIQFN.js');
     const { AGENT_COMMANDS, credentialFromStdin, isAgentName, restartForCredential, RunnerEnvError } = await import('./runner-env-GZHXM27A.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     if (opts.agent !== void 0 && !isAgentName(opts.agent)) {
@@ -5015,7 +5029,7 @@ already in runner.env is used.
     try {
       let credential;
       if (agent !== void 0) {
-        const { readPipedKey } = await import('./login-browser-BN5UKPHS.js');
+        const { readPipedKey } = await import('./login-browser-4OMZFP3U.js');
         credential = credentialFromStdin(
           await readPipedKey(process.stdin, {
             onWaiting: () => process.stderr.write(`runner init is waiting for Claude's credential on stdin; close stdin to use the one already in runner.env
@@ -5151,7 +5165,7 @@ ${C.yellow}The runner will not update itself: ${installErr.message}${C.reset}
       let serviceUp = false;
       let restart;
       if (installedLayout) {
-        const { installServiceCommand } = await import('./command-IQTPFSXY.js');
+        const { installServiceCommand } = await import('./command-4FAP2D3P.js');
         const service = await installServiceCommand({
           configPath,
           entryPath: process.argv[1] ?? "",
@@ -5196,10 +5210,10 @@ Next:
     "\nA repository governed by a control plane builds the control plane's image, at the commit\nthe gateway has stored for it. A repository that governs itself fetches the head of its\ndefault branch into the runner's cache. Either way it reads .devcontainer/devcontainer.json\nand builds the image with the devcontainer CLI. Settings\nthat reach the host or widen the container's privileges are ignored and listed. The\nimage holds this CLI and a pinned Claude Code. Nothing runs inside the image.\n"
   ).action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-H4QS332G.js');
-    const { buildRepositoryImage, RecipeError } = await import('./build-6WRNZPVR.js');
+    const { buildRepositoryImage, RecipeError } = await import('./build-WHHFA7KM.js');
     const { currentCliBuild } = await import('./cli-build-K56DK4DS.js');
-    const { createDockerHost } = await import('./docker-JU422JL7.js');
-    const { builderSpec } = await import('./builder-G3MLDMTI.js');
+    const { createDockerHost } = await import('./docker-KMK4LOET.js');
+    const { builderSpec } = await import('./builder-7FBQAWQZ.js');
     const { loadRunnerConfig } = await import('./config-H4QS332G.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const loaded = (() => {
@@ -5211,11 +5225,11 @@ Next:
     })();
     const memory = loaded?.build?.memory ?? "8g";
     try {
-      const { ensureRunnerIdentity } = await import('./runner-identity-FTHZFMGY.js');
+      const { ensureRunnerIdentity } = await import('./runner-identity-IIZ3RK7M.js');
       await ensureRunnerIdentity(configPath, { log: (line) => console.error(line) }).catch((err) => {
         console.error(`the runner's Docker identity could not be stored: ${err instanceof Error ? err.message : String(err)}`);
       });
-      const { imageTargetFor } = await import('./governing-source-XSEIRSBE.js');
+      const { imageTargetFor } = await import('./governing-source-EQBKPME7.js');
       const target = await imageTargetFor({ config: loaded, repository: opts.repository, fetchImpl: fetch });
       if (!target.ok) {
         if (opts.json) {
@@ -5279,15 +5293,15 @@ Next:
   });
   runnerCmd.command("stop").description("Take no more work; wait for running jobs to finish, then exit").option("--config <path>", "the cloud config file naming the runner to stop").option("--now", "end running jobs immediately, with outcome stopped").action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-H4QS332G.js');
-    const { requestStop } = await import('./loop-6WENRS5S.js');
+    const { requestStop } = await import('./loop-JPW2QJ64.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     await requestStop(configPath, Boolean(opts.now));
   });
   runnerCmd.command("status").description("List running jobs; with --recent, finished ones too").option("--config <path>", "the cloud config file naming the runner to inspect").option("--recent", "also list finished jobs, newest first, capped at 20").option("--json", "machine-readable JSON output").action(async (opts) => {
     const { defaultRunnerConfigPath, loadRunnerConfig } = await import('./config-H4QS332G.js');
     const { jobsDir, runnerDir } = await import('./paths-AKX2OOLF.js');
-    const { listJobFiles, runnerProcessState } = await import('./loop-6WENRS5S.js');
-    const { renderStatus } = await import('./status-JOO7MGIC.js');
+    const { listJobFiles, runnerProcessState } = await import('./loop-JPW2QJ64.js');
+    const { renderStatus } = await import('./status-UCQDEMFX.js');
     const { readHousekeepingRecord } = await import('./record-Q4IEYIVV.js');
     const path2 = await import('path');
     const configPath = opts.config ?? defaultRunnerConfigPath();
@@ -5343,7 +5357,7 @@ Next:
   });
   runnerCmd.command("logs").argument("<item>", "the work item's number in the factory").description("Print the newest attempt's log for one item").option("--config <path>", "the cloud config file naming the runner to inspect").option("-f, --follow", "keep printing as the log grows").action(async (itemArg, opts) => {
     const { defaultRunnerConfigPath } = await import('./config-H4QS332G.js');
-    const { listJobFiles } = await import('./loop-6WENRS5S.js');
+    const { listJobFiles } = await import('./loop-JPW2QJ64.js');
     const { newestAttempt, logPathFor, tail, RunnerLogsError } = await import('./logs-N3ZX7HFV.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const item = parseTrackerNumber(itemArg);
@@ -5570,7 +5584,7 @@ Self-host deployments also need --app-id: without a key service to resolve the
 caller from the bearer token, the gateway answers 401 without that header.
