@outerlayer/cli 0.27.1 → 0.28.2

package/dist/{cli-GHEOBXC7.js → cli-SCTKM2Y5.js}

@@ -1,29 +1,36 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-LPFOWUHG.js';
-import './chunk-P33PZIWS.js';
-import './chunk-XZ6Q6ZNR.js';
-import { verifiedTrackerNames, TRACKERS } from './chunk-55GNQPO6.js';
-import './chunk-2F762IXY.js';
-import './chunk-N4D5TMVU.js';
+import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-25X2PJDI.js';
+import './chunk-ITAIEJ2T.js';
+import './chunk-QBQHQEUG.js';
+import './chunk-KT4CN6OU.js';
+import './chunk-SATUCMAJ.js';
+import { verifiedTrackerNames, TRACKERS } from './chunk-X52PMPOM.js';
+import './chunk-LNIFYSNK.js';
+import './chunk-VU7ZJPIR.js';
 import './chunk-BUP5N3X6.js';
-import { FIRST_VERSION_READING_AGENTS_SKILLS } from './chunk-LOKSLO25.js';
-import './chunk-6BLXUD56.js';
+import './chunk-UHU7H57K.js';
+import { FIRST_VERSION_READING_AGENTS_SKILLS } from './chunk-5B7BEQPR.js';
+import './chunk-HOU33DW5.js';
 import './chunk-G2JWZDFA.js';
-import './chunk-MHX7YX7Y.js';
-import './chunk-BWH36FOC.js';
-import { hookFiredMarkerPath, installedCliDistDir } from './chunk-DJHNEGNM.js';
+import { C, warnDeprecated, API_KEY_FLAG_DEPRECATION, NO_COLOR_FLAG, stripNoColor } from './chunk-ANPNT6PM.js';
+import './chunk-P2RWZCV7.js';
+import './chunk-7CK2TJFB.js';
+import './chunk-PJDQPF5N.js';
+import './chunk-YL2VDSNF.js';
+import './chunk-5K3KB4YR.js';
+import './chunk-HXAEQPZR.js';
+import { hookFiredMarkerPath, installedCliDistDir } from './chunk-DKWQMPSL.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-I7RZHMXW.js';
 import './chunk-BKO6JEZI.js';
 import './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
-import './chunk-IMOB4IOI.js';
-import './chunk-7OUOLGUV.js';
-import './chunk-QE3UQAHK.js';
-import './chunk-KT4CN6OU.js';
-import { C, warnDeprecated, API_KEY_FLAG_DEPRECATION, NO_COLOR_FLAG, stripNoColor } from './chunk-ANPNT6PM.js';
-import './chunk-PJDQPF5N.js';
+import './chunk-DQYMQ47E.js';
+import './chunk-JGML2VUN.js';
+import './chunk-5BHIBJDA.js';
+import './chunk-CDDED64E.js';
+import { resolveVersion, resolvePackageVersion } from './chunk-RA3O54FC.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { cliInvocation, packageRunnerOf } from './chunk-CRB3POP4.js';
 import { settingsPath, readSettings, SettingsParseError, listHookCandidates, PORTABLE_BIN, wrapHooks, writeSettings, unwrapHooks, REGISTERED_EVENTS, removeHooks, removeStatusline, cliBinResolvable, mergeHooks, repointWrappedHooks, AUTO_WRAP_EVENTS, mergeStatusline } from './chunk-URIZRCRY.js';
@@ -33,10 +40,7 @@ import { removeJournalHooks, removePreCommitGuardHook } from './chunk-TUSYOL2O.j
 import './chunk-RKOTJQVG.js';
 import './chunk-QZBXLLTV.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import { resolveVersion } from './chunk-RA3O54FC.js';
-import './chunk-Y4OKEFAX.js';
-import './chunk-RHAGBUL5.js';
-import './chunk-2I3LIRZP.js';
+import './chunk-XD4ZCMA4.js';
 import './chunk-JGD5TWQ2.js';
 import './chunk-Z5GEFMRW.js';
 import { EventEmitter } from 'events';
@@ -3654,14 +3658,14 @@ function apiKeyOption() {
   return new Option("--api-key <key>", `deprecated: use \`${cliInvocation()} login\` or OUTERLAYER_API_KEY`).hideHelp();
 }
 async function installStarterPackInRepo() {
-  const { installStarterPack, formatStarterPackOutput } = await import('./starter-pack-GPU4X6B7.js');
+  const { installStarterPack, formatStarterPackOutput } = await import('./starter-pack-5SOT5V4I.js');
   const cwd = process.cwd();
   let repoRoot = cwd;
   try {
     repoRoot = execFileSync("git", ["rev-parse", "--show-toplevel"], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || cwd;
   } catch {
   }
-  const { declareAgentsMdLayout, isAgentsMdLayout, skillsBaseFor } = await import('./layout-XNFDTOET.js');
+  const { declareAgentsMdLayout, isAgentsMdLayout, skillsBaseFor } = await import('./layout-BBTQPS6V.js');
   const fresh = !isAgentsMdLayout(repoRoot) && !existsSync(join(repoRoot, ".outerlayer"));
   const result = installStarterPack({ repoRoot, base: fresh ? ".agents/skills" : skillsBaseFor(repoRoot) });
   if (fresh) declareAgentsMdLayout(repoRoot);
@@ -3787,7 +3791,7 @@ ${starter.output}`),
   }
 }
 async function installMachineSkillsForSetup() {
-  const { setupMachineSkills } = await import('./machine-skills-FLIRJYP7.js');
+  const { setupMachineSkills } = await import('./machine-skills-O7W6NMWB.js');
   const result = setupMachineSkills(homeFromEnv());
   for (const failure of result.failures) process.stderr.write(`${C.yellow}!${C.reset} Could not write a maintained skill: ${failure}
 `);
@@ -3795,8 +3799,8 @@ async function installMachineSkillsForSetup() {
 ` : "";
 }
 async function realConnectDepsForCwd() {
-  const { realConnectDeps } = await import('./connect-cmd-HGS7YPA2.js');
-  const { resolveRepoIdentity } = await import('./dist-QPHZE47F.js');
+  const { realConnectDeps } = await import('./connect-cmd-5TYAOK5M.js');
+  const { resolveRepoIdentity } = await import('./dist-JFVKLUHL.js');
   return {
     ...realConnectDeps(),
     home: homeFromEnv(),
@@ -3813,10 +3817,21 @@ function buildProgram(argv = process.argv) {
   const program2 = new Command();
   program2.name(cliInvocation()).description("OuterLayer \u2014 see what your coding agents actually do").enablePositionalOptions().version(resolveVersion()).hook("preAction", async (_root, command) => {
     if (command.opts().apiKey !== void 0) warnDeprecated(API_KEY_FLAG_DEPRECATION);
-    const { machineRefreshSkipped, refreshMachineSkills } = await import('./machine-skills-FLIRJYP7.js');
+    const { machineRefreshSkipped, refreshMachineSkills } = await import('./machine-skills-O7W6NMWB.js');
     const names = [];
     for (let at = command; at?.parent; at = at.parent) names.push(at.name());
     if (!machineRefreshSkipped(names, command._hidden === true, argv)) refreshMachineSkills(homeFromEnv());
+  }).hook("postAction", async (_root, command) => {
