@outerlayer/cli 0.28.4 → 0.30.0

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # @outerlayer/cli
 
+## 0.30.0
+
+### Minor Changes
+
+- 964f486: `outerlayer findings show` lists the problems a fix item covers. `outerlayer findings result` records whether the fix resolved a problem, with a note.
+
+### Patch Changes
+
+- 7d80fe5: The line `init` and `connect` print to commit the policy says checks wait for it on the branch a pull request targets, not on the default branch. That is the branch OuterLayer reads the policy from.
+- 1eba9b9: `outerlayer runner container-start` refuses to start when `ANTHROPIC_AUTH_TOKEN` is its only Claude credential, and says so. The runner never used that variable, so a runner image given only it started and then claimed no work. Set `CLAUDE_CODE_OAUTH_TOKEN` or `ANTHROPIC_API_KEY` instead.
+- aea4cbd: Update the bundled `structured-headers` library from 2.1.0 to 2.1.1. The runner uses it to sign its requests to the gateway; signed requests are unchanged.
+
+## 0.29.0
+
+### Minor Changes
+
+- 8ed2acc: The host's criteria judge records one check item per criterion, with its result and reason, and judges again only the criteria whose tests changed. `outerlayer emit <name> --items <file>` sends check items from CI, a host command writes them to the file `OUTERLAYER_CHECK_ITEMS` names, and `outerlayer work status` lists the failing ones. A judge check can set `subjects: none` to judge the change with no criteria.
+
+### Patch Changes
+
+- 3a2c7ea: A command in a microVM build that finishes at once no longer fails now and then with `write EPIPE` from the exec agent. The runner sends a command's request and its known input to the guest in one write.
+- c6533fc: A runner reads past the first page of startable work, so a runner limited to some repositories finds their work however long the queue is. It takes work in the order the gateway lists it, which is now the order each build was asked for.
+- 86d956d: The tracker adapters name an issue's labels `labels` instead of `tags`. The label names they read from GitHub, Linear and Jira are unchanged.
+
 ## 0.28.4
 