 `
   ).action(async (opts) => {
-    const { runMcpInstall, handleMcpInstallError, McpInstallError } = await import('./mcp-install-cmd-GD4QUP7Z.js');
+    const { runMcpInstall, handleMcpInstallError, McpInstallError } = await import('./mcp-install-cmd-GGWB3JJ2.js');
     try {
       if (opts.transport !== void 0 && opts.transport !== "stdio" && opts.transport !== "http") {
         throw new McpInstallError(`--transport must be "stdio" or "http", got "${opts.transport}"`);
@@ -5592,7 +5606,7 @@ caller from the bearer token, the gateway answers 401 without that header.
     "after",
     "\nWhat the stdio .mcp.json entry spawns. Reads newline-delimited JSON-RPC 2.0 on\nstdin and writes responses on stdout. The API key comes from OUTERLAYER_API_KEY\nor ~/.outerlayer/config.json at start-up; with neither the command exits 1 and\nprints why, which the MCP client shows as the connect error.\n"
   ).action(async (opts) => {
-    const { runMcpServe, handleMcpServeError } = await import('./mcp-serve-cmd-SBW7HYKD.js');
+    const { runMcpServe, handleMcpServeError } = await import('./mcp-serve-cmd-CNRC5AL5.js');
     try {
       await runMcpServe({ url: opts.url, appId: opts.appId });
     } catch (err) {
@@ -5603,7 +5617,7 @@ caller from the bearer token, the gateway answers 401 without that header.
 function registerImportCommands(program2) {
   const importCmd = program2.command("import").description("Import an existing config format into .outerlayer/");
   importCmd.command("ruler").description("Port a .ruler/ tree into the equivalent .outerlayer/ tree").option("--dir <path>", "repo root to read from (default: cwd)").option("--json", "machine-readable JSON output").addHelpText("after", "\nRuler: https://github.com/intellectronica/ruler. Mostly a rename.\n").action(async (opts) => {
-    const { runImportRuler, ImportRulerError } = await import('./import-ruler-cmd-T6LLO6Q7.js');
+    const { runImportRuler, ImportRulerError } = await import('./import-ruler-cmd-VJOHOJQ7.js');
     try {
       const result = runImportRuler({ cwd: opts.dir, json: opts.json });
       if (result.exitCode !== 0) process.exitCode = result.exitCode;
@@ -5619,7 +5633,7 @@ function registerImportCommands(program2) {
     "after",
     "\nInstalls the five maintained skills (outerlayer-evidence, outerlayer-amend,\nouterlayer-findings, outerlayer-cli, outerlayer-build) and an AGENTS.md snippet teaching agents to run\n`emit artifact`. A skill that differs from this CLI's bundle is rewritten to it, and the output says so.\n"
   ).action(async (opts) => {
-    const { runImportCapture, ImportCaptureError } = await import('./import-capture-cmd-Q56DDZVO.js');
+    const { runImportCapture, ImportCaptureError } = await import('./import-capture-cmd-TCOKNVBM.js');
     try {
       runImportCapture({ cwd: opts.dir, json: opts.json });
     } catch (err) {