+    const notice = await import('./cli-update-notice-4DLZ3655.js');
+    let top;
+    for (let at = command; at.parent; at = at.parent) top = at.name();
+    const json = command.opts().json === true || argv.includes("--json");
+    if (notice.updateNoticeSkipped(top, command._hidden === true, argv)) return;
+    if (!notice.isCommandInTerminal({ isTTY: process.stderr.isTTY === true, json, env: process.env }) || notice.updateNoticeSuppressed(process.env)) return;
+    const running = resolvePackageVersion();
+    const recorded = notice.newerRecordedVersion(homeFromEnv(), running);
+    if (recorded !== void 0) process.stderr.write(`${notice.updateNoticeLine(recorded, running)}
+`);
   }).option(NO_COLOR_FLAG, "disable color (NO_COLOR=1 does the same)").addHelpText("after", SUPPORT_TEXT);
   program2.command("init").description("Connect this repository, install hooks and agent skills, run doctor").option("--user", "install into user settings [default]").option("--project", "install into project settings (./.claude/settings.json)").option("--org", "print a managed-settings.json snippet for MDM/GPO rollout").option("--remove", "uninstall OuterLayer hooks").option("--local", "install the hooks only: no connect step and no network call").option("--factory <org/factory>", `the factory to connect this repository to (see \`${cliInvocation()} connect\`)`).option("--gitignore", "also add .outerlayer/ to .gitignore (project scope)").option("--template <name>", "install the starter skills and a policy file (only: default)").option("--update", "update the files init wrote that you have not edited, and write missing ones").option("--dry-run", "with --update: print the plan and write nothing").option("--no-skills-link", "do not link .claude/skills to .agents/skills").option("--control-plane", "with --update: this is a control plane; older CLIs keep .claude/skills/").option("--no-wrap-hooks", "leave PreToolUse/PostToolUse hooks unwrapped").option("--statusline", "install the status-line segment [default]").option("--no-statusline", "leave the statusLine slot untouched").option("--shell-function", "make plain claude run `outerlayer claude` (edits ~/.zshrc or ~/.bashrc)").option("--no-shell-function", "do not set up the shell function, and remove it if it is there").option("--json", "machine-readable JSON output").addHelpText(
     "after",
@@ -3851,19 +3866,25 @@ repository that has not moved keeps copies that \`context emit\` rewrites.
 --update first moves a repository in the earlier layout to AGENTS.md,
 .agents/skills/ and .mcp.json: it removes each file that holds exactly what
 \`` + cliInvocation() + ' context emit` writes, moves the sources, links .claude/skills\nand sets "layout": 2. A file you edited is kept and listed. It then brings\nthe files init wrote once up to this CLI\'s version: the template skills, the\npolicy, the two starter checks and the two MCP entries. A file still equal\nto a version an earlier release wrote is replaced, and a missing one is\nwritten. A file you edited is never touched. The changes are left\nuncommitted. --dry-run prints the plan, with a command to compare each\nedited file, and writes nothing. In the AGENTS.md layout, --update also removes\neach maintained skill folder whose SKILL.md carries the "maintained by\nOuterLayer" line, from .agents/skills/ and from a .claude/skills that is a\nfolder. It says that every machine and runner host must run this CLI version\nor later, and each machine a person works on must run `' + cliInvocation() + ` init --local\`,
-before you commit the removal. In an edited build, it changes only the line
-that names ../outerlayer-build/SKILL.md, to ~/.agents/skills/outerlayer-build/SKILL.md.
+before you commit the removal, and with a login it names each runner host that
+runs an older CLI. Once the folders are gone, it changes each path to one of
+them in AGENTS.md, CLAUDE.md and the skills to ~/.agents/skills/: in an edited
+build, ../outerlayer-build/SKILL.md becomes ~/.agents/skills/outerlayer-build/SKILL.md.
 --control-plane makes no link and says
 what CLIs older than ${FIRST_VERSION_READING_AGENTS_SKILLS} do. \`` + cliInvocation() + " doctor` reports the same\nstates under Starter files.\n"
   ).action(async (opts) => {
     if (opts.update || opts.dryRun) {
-      const { runInitUpdate, formatInitUpdate, updateFlagProblem } = await import('./init-update-ECWNG47R.js');
+      const { runInitUpdateWithFleet, formatInitUpdate, updateFlagProblem } = await import('./init-update-RWTQSTPE.js');
+      const { fleetReadiness } = await import('./fleet-readiness-G5X3MKP2.js');
       const problem = updateFlagProblem(opts);
       if (problem !== void 0) {
         fail(problem);
         return;
       }
-      const result = runInitUpdate({ cwd: process.cwd(), dryRun: opts.dryRun === true, skillsLink: opts.skillsLink !== false, controlPlane: opts.controlPlane === true });
+      const result = await runInitUpdateWithFleet(
+        { cwd: process.cwd(), dryRun: opts.dryRun === true, skillsLink: opts.skillsLink !== false, controlPlane: opts.controlPlane === true },
+        fleetReadiness
+      );
       if (opts.json) writeJson(result);
       else process.stdout.write(formatInitUpdate(result));
       if (result.status === "failed") process.exitCode = 1;
@@ -3871,7 +3892,7 @@ what CLIs older than ${FIRST_VERSION_READING_AGENTS_SKILLS} do. \`` + cliInvocat
     }
     let starterTemplate;
     if (opts.template !== void 0) {
-      const { assertKnownTemplate, StarterPackError } = await import('./starter-pack-GPU4X6B7.js');
+      const { assertKnownTemplate, StarterPackError } = await import('./starter-pack-5SOT5V4I.js');
       try {
         assertKnownTemplate(opts.template);
       } catch (err) {
@@ -3905,13 +3926,13 @@ what CLIs older than ${FIRST_VERSION_READING_AGENTS_SKILLS} do. \`` + cliInvocat
         if (changed.length > 0 && !opts.json) process.stdout.write(`Removed the claude function from ${changed.join(", ")}.