 ### Patch Changes

package/README.md

@@ -196,7 +196,7 @@ content:
 - **`outerlayer work`** and **`outerlayer emit`**, in the subcommands named below, with a login and no saved
   connection for the repository send the same `GET /v1/me/factories?repository=<host/owner/name>`
   request before their own, to connect the repository when exactly one factory
-  fits. They send nothing extra with a factory key, `--app-id` or `OUTERLAYER_APP_ID`. The subcommands are `work build`, `list`, `status`, `remove` and `pr`, and `emit artifact`, `criteria`, `finding`, `findings` and `emit <name>`. Other `work` subcommands never connect.
+  fits. They send nothing extra with a factory key, `--app-id` or `OUTERLAYER_APP_ID`. The subcommands are `work build`, `list`, `status`, `remove` and `pr`, and `emit artifact`, `criteria`, `finding`, `findings` and `emit <name>`, and `findings show` and `findings result`. Other `work` subcommands never connect.
 - **`outerlayer connect`**, and the first step of `outerlayer init`, send a
   request with your login's token: `GET /v1/me/factories?repository=<host/owner/name>`,
   naming this checkout's remote. The gateway answers with the factories you can
@@ -377,6 +377,12 @@ content:
   and a one-line summary scrubbed of secrets) and to look up the time of the
   events you name with `--started-at` and `--ended-at`. The transcript itself
   is never sent; only the two event ids and their times are.
+- **`outerlayer findings show`** and **`outerlayer findings result`**
+  read the problems a fix item covers (`GET /v1/work-items/{id}/problems`) and
+  record whether the fix resolved one (`PUT /v1/work-items/{id}/problems/{problemId}/result`).
+  The item is `--item`, or the item the recorded session was launched for.
+  `findings result` sends the problem id, `fixed` or `not_fixed`, your note and
+  the session id. Nothing from the session itself is sent.
 - **`outerlayer emit criteria <file>`** sends the acceptance criteria of a work
   item as one list (`POST /v1/criteria`): each criterion's id, text and
   declared proof kind, from the JSON file you name. The anchoring is the same
@@ -458,6 +464,8 @@ before it gives up.
 | `outerlayer emit finding --id <id> --category <context\|flaky-test\|tooling\|environment\|defect\|other> --title <text> --file <path> --where <label> [--line <n>] [--item <number>] [--cause <text>] [--detail <text>] [--suggestion <text>] [--command <text>] [--error <text>] [--test <name>] [--symbol <name>] [--started-at <event> --ended-at <event>] [--problem <id> … --link-reason <text> \| --new] …` | Record one problem you hit in the factory. `--category` is one of `context` (an instruction that is wrong, broken or missing), `flaky-test`, `tooling`, `environment`, `defect` (a bug outside your own change) or `other`. A `context` finding also needs `--rule-path` and `--rule-relation` (`wrong`, `broken` or `missing`), and `--rule-quote` unless the relation is `missing`. `--cause`, `--detail`, `--suggestion`, `--command`, `--error` (the first error line), `--test` and `--symbol` carry what a fix needs. Every finding joins a factory-level problem: when a key of the finding matches a known problem it joins that problem; otherwise nothing is stored, the closest problems are printed, and the command exits with code 3. Run it again with `--problem <id> --link-reason <text>` (repeat `--problem` for each problem the finding reports) or with `--new`. Without `--started-at`, it prints the session's recent events with ids and times; name the event where you hit the problem and the one where you got past it with `--started-at` and `--ended-at`. Findings are informational; nothing reads one to pass or fail the work. `--item` names the work item; without it, inside a recorded session, the item that session was launched for is used automatically. Re-emitting the same `--id` on the item replaces that finding and keeps its problems. |
 | `outerlayer emit findings <file> [--item <number>]` | Record a whole batch at once, read from a JSON file (`-` for standard input) with `"schemaVersion": 3` — the same shape and validation as `emit finding`, one record per id. A finding's `startedAt` and `endedAt` may be event ids. The findings that match a key are stored; those that need a choice are listed with their candidates and not stored, and the exit code is 3. Anchored the same way: `--item`, else a recorded session's own item. |
 | `outerlayer emit step <name> [--item <number>]` | Report that you started a step. The name is free text, 1 to 80 characters on one line. The work item's Activity tab shows the step with the time you ran the command. A step has a start and nothing else, so run it again at the start of the next step. `--item` names the work item; without it, inside a recorded session, the item that session was launched for is used. If the gateway cannot be reached, or answers with a 5xx, the step is queued in `~/.outerlayer/spool/steps.jsonl`, the command exits 0, and `outerlayer sync` sends it later with its original time. If the gateway refuses the step, the command prints why and exits 1. |
+| `outerlayer findings show [--item <number>] [--json]` | List the problems a fix item covers, each with its id, title, reports and recorded result. A problem with no result shows "no result yet". `--item` names the work item; without it, inside a recorded session, the item that session was launched for is used. |
+| `outerlayer findings result <problem> --fixed\|--not-fixed --note <text> [--item <number>]` | Record whether the fix resolved one covered problem. Give exactly one of `--fixed` and `--not-fixed`, and a `--note`. Running it again for the same problem replaces the earlier result. A problem the item does not cover is refused and nothing is stored. |
 | `outerlayer emit criteria <file> [--item <number>]` | Record a work item's acceptance criteria as one list, read from a JSON file (`-` for standard input): `{"criteria": [{"id": "AC-1", "text": "Given …", "proof": null}]}`. An `id` is 1 to 64 characters of `A-Z a-z 0-9 . _ : -`, the same id `emit artifact --for` binds evidence to. `proof` is `video`, `screenshot`, `report`, `log`, `test`, `file` or `null` (any bound artifact proves it). The list holds 1 to 200 criteria, each `text` at most 2,000 characters, with no id twice. It is validated before anything is sent. This list is the only source for the item's Criteria tab. Once an item has a list, only a person can replace it: run the command outside an agent session, with your own login. Anchored the same way as `emit findings`: `--item`, else a recorded session's own item. |
 | `outerlayer mcp install [--transport stdio\|http] [--url] [--name] [--command]` | Write (or update) an `mcpServers` entry in `.mcp.json` for the OuterLayer gateway. Default `stdio`: the client spawns `outerlayer mcp serve`, which reads the API key from `~/.outerlayer/config.json` (or `OUTERLAYER_API_KEY`) each time it connects, so a reconnect picks up a newly saved or rotated key. `--transport http` writes a direct `POST /v1/mcp` entry referencing `${OUTERLAYER_API_KEY}`, resolved by the client from the environment it was launched with. Never writes an API key. Pass `--url`/`--app-id` for self-host. |
 | `outerlayer mcp serve [--url] [--app-id]` | Stdio MCP server bridging stdin/stdout JSON-RPC to the gateway's `POST /v1/mcp`. What the stdio `.mcp.json` entry runs; exits 1 with a clear message when no API key is configured. |