 `);
       }
-      const shell = !opts.remove && opts.shellFunction !== void 0 ? (await import('./init-cmd-RIDBVSE4.js')).applyShellFunctionFlag(opts.shellFunction, { home: homeFromEnv(), shellPath: process.env.SHELL }) : void 0;
+      const shell = !opts.remove && opts.shellFunction !== void 0 ? (await import('./init-cmd-L4VW3ZCT.js')).applyShellFunctionFlag(opts.shellFunction, { home: homeFromEnv(), shellPath: process.env.SHELL }) : void 0;
       if (opts.json) writeJson(shell === void 0 ? outcome.result : { ...outcome.result, shellFunction: { outcome: shell.outcome, reason: shell.reason } });
       else process.stdout.write(outcome.text + skillsLine + (shell?.text ?? ""));
       return;
     }
     await installMachineSkillsForSetup();
-    const { runInitCommand } = await import('./init-cmd-RIDBVSE4.js');
+    const { runInitCommand } = await import('./init-cmd-L4VW3ZCT.js');
     const code = await runInitCommand(
       { json: opts.json, factory: opts.factory, shellFunction: opts.shellFunction },
       {
@@ -3923,7 +3944,7 @@ what CLIs older than ${FIRST_VERSION_READING_AGENTS_SKILLS} do. \`` + cliInvocat
           return { ok, text, detail };
         },
         runAgentSetup: async () => {
-          const { runAgentSetup } = await import('./agent-setup-UW36TAQM.js');
+          const { runAgentSetup } = await import('./agent-setup-YVR5RO56.js');
           return runAgentSetup({ cwd: process.cwd(), skillsLink: opts.skillsLink !== false });
         },
         runDoctorChecks: gatherDoctorChecks,
@@ -3932,7 +3953,7 @@ what CLIs older than ${FIRST_VERSION_READING_AGENTS_SKILLS} do. \`` + cliInvocat
           shellPath: process.env.SHELL,
           interactive: Boolean(process.stdin.isTTY && process.stderr.isTTY) && opts.json !== true,
           ask: async () => {
-            const { promptOnTerminal } = await import('./connect-cmd-HGS7YPA2.js');
+            const { promptOnTerminal } = await import('./connect-cmd-5TYAOK5M.js');
             const answer = await promptOnTerminal({
               message: `Should plain claude start Claude Code through ${cliInvocation()} claude? That is how a session in a governed repository gets its control plane. It adds one block to your zsh or bash startup file.`,
               options: [
@@ -3971,7 +3992,7 @@ linked (true, false, or null when it could not be checked) and, when false,
 linkUrl.
 `
   ).action(async (opts) => {
-    const { runConnectCommand } = await import('./connect-cmd-HGS7YPA2.js');
+    const { runConnectCommand } = await import('./connect-cmd-5TYAOK5M.js');
     const code = await runConnectCommand({ factory: opts.factory, json: opts.json }, await realConnectDepsForCwd(), {
       stdout: process.stdout,
       stderr: process.stderr
@@ -4010,7 +4031,7 @@ Every later command reads the saved file, so none of them needs a key on
 its command line. A saved key is checked for real on the first \`sync\`.
 `
   ).action(async (opts) => {
-    const { runLoginCommand, realLoginDeps } = await import('./login-browser-EWXSGHM7.js');
+    const { runLoginCommand, realLoginDeps } = await import('./login-browser-WSOSQH2T.js');
     const code = await runLoginCommand(
       {
         browser: opts.browser !== false,
@@ -4049,7 +4070,7 @@ code is 1: revoke the token on /profile/security.
       else fail(found.reason);
       return;
     }
-    const { runSync, SyncConfigError, SyncTransportError } = await import('./sync-cmd-ATXJVS7S.js');
+    const { runSync, SyncConfigError, SyncTransportError } = await import('./sync-cmd-N4R7ST6X.js');
     try {
       const result = await runSync({
         url: opts.url,
@@ -4080,7 +4101,7 @@ code is 1: revoke the token on /profile/security.
     if (invokedCommandToken(argv) === "watch") {
       warnDeprecated(`\`${cliInvocation()} watch\` is now \`${cliInvocation()} daemon\`; the old name will be removed in a future release.`);
     }
-    const { runWatch } = await import('./watch-M7NR3DOW.js');
+    const { runWatch } = await import('./watch-L5MSAWEO.js');
     await runWatch({ once: opts.once });
   });
   program2.command("hook <event>", { hidden: true }).description("capture-hook fast path, installed by `init`").action(() => {
@@ -4092,7 +4113,7 @@ code is 1: revoke the token on /profile/security.
   program2.command("claude [args...]").description("start Claude Code with the repository's control plane attached").allowUnknownOption().helpOption(false).action(() => {
   });
   const brokerRelay = program2.command("broker-relay", { hidden: true }).description("relay a build's loopback connections to the runner's tunnel and destinations").enablePositionalOptions().option("--port <port>", "the loopback port to listen on").option("--socket <path>", "the runner's tunnel socket").option("--join <path>", "the socket the runner's joining process connects to").option("--lease-watchdog", "exit when the runner's lease expiry passes; needs --join").option("--forward <port=target>", "also relay a loopback port to a destination; repeatable", (value, previous) => [...previous, value], []).action(async (opts) => {
-    const { startRelay, startSessionRelay } = await import('./relay-GFPPD6GF.js');
+    const { startRelay, startSessionRelay } = await import('./relay-FJ5K37Z5.js');
     const { TARGET_TUNNEL, targetOfPath } = await import('./relay-protocol-HELO5SNH.js');
     const port = Number(opts.port);
     if (!Number.isInteger(port) || port < 1 || port > 65535) {
@@ -4125,7 +4146,7 @@ code is 1: revoke the token on /profile/security.
     await startRelay({ port, socketPath: opts.socket, forwards: forwards.map((forward) => ({ port: forward.port, socketPath: forward.spec })) });
   });
   brokerRelay.command("join").description("carry the runner's session to the relay over standard input and output").option("--socket <path>", "the relay's joining socket", "/run/outerlayer-relay/join.sock").action(async (opts) => {
-    const { joinRelay } = await import('./relay-GFPPD6GF.js');
+    const { joinRelay } = await import('./relay-FJ5K37Z5.js');
     try {
       await joinRelay({ socketPath: opts.socket, input: process.stdin, output: process.stdout });
     } catch (err) {
@@ -4141,7 +4162,7 @@ code is 1: revoke the token on /profile/security.
     }
   });
   program2.command("vm-exec", { hidden: true }).description("run a command in a microVM build's guest through its exec agent").requiredOption("--socket <path>", "the Unix socket Firecracker serves the build's vsock device on").option("--user <user>", "the user to run as", "").option("--cwd <dir>", "the working directory", "/").option("--env <NAME=value>", "an environment value the command line carries; repeatable", (value, previous) => [...previous, value], []).option("--pass <NAME>", "an environment variable whose value is read from this process; repeatable", (value, previous) => [...previous, value], []).argument("<argv...>", "the command and its arguments").action(async (argv2, opts) => {
-    const { runVmExec } = await import('./exec-client-6WVS7DRZ.js');
+    const { runVmExec } = await import('./exec-client-VKT2XNB3.js');
     const env = {};
     for (const entry of opts.env) {
       const eq = entry.indexOf("=");
@@ -4170,7 +4191,7 @@ code is 1: revoke the token on /profile/security.
     process.exitCode = await runBuildCommand({ dir: opts.dir, argv: command });
   });
   program2.command("session-sender", { hidden: true }).description("stream a runner build's sessions to its work item while the build runs").action(async () => {
-    const { runSessionSender } = await import('./session-sender-SC5PSU2G.js');
+    const { runSessionSender } = await import('./session-sender-UQ3VF732.js');
     try {
       await runSessionSender();
     } catch (err) {
@@ -4178,7 +4199,7 @@ code is 1: revoke the token on /profile/security.