package/dist/{agent-setup-IDF3EXM4.js → agent-setup-ZNYAXAWI.js}

@@ -1,30 +1,30 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { keepHandWritten, runAgentSetup } from './chunk-UXLLWIA2.js';
-import './chunk-QKXF7CLR.js';
+export { keepHandWritten, runAgentSetup } from './chunk-I3WLYIIW.js';
+import './chunk-XB7TRWI2.js';
 import './chunk-KT4CN6OU.js';
-import './chunk-SATUCMAJ.js';
-import './chunk-5B7BEQPR.js';
+import './chunk-XTKH5VAC.js';
+import './chunk-QDDPVBIS.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-TG7FAHRP.js';
-import './chunk-P2RWZCV7.js';
-import './chunk-KJIUFOC4.js';
+import './chunk-DLY22KHX.js';
+import './chunk-V6IYYQU3.js';
+import './chunk-AM3GMWQK.js';
 import './chunk-PJDQPF5N.js';
-import './chunk-R7TMTFJP.js';
-import './chunk-DWVAG73B.js';
-import './chunk-N5EEEKT6.js';
+import './chunk-IRF2FKB5.js';
+import './chunk-SOWXLIDN.js';
+import './chunk-WHCDULC4.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-BJ3KTMDH.js';
-import './chunk-JGML2VUN.js';
+import './chunk-AKKVPUGK.js';
 import './chunk-5BHIBJDA.js';
 import './chunk-CDDED64E.js';
 import './chunk-RA3O54FC.js';
 import './chunk-CRB3POP4.js';
-import './chunk-VWFOKRYS.js';
+import './chunk-HJUGOAM7.js';
 import './chunk-YQR6E6OV.js';
 import './chunk-TUSYOL2O.js';
-import './chunk-RKOTJQVG.js';
-import './chunk-QZBXLLTV.js';
+import './chunk-ZUOPFE22.js';
+import './chunk-IWFYKNAO.js';
 import './chunk-VNVZDWO3.js';
 import './chunk-XD4ZCMA4.js';
 import './chunk-MESOOLF4.js';

package/dist/{artifact-link-cmd-LEI6EOZE.js → artifact-link-cmd-VY6OM7S5.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { sanitizeTerminal, readEffectiveArtifactSpoolState } from './chunk-BUP5N3X6.js';
+import { sanitizeTerminal, readEffectiveArtifactSpoolState } from './chunk-HSUUTD4E.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import './chunk-QZBXLLTV.js';
+import './chunk-IWFYKNAO.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/{bridge-JN3VJ23L.js → bridge-FI7OF2H3.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { BRIDGE_ADDRESS, BRIDGE_CIDR, CONTAINER_NO_PROXY, CONTAINER_PROXY, TUNNEL_PORT, dockerClientConfig, startBridgeForward, writeDockerClientConfig } from './chunk-RXFKXZJS.js';
-import './chunk-N5EEEKT6.js';
+export { BRIDGE_ADDRESS, BRIDGE_CIDR, CONTAINER_NO_PROXY, CONTAINER_PROXY, TUNNEL_PORT, dockerClientConfig, startBridgeForward, writeDockerClientConfig } from './chunk-TN2XMMD7.js';
+import './chunk-WHCDULC4.js';
 import './chunk-XD4ZCMA4.js';
 import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';

package/dist/{build-JCYOHPLL.js → build-PXRDWSN4.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { buildRepositoryImage } from './chunk-TCBVV2JK.js';
-import './chunk-M6NNXKRM.js';
+export { buildRepositoryImage } from './chunk-U5DC57AF.js';
+import './chunk-IRTZYDZO.js';
 import './chunk-JBJTC3UU.js';
 export { RecipeError } from './chunk-SJZL5F3F.js';
-import './chunk-DWVAG73B.js';
-import './chunk-N5EEEKT6.js';
+import './chunk-SOWXLIDN.js';
+import './chunk-WHCDULC4.js';
 import './chunk-XD4ZCMA4.js';
 import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-17T18:42:55.566Z+c3e29e0","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-19T18:27:12.345Z+c19f734","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/dist/{builder-HCTVP2O7.js → builder-UNVHUZL7.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-MFI55TNI.js';
+export { MIN_BUILDX_VERSION, builderName, builderSpec, buildxState, ensureBuilder, ensureFailureCount, isOutOfMemory, proxyEnvironment, trackImageBuild } from './chunk-7YSR636F.js';
 import './chunk-YJLHUKYS.js';
 import './chunk-SJZL5F3F.js';
-import './chunk-UHU7H57K.js';
-import './chunk-R7TMTFJP.js';
-import './chunk-DWVAG73B.js';
-import './chunk-N5EEEKT6.js';
-import './chunk-QZBXLLTV.js';
+import './chunk-FTGJ3DPV.js';
+import './chunk-IRF2FKB5.js';
+import './chunk-SOWXLIDN.js';
+import './chunk-WHCDULC4.js';
+import './chunk-IWFYKNAO.js';
 import './chunk-XD4ZCMA4.js';
 import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';