     }
   });
   program2.command("vm-init", { hidden: true }).description("lay out a microVM build's guest; the guest helper runs it").action(async () => {
-    const { realGuestHost, runGuestInit } = await import('./guest-init-H5K2RW3P.js');
+    const { realGuestHost, runGuestInit } = await import('./guest-init-QW2DPX7H.js');
     const { readFileSync: readFileSync3 } = await import('fs');
     try {
       runGuestInit(realGuestHost(), readFileSync3("/proc/cmdline", "utf8"));
@@ -4187,7 +4208,7 @@ code is 1: revoke the token on /profile/security.
     }
   });
   program2.command("vm-forward", { hidden: true }).description("pipe a guest port to another; vm-init runs it").requiredOption("--listen <host:port>", "the address to listen on").requiredOption("--to <host:port>", "the address to pipe each connection to").action(async (opts) => {
-    const { startBridgeForward } = await import('./bridge-B5VJVECY.js');
+    const { startBridgeForward } = await import('./bridge-WW2V7DTB.js');
     try {
       await startBridgeForward(opts);
     } catch (err) {
@@ -4213,7 +4234,7 @@ async function runCli(processArgv) {
   await buildProgram(argv).parseAsync(argv);
 }
 async function compileContext(opts) {
-  const { runEmit, EmitError } = await import('./emit-cmd-VAQHRWJR.js');
+  const { runEmit, EmitError } = await import('./emit-cmd-QUABLVO6.js');
   try {
     const result = runEmit({ cwd: opts.dir, check: opts.check, json: opts.json });
     if (result.exitCode !== 0) process.exitCode = result.exitCode;
@@ -4260,7 +4281,7 @@ Compiling .outerlayer/ moved to \`${cliInvocation()} context emit\`.
       await compileContext({ dir: opts.dir, check: opts.check, json: opts.json });
       return;
     }
-    const { runEmitResult, EmitResultError } = await import('./emit-result-cmd-KUSL56RI.js');
+    const { runEmitResult, EmitResultError } = await import('./emit-result-cmd-TKA3GAN7.js');
     try {
       const result = await runEmitResult({
         name,
@@ -4310,7 +4331,7 @@ everywhere, bytes and deep link untouched; a still-queued one is cancelled
 locally so it never uploads. One correction can retire several duplicates.
 `
   ).action(async (file, opts) => {
-    const { runEmitArtifact, EmitArtifactError } = await import('./emit-artifact-cmd-ALDK55Y2.js');
+    const { runEmitArtifact, EmitArtifactError } = await import('./emit-artifact-cmd-SOXLBPQB.js');
     let pr;
     if (opts.pr !== void 0) {
       pr = parseTrackerNumber(opts.pr);
@@ -4369,7 +4390,7 @@ recent events with their ids. --find <text> searches all of them.
 item that session was launched for is used automatically.
 `
   ).action(async (opts) => {
-    const { runEmitFinding, refuseRemovedFindingFlags, EmitFindingError } = await import('./emit-finding-cmd-2NBAPDSV.js');
+    const { runEmitFinding, refuseRemovedFindingFlags, EmitFindingError } = await import('./emit-finding-cmd-VCQPCLI2.js');
     try {
       refuseRemovedFindingFlags(opts);
       const result = await runEmitFinding({
@@ -4436,7 +4457,7 @@ the whole batch. "untimed": true records one with no time on purpose.
 that session was launched for is used automatically.
 `
   ).action(async (file, opts) => {
-    const { runEmitFindings, EmitFindingError } = await import('./emit-finding-cmd-2NBAPDSV.js');
+    const { runEmitFindings, EmitFindingError } = await import('./emit-finding-cmd-VCQPCLI2.js');
     try {
       const result = await runEmitFindings({
         file,
@@ -4471,7 +4492,7 @@ command, the command exits 0, and \`sync\` sends it later. If the gateway refuse
 the step, the command prints why and exits 1.
 `
   ).action(async (name, opts) => {
-    const { runEmitStep, EmitStepError } = await import('./emit-step-cmd-KD4AKEAT.js');
+    const { runEmitStep, EmitStepError } = await import('./emit-step-cmd-XN44BXYU.js');
     try {
       await runEmitStep({
         name,
@@ -4514,7 +4535,7 @@ of the item, and a (proof: <kind>) annotation names its proof.
   ${cliInvocation()} emit criteria acceptance/412-login.md --item 412
 `
   ).action(async (file, opts) => {
-    const { runEmitCriteria, EmitCriteriaError } = await import('./emit-criteria-cmd-Q7SM6VP2.js');
+    const { runEmitCriteria, EmitCriteriaError } = await import('./emit-criteria-cmd-JDO2VUG5.js');
     try {
       const result = await runEmitCriteria({
         file,
@@ -4538,9 +4559,9 @@ function registerSpecCommands(program2) {
   const specCmd = program2.command("spec").description("Find, file and edit the issue a spec lives in, in your factory's tracker");
   const credentialOptions = (command) => command.option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)");
   const run = async (action) => {
-    const { WorkCommandError } = await import('./work-cmd-VECTYST6.js');
+    const { WorkCommandError } = await import('./work-cmd-COESFSHE.js');
     try {
-      await action(await import('./spec-cmd-JGYHHJ4P.js'));
+      await action(await import('./spec-cmd-Z6MGATWC.js'));
     } catch (err) {
       if (err instanceof WorkCommandError) {
         fail(err.message);
@@ -4582,7 +4603,7 @@ takes it, and prints the line that starts your session on it. That
 session links itself and holds the item's lease while it works.
 `
   ).action(async (opts) => {
-    const { runWorkBuild, WorkCommandError } = await import('./work-cmd-VECTYST6.js');
+    const { runWorkBuild, WorkCommandError } = await import('./work-cmd-COESFSHE.js');
     try {
       await runWorkBuild(opts);
     } catch (err) {
@@ -4605,7 +4626,7 @@ renews that session's own 20-minute lease, unless --no-lease or
 --ended is given, or another worker already holds a live one.
 `
   ).action(async (number, opts) => {
-    const { runWorkLinkSession, WorkCommandError } = await import('./work-cmd-VECTYST6.js');
+    const { runWorkLinkSession, WorkCommandError } = await import('./work-cmd-COESFSHE.js');
     try {
       await runWorkLinkSession({ ...opts, number, noLease: opts.lease === false, logFailures: opts.logFailures === true });
     } catch (err) {
@@ -4629,8 +4650,8 @@ criterion's new proof; --ready hands the thread back to a person. At
 most one action flag may be given.
 `
   ).action(async (opts) => {
-    const { runWorkComment, WorkCommentCommandError } = await import('./work-comment-cmd-F3NRWKPZ.js');
-    const { WorkCommandError } = await import('./work-cmd-VECTYST6.js');
+    const { runWorkComment, WorkCommentCommandError } = await import('./work-comment-cmd-A4ZUVCSA.js');
+    const { WorkCommandError } = await import('./work-cmd-COESFSHE.js');
     try {
       await runWorkComment(opts);
     } catch (err) {
@@ -4651,8 +4672,8 @@ criterion that carries proof or a comment, each with who is waiting
 on whom next.
 `
   ).action(async (opts) => {
-    const { runWorkThreads, WorkCommentCommandError } = await import('./work-comment-cmd-F3NRWKPZ.js');
-    const { WorkCommandError } = await import('./work-cmd-VECTYST6.js');
+    const { runWorkThreads, WorkCommentCommandError } = await import('./work-comment-cmd-A4ZUVCSA.js');
+    const { WorkCommandError } = await import('./work-cmd-COESFSHE.js');
     try {
       await runWorkThreads(opts);
     } catch (err) {
@@ -4676,8 +4697,8 @@ still running, or that an older runner released, has no log and the
 command exits 1.
 `
   ).action(async (opts) => {
-    const { runWorkLogs, WorkLogsCommandError } = await import('./work-logs-cmd-QF6P32FE.js');
-    const { WorkCommandError } = await import('./work-cmd-VECTYST6.js');
+    const { runWorkLogs, WorkLogsCommandError } = await import('./work-logs-cmd-CTF43MBE.js');
+    const { WorkCommandError } = await import('./work-cmd-COESFSHE.js');
     try {
       await runWorkLogs(opts);
     } catch (err) {
@@ -4700,8 +4721,8 @@ item is not built again until a new build request. Exits 1 when no host
 build is running for the item.
 `
   ).action(async (opts) => {
-    const { runWorkStop, WorkStopCommandError } = await import('./work-stop-cmd-C3F5HNUO.js');
-    const { WorkCommandError } = await import('./work-cmd-VECTYST6.js');
+    const { runWorkStop, WorkStopCommandError } = await import('./work-stop-cmd-NIHAN45R.js');
+    const { WorkCommandError } = await import('./work-cmd-COESFSHE.js');
     try {
       await runWorkStop(opts);
     } catch (err) {
@@ -4722,7 +4743,7 @@ deletes anything \u2014 the item is removed from Work only once no
 live addition remains on it.
 `
   ).action(async (opts) => {
-    const { runWorkRemove, WorkCommandError } = await import('./work-cmd-VECTYST6.js');
+    const { runWorkRemove, WorkCommandError } = await import('./work-cmd-COESFSHE.js');
     try {
       await runWorkRemove(opts);
     } catch (err) {
@@ -4734,7 +4755,7 @@ live addition remains on it.
     }
   });
   workCmd.command("status").description("Show one item's stage, gate ledger, and additions").option("--item <number>", "the item's number inside this factory").option("--issue <number>", "issue number, or a Linear/Jira key like ENG-123").option(TRACKER_OPTION_FLAG, "tracker for a keyed --issue, when both hold the key").option("--repo <owner/name>", "repository for an issue number (default: the checkout's remote)").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").action(async (opts) => {
-    const { runWorkStatus, WorkCommandError } = await import('./work-cmd-VECTYST6.js');
+    const { runWorkStatus, WorkCommandError } = await import('./work-cmd-COESFSHE.js');
     try {
       await runWorkStatus(opts);
     } catch (err) {
@@ -4746,7 +4767,7 @@ live addition remains on it.
     }
   });
   workCmd.command("list").description("List live work items for this factory").option("--stage <spec|build|review>", "filter by stage").option("--section <attention|waiting|flowing>", "filter by Queue section").option("--repo <owner/name>", "repository (default: the current checkout's remote)").option("--unclaimed", "only items with no live lease").option("--claimed", "only items with a live lease, held by a host or a local session").option("--startable", "only items a host can start: a build request, no open PR, no live lease").option("--needs <amend>", "only items with a thread waiting on an agent").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").action(async (opts) => {
-    const { runWorkList, WorkCommandError } = await import('./work-cmd-VECTYST6.js');
+    const { runWorkList, WorkCommandError } = await import('./work-cmd-COESFSHE.js');
     try {
       await runWorkList(opts);
     } catch (err) {
@@ -4767,7 +4788,7 @@ by a different key is refused; claiming again with the same key extends
 it. --host is a label only.
 `
   ).action(async (opts) => {
-    const { runWorkClaim, WorkCommandError } = await import('./work-claim-cmd-DNUDZKJA.js');
+    const { runWorkClaim, WorkCommandError } = await import('./work-claim-cmd-CXALMILD.js');
     try {
       await runWorkClaim(opts);
     } catch (err) {
@@ -4787,7 +4808,7 @@ Extends the live lease this API key holds. Refused with a 410 if the
 lease has expired, or a 403 if a different key holds it.
 `
   ).action(async (opts) => {
-    const { runWorkRenew, WorkCommandError } = await import('./work-claim-cmd-DNUDZKJA.js');
+    const { runWorkRenew, WorkCommandError } = await import('./work-claim-cmd-CXALMILD.js');
     try {
       await runWorkRenew(opts);
     } catch (err) {
@@ -4819,7 +4840,7 @@ applies to a host's lease only. A later tool call in the session
 takes the lease again.
 `
   ).action(async (opts) => {
-    const { runWorkRelease, WorkCommandError } = await import('./work-claim-cmd-DNUDZKJA.js');
+    const { runWorkRelease, WorkCommandError } = await import('./work-claim-cmd-CXALMILD.js');
     try {
       await runWorkRelease(opts);
     } catch (err) {
@@ -4846,7 +4867,7 @@ Idempotent: declaring the same pull request twice is a no-op.
 needs your own login; an agent session or a factory key is refused.
 `
   ).action(async (number, opts) => {
-    const { runWorkPr, WorkPrCommandError } = await import('./work-pr-cmd-BH56GUKN.js');
+    const { runWorkPr, WorkPrCommandError } = await import('./work-pr-cmd-FEXMS6RH.js');
     try {
       await runWorkPr({ ...opts, number });
     } catch (err) {
@@ -4871,8 +4892,8 @@ login, then declares the pull request on the item, as \`work pr\` does.
 Run it again after a change to the title or description.
 `
   ).action(async (opts) => {
-    const { runWorkOpenPr, WorkOpenPrCommandError } = await import('./work-open-pr-cmd-XE23JA3R.js');
-    const { WorkCommandError } = await import('./work-cmd-VECTYST6.js');
+    const { runWorkOpenPr, WorkOpenPrCommandError } = await import('./work-open-pr-cmd-EMGYJXVD.js');
+    const { WorkCommandError } = await import('./work-cmd-COESFSHE.js');
     try {
       await runWorkOpenPr(opts);
     } catch (err) {
@@ -4888,12 +4909,12 @@ function registerRunnerCommands(program2) {
   const runnerCmd = program2.command("runner").description("Take work from the implement and amend queues on this machine");
   const configOption = "the cloud config file to run against (default: ~/.outerlayer/config.json)";
   runnerCmd.command("start").description("Run the loop: claim work, run it, report, clean up, repeat").option("--config <path>", configOption).action(async (opts) => {
-    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-TWS5VZEN.js');
-    const { start, RunnerStartError } = await import('./loop-AIJZVUNA.js');
-    const { RunnerAlreadyRunningError } = await import('./pidfile-DKMYYXLH.js');
+    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-5QYIKYUP.js');
+    const { start, RunnerStartError } = await import('./loop-QDV7T65M.js');
+    const { RunnerAlreadyRunningError } = await import('./pidfile-CYCTH6NQ.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     try {
-      const { realUpdateDeps } = await import('./real-deps-KNNBQC75.js');
+      const { realUpdateDeps } = await import('./real-deps-QX5YH7FG.js');
       await start(configPath, { update: realUpdateDeps(), leave: { exit: (code) => process.exit(code) }, fetchImpl: fetch });
     } catch (err) {
       if (err instanceof RunnerConfigError || err instanceof RunnerAlreadyRunningError || err instanceof RunnerStartError) {
@@ -4907,10 +4928,10 @@ function registerRunnerCommands(program2) {
     "after",
     "\nReads OUTERLAYER_URL, OUTERLAYER_APP_ID, OUTERLAYER_API_KEY, OUTERLAYER_RUNNER_NAME and one Claude credential\n(CLAUDE_CODE_OAUTH_TOKEN, ANTHROPIC_API_KEY or ANTHROPIC_AUTH_TOKEN) from the environment. OUTERLAYER_AGENT\nis optional and defaults to claude. On a later start it refuses variables that disagree with the config in the volume.\nThe image sets OUTERLAYER_RUNNER_IMAGE; outside the image, use `runner start`.\n"
   ).action(async () => {
-    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-TWS5VZEN.js');
-    const { containerStart } = await import('./container-start-FHB2VDC4.js');
-    const { start, RunnerStartError } = await import('./loop-AIJZVUNA.js');
-    const { RunnerAlreadyRunningError } = await import('./pidfile-DKMYYXLH.js');
+    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-5QYIKYUP.js');
+    const { containerStart } = await import('./container-start-7WLZMPEI.js');
+    const { start, RunnerStartError } = await import('./loop-QDV7T65M.js');
+    const { RunnerAlreadyRunningError } = await import('./pidfile-CYCTH6NQ.js');
     try {
       const result = await containerStart({
         env: process.env,
@@ -4928,8 +4949,8 @@ function registerRunnerCommands(program2) {
     }
   });
   runnerCmd.command("check").description("Validate the config, the hooks and the key, and print the effective settings").option("--config <path>", configOption).action(async (opts) => {
-    const { defaultRunnerConfigPath } = await import('./config-TWS5VZEN.js');
-    const { runRunnerCheck } = await import('./check-YTXFVWK7.js');
+    const { defaultRunnerConfigPath } = await import('./config-5QYIKYUP.js');
+    const { runRunnerCheck } = await import('./check-YEI6TCUH.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const result = await runRunnerCheck(configPath);
     if (!result.ok) {
@@ -4950,8 +4971,8 @@ function registerRunnerCommands(program2) {
 `);
   });
   runnerCmd.command("install").description("Put this CLI in the runner's install layout; --service adds its service").option("--config <path>", configOption).option("--service", "set up the service that keeps the runner running").option("--print", "with --service, print the unit and set up nothing").option("--user <account>", "with --service, the account the service runs as").option("--replace", "replace a unit or launcher file this command did not write").option("--allow-downgrade", "install this CLI even when it is older than the version the runner runs").option("--unit-name <name>", "with --service, the unit's name, to run a second runner beside the first").action(async (opts) => {
-    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-TWS5VZEN.js');
-    const { runRunnerInstall, RunnerInstallError, launcherSummary, restartNote } = await import('./install-cmd-JMT67P35.js');
+    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-5QYIKYUP.js');
+    const { runRunnerInstall, RunnerInstallError, launcherSummary, restartNote } = await import('./install-cmd-GFY4QF72.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     if (opts.service !== true) {
       for (const flag of ["print", "user", "unitName"]) {
@@ -4963,7 +4984,7 @@ function registerRunnerCommands(program2) {
     }
     try {
       if (opts.service === true) {
-        const { installServiceCommand } = await import('./command-V7B7GTPZ.js');
+        const { installServiceCommand } = await import('./command-PY3C2E4B.js');
         const result2 = await installServiceCommand({
           configPath,
           print: opts.print,
@@ -5018,8 +5039,8 @@ To keep it running, run ${C.yellow}${cliInvocation()} runner install --service${
       fail(`pass --service: \`${cliInvocation()} runner uninstall --service\` removes the runner's service.`);
       return;
     }
-    const { defaultRunnerConfigPath } = await import('./config-TWS5VZEN.js');
-    const { uninstallServiceCommand } = await import('./command-V7B7GTPZ.js');
+    const { defaultRunnerConfigPath } = await import('./config-5QYIKYUP.js');
+    const { uninstallServiceCommand } = await import('./command-PY3C2E4B.js');
     const result = await uninstallServiceCommand({ configPath: opts.config ?? defaultRunnerConfigPath(), unitName: opts.unitName, home: homeFromEnv() });
     if (result.ok) for (const line of result.lines) process.stdout.write(`${C.green}\u2713${C.reset} ${line}
 `);
@@ -5039,19 +5060,19 @@ With no terminal to ask on, it stops and says what to put in the config file.
 With --agent claude, the queue commands start Claude Code instead of the
 placeholder, and Claude's credential is read from stdin: a token from
 \`claude setup-token\` (sk-ant-oat...) or an API key (sk-ant-api...). It is
-never printed, and is stored in the runner.env beside the config with mode
-600. Other lines in the file are kept. With nothing piped, a credential
-already in runner.env is used.
+never printed, and is stored in the claude.env beside the config with mode
+600. Any Claude credential line in runner.env is removed. With nothing piped, a credential
+already in claude.env is used.
 
   printf '%s' "$CLAUDE_CODE_OAUTH_TOKEN" | ${cliInvocation()} runner init --agent claude --factory <org>/<factory>
 `
   ).action(async (opts) => {
-    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-TWS5VZEN.js');
-    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-SWKYV6CL.js');
-    const { obtainRunnerKey, runnerKeyLogin } = await import('./runner-key-EFNTZWNX.js');
-    const { detectMachine } = await import('./machine-OOQ2NXC3.js');
-    const { chooseVm, runVmInit, VmInitError } = await import('./init-3DAGX7UY.js');
-    const { AGENT_COMMANDS, credentialFromStdin, isAgentName, restartForCredential, RunnerEnvError } = await import('./runner-env-YRRNRKF4.js');
+    const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-5QYIKYUP.js');
+    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-5LHTF72R.js');
+    const { obtainRunnerKey, runnerKeyLogin } = await import('./runner-key-M4N2BY5A.js');
+    const { detectMachine } = await import('./machine-PLNSGKNF.js');
+    const { chooseVm, runVmInit, VmInitError } = await import('./init-BTH5YPBC.js');
+    const { AGENT_COMMANDS, credentialFromStdin, isAgentName, restartForCredential, RunnerEnvError } = await import('./runner-env-EIB6WFPG.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     if (opts.agent !== void 0 && !isAgentName(opts.agent)) {
       fail(`--agent ${opts.agent}: runner init writes commands for ${Object.keys(AGENT_COMMANDS).join(", ")}. For another agent, leave --agent out and edit runner.commands.`);
@@ -5065,10 +5086,10 @@ already in runner.env is used.
     try {
       let credential;
       if (agent !== void 0) {
-        const { readPipedKey } = await import('./login-browser-EWXSGHM7.js');
+        const { readPipedKey } = await import('./login-browser-WSOSQH2T.js');
         credential = credentialFromStdin(
           await readPipedKey(process.stdin, {
-            onWaiting: () => process.stderr.write(`runner init is waiting for Claude's credential on stdin; close stdin to use the one already in runner.env
+            onWaiting: () => process.stderr.write(`runner init is waiting for Claude's credential on stdin; close stdin to use the one already in claude.env
 `)
           })
         );
@@ -5082,7 +5103,7 @@ already in runner.env is used.
         const chunks = [];
         for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
         const result2 = runRunnerInit(configPath, { machine, configFromStdin: Buffer.concat(chunks).toString("utf8"), requireContainer: true });
-        const { ensureHostKey: ensureHostKey2 } = await import('./host-key-XNKZCWTS.js');
+        const { ensureHostKey: ensureHostKey2 } = await import('./host-key-AC6LTZDS.js');
         const hostKey2 = await ensureHostKey2(configPath);
         process.stdout.write(`host key ${hostKey2.fingerprint}
 hooks: ${result2.hooks}
@@ -5117,13 +5138,13 @@ hooks: ${result2.hooks}
       if (useVm) {
         const { realLima } = await import('./lima-7NPCNGWT.js');
         const { cpus, totalmem } = await import('os');
-        const { resolvePackageVersion } = await import('./version-BWM6VLDI.js');
+        const { resolvePackageVersion: resolvePackageVersion2 } = await import('./version-BWM6VLDI.js');
         const result2 = await runVmInit(configPath, {
           lima: realLima(),
           home: homeFromEnv(),
           hostCpus: cpus().length,
           hostMemoryBytes: totalmem(),
-          version: resolvePackageVersion(),
+          version: resolvePackageVersion2(),
           cliPackage: opts.vmCliPackage,
           agent,
           credential,
@@ -5141,7 +5162,7 @@ hooks: ${result2.hooks}
       const prepared = prepareRunnerInit(configPath, { machine, allowProcess, agent, credential, keyFromLogin: makeKey !== void 0 });
       const created = makeKey === void 0 ? void 0 : await makeKey();
       const result = writeRunnerInit(prepared, created);
-      const { ensureHostKey } = await import('./host-key-XNKZCWTS.js');
+      const { ensureHostKey } = await import('./host-key-AC6LTZDS.js');
       const hostKey = await ensureHostKey(configPath);
       if (created !== void 0) {
         process.stdout.write(`${C.green}\u2713${C.reset} saved the runner key in ${result.configPath}
@@ -5169,7 +5190,7 @@ ${C.yellow}${result.note}${C.reset}
 To isolate builds in containers instead, run ${C.yellow}${cliInvocation()} runner init --vm${C.reset}.
 `);
       }
-      const { runRunnerInstall, RunnerInstallError, RunnerDowngradeError, launcherSummary } = await import('./install-cmd-JMT67P35.js');
+      const { runRunnerInstall, RunnerInstallError, RunnerDowngradeError, launcherSummary } = await import('./install-cmd-GFY4QF72.js');
       let installedLayout = false;
       let noService = "it starts the runner from the install layout, which needs a CLI installed with npm";
       try {
@@ -5201,7 +5222,7 @@ ${C.yellow}The runner will not update itself: ${installErr.message}${C.reset}
       let serviceUp = false;
       let restart;
       if (installedLayout) {
-        const { installServiceCommand } = await import('./command-V7B7GTPZ.js');
+        const { installServiceCommand } = await import('./command-PY3C2E4B.js');
         const service = await installServiceCommand({
           configPath,
           entryPath: process.argv[1] ?? "",
@@ -5229,7 +5250,7 @@ ${C.yellow}${restart}${C.reset}
         `
 Next:
 ` + steps.map((step, i) => `  ${i + 1}. ${step}
-`).join("") + (serviceUp && agent === void 0 ? `  The runner service claims nothing until step 1 is done and a Claude credential is in ${join(dirname(configPath), "runner.env")}; ${C.yellow}${cliInvocation()} runner status${C.reset} shows what it is doing.
+`).join("") + (serviceUp && agent === void 0 ? `  The runner service claims nothing until step 1 is done and a Claude credential is in ${join(dirname(configPath), "claude.env")}; ${C.yellow}${cliInvocation()} runner status${C.reset} shows what it is doing.
 ` : serviceUp ? `  The runner service is running; ${C.yellow}${cliInvocation()} runner status${C.reset} shows what it is doing.
 ` : "")
       );
@@ -5245,12 +5266,12 @@ Next:
     "after",
     "\nA repository governed by a control plane builds the control plane's image, at the commit\nthe gateway has stored for it. A repository that governs itself fetches the head of its\ndefault branch into the runner's cache. Either way it reads .devcontainer/devcontainer.json\nand builds the image with the devcontainer CLI. Settings\nthat reach the host or widen the container's privileges are ignored and listed. The\nimage holds this CLI and a pinned Claude Code. Nothing runs inside the image.\n"
   ).action(async (opts) => {
-    const { defaultRunnerConfigPath } = await import('./config-TWS5VZEN.js');
-    const { buildRepositoryImage, RecipeError } = await import('./build-HRLACBOZ.js');
+    const { defaultRunnerConfigPath } = await import('./config-5QYIKYUP.js');
+    const { buildRepositoryImage, RecipeError } = await import('./build-5FRC3RKM.js');
     const { currentCliBuild } = await import('./cli-build-K56DK4DS.js');
-    const { createDockerHost } = await import('./docker-YT6Z3LXI.js');
-    const { builderSpec } = await import('./builder-6Y6ZWGNH.js');
-    const { loadRunnerConfig } = await import('./config-TWS5VZEN.js');
+    const { createDockerHost } = await import('./docker-ZTC4EIU4.js');
+    const { builderSpec } = await import('./builder-4F2XNSFC.js');
+    const { loadRunnerConfig } = await import('./config-5QYIKYUP.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const loaded = (() => {
       try {
@@ -5261,11 +5282,11 @@ Next:
     })();
     const memory = loaded?.build?.memory ?? "8g";
     try {
-      const { ensureRunnerIdentity } = await import('./runner-identity-YS2BZXZV.js');
+      const { ensureRunnerIdentity } = await import('./runner-identity-S3V6I4I3.js');
       await ensureRunnerIdentity(configPath, { log: (line) => console.error(line) }).catch((err) => {
         console.error(`the runner's Docker identity could not be stored: ${err instanceof Error ? err.message : String(err)}`);
       });
-      const { imageTargetFor } = await import('./governing-source-VVUA5TKB.js');
+      const { imageTargetFor } = await import('./governing-source-B3M2U4BC.js');
       const target = await imageTargetFor({ config: loaded, repository: opts.repository, fetchImpl: fetch });
       if (!target.ok) {
         if (opts.json) {
@@ -5328,25 +5349,25 @@ Next:
     }
   });
   runnerCmd.command("stop").description("Take no more work; finish running jobs, then exit").option("--config <path>", "the cloud config file naming the runner to stop").option("--now", "end running jobs immediately, with outcome stopped").action(async (opts) => {
-    const { defaultRunnerConfigPath } = await import('./config-TWS5VZEN.js');
-    const { requestStop } = await import('./loop-AIJZVUNA.js');
+    const { defaultRunnerConfigPath } = await import('./config-5QYIKYUP.js');
+    const { requestStop } = await import('./loop-QDV7T65M.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
-    const { runnerImageVersion } = await import('./image-tag-R34J4O3F.js');
+    const { runnerImageVersion } = await import('./image-tag-SS7YKJHN.js');
     await requestStop(configPath, Boolean(opts.now), void 0, { image: runnerImageVersion() !== void 0 });
   });
   runnerCmd.command("status").description("List running jobs; with --recent, finished ones too").option("--config <path>", "the cloud config file naming the runner to inspect").option("--recent", "also list finished jobs, newest first, capped at 20").option("--json", "machine-readable JSON output").action(async (opts) => {
-    const { defaultRunnerConfigPath, loadRunnerConfig } = await import('./config-TWS5VZEN.js');
-    const { jobsDir, runnerDir } = await import('./paths-LHSPNORF.js');
-    const { listJobFiles, runnerProcessState } = await import('./loop-AIJZVUNA.js');
-    const { renderStatus } = await import('./status-7WM7S7JX.js');
-    const { readHousekeepingRecord } = await import('./record-3LPTY3G5.js');
+    const { defaultRunnerConfigPath, loadRunnerConfig } = await import('./config-5QYIKYUP.js');
+    const { jobsDir, runnerDir } = await import('./paths-32DWGK35.js');
+    const { listJobFiles, runnerProcessState } = await import('./loop-QDV7T65M.js');
+    const { renderStatus } = await import('./status-PWMPP4ES.js');
+    const { readHousekeepingRecord } = await import('./record-N4WPZCGK.js');
     const path2 = await import('path');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const all = listJobFiles(configPath);
     const housekeeping = readHousekeepingRecord(runnerDir(configPath));
-    const { readPendingUpdate } = await import('./pending-3YZCSKON.js');
+    const { readPendingUpdate } = await import('./pending-CSIY4Y2I.js');
     const pendingUpdate = readPendingUpdate(runnerDir(configPath));
-    const { readImageStatus } = await import('./image-tag-R34J4O3F.js');
+    const { readImageStatus } = await import('./image-tag-SS7YKJHN.js');
     const image = readImageStatus(runnerDir(configPath));
     let host = "unknown";
     let concurrency = 1;
@@ -5359,8 +5380,8 @@ Next:
     const processState = runnerProcessState(configPath);
     const service = await (async () => {
       if (process.platform !== "linux" || !existsSync("/run/systemd/system")) return void 0;
-      const { inspectService, realInspectProbes } = await import('./inspect-IPFA7AAT.js');
-      const { DEFAULT_UNIT_NAME } = await import('./install-6OIY3KHZ.js');
+      const { inspectService, realInspectProbes } = await import('./inspect-L7JIBK3Y.js');
+      const { DEFAULT_UNIT_NAME } = await import('./install-35SAMY75.js');
       const facts = inspectService(DEFAULT_UNIT_NAME, path2.dirname(configPath), realInspectProbes());
       return facts === void 0 ? void 0 : { unit: facts.unit, running: facts.mainPid !== void 0, delegated: facts.delegate };
     })();
@@ -5397,9 +5418,9 @@ Next:
     );
   });
   runnerCmd.command("logs").argument("<item>", "the work item's number in the factory").description("Print the newest attempt's log for one item").option("--config <path>", "the cloud config file naming the runner to inspect").option("-f, --follow", "keep printing as the log grows").action(async (itemArg, opts) => {
-    const { defaultRunnerConfigPath } = await import('./config-TWS5VZEN.js');
-    const { listJobFiles } = await import('./loop-AIJZVUNA.js');
-    const { newestAttempt, logPathFor, tail, RunnerLogsError } = await import('./logs-XHAS6LMZ.js');
+    const { defaultRunnerConfigPath } = await import('./config-5QYIKYUP.js');
+    const { listJobFiles } = await import('./loop-QDV7T65M.js');
+    const { newestAttempt, logPathFor, tail, RunnerLogsError } = await import('./logs-X2IRDP5T.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const item = parseTrackerNumber(itemArg);
     if (item === void 0) {
@@ -5630,7 +5651,7 @@ caller from the bearer token, the gateway answers 401 without that header.
     "after",
     "\nWhat the stdio .mcp.json entry spawns. Reads newline-delimited JSON-RPC 2.0 on\nstdin and writes responses on stdout. The API key comes from OUTERLAYER_API_KEY\nor ~/.outerlayer/config.json at start-up; with neither the command exits 1 and\nprints why, which the MCP client shows as the connect error.\n"
   ).action(async (opts) => {
-    const { runMcpServe, handleMcpServeError } = await import('./mcp-serve-cmd-LY5A3CE7.js');
+    const { runMcpServe, handleMcpServeError } = await import('./mcp-serve-cmd-IITCPAAR.js');
     try {
       await runMcpServe({ url: opts.url, appId: opts.appId });
     } catch (err) {