package/dist/{check-WJ4X2Q44.js → check-BKONE55O.js}

@@ -1,66 +1,67 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { probeCredentials } from './chunk-NVUO52YW.js';
-import './chunk-6P2Z5AUY.js';
+import { probeCredentials } from './chunk-DBENBGVF.js';
+import './chunk-ISKWFUEQ.js';
 import './chunk-3JVYMD4G.js';
 import './chunk-E7R2GIAW.js';
 import './chunk-TPKYTORP.js';
-import './chunk-HWOU2HDH.js';
+import './chunk-QWJBTFAF.js';
 import './chunk-ZVB57WI6.js';
-import './chunk-QBF462QH.js';
-import './chunk-OO6OADZN.js';
-import './chunk-YTR435DO.js';
-import './chunk-2BZTGJII.js';
-import './chunk-VM6BX2WJ.js';
+import './chunk-44CGGHJF.js';
+import './chunk-6CNNRO53.js';
+import './chunk-I3LTIAOR.js';
+import './chunk-ZNMVBHGJ.js';
+import './chunk-DBELICD6.js';
+import './chunk-PS3AHE6C.js';
 import './chunk-ESVW4MJY.js';
-import './chunk-RXFKXZJS.js';
-import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-ERVZGWUR.js';
+import './chunk-TN2XMMD7.js';
+import { placeholderQueues, placeholderProblem, permissionModeProblems, permissionModeProblem, needsClaudeCredential, claudeCredentialCheck, claimPermissionProblem, formerSkillQueues, formerSkillProblem } from './chunk-JGOMMFNX.js';
 import './chunk-YYYRBYWG.js';
-import './chunk-6NFXOQKZ.js';
+import './chunk-LJIFCG4G.js';
 import './chunk-TBT347UY.js';
-import './chunk-KBB3CQTW.js';
-import './chunk-W3K6GBXY.js';
-import './chunk-5Q4NDYQP.js';
-import './chunk-WL3QF3QF.js';
-import './chunk-DIQN5SEL.js';
-import './chunk-JZJLKTZT.js';
-import './chunk-O47BTZSN.js';
+import './chunk-B6OYEP3K.js';
+import './chunk-XRRSFHKV.js';
+import './chunk-QQJGL7LG.js';
+import './chunk-MBVSVQVH.js';
+import './chunk-TKJISBV6.js';
+import './chunk-3IDNLZPR.js';
+import './chunk-D3LS7E7U.js';
 import './chunk-TQMI335S.js';
-import './chunk-AV5MJY45.js';
-import './chunk-JYVBEWBC.js';
-import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-YYGXCRIW.js';
+import './chunk-5HZDPOJI.js';
+import './chunk-3F7RC3UA.js';
+import { loadRunnerConfig, RunnerConfigError, checkHooks } from './chunk-2ZMJFGOZ.js';
 import './chunk-UXYLWVTQ.js';
-import './chunk-TCBVV2JK.js';
-import './chunk-M6NNXKRM.js';
+import './chunk-U5DC57AF.js';
+import './chunk-IRTZYDZO.js';
 import './chunk-JBJTC3UU.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-MFI55TNI.js';
+import './chunk-7YSR636F.js';
 import './chunk-YJLHUKYS.js';
 import './chunk-SJZL5F3F.js';
-import './chunk-X7SFJZIG.js';
-import './chunk-NMIYK2G2.js';
-import './chunk-QFNFBQCG.js';
-import './chunk-BUP5N3X6.js';
-import './chunk-UHU7H57K.js';
-import './chunk-5B7BEQPR.js';
-import './chunk-HOU33DW5.js';
+import './chunk-DBRB26R7.js';
+import './chunk-SJ4DX2AD.js';
+import './chunk-3YLHIXLR.js';
+import './chunk-HSUUTD4E.js';
+import './chunk-FTGJ3DPV.js';
+import './chunk-QDDPVBIS.js';
+import './chunk-G2RRBBOX.js';
 import './chunk-G2JWZDFA.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-TG7FAHRP.js';
-import './chunk-P2RWZCV7.js';
-import './chunk-KJIUFOC4.js';
+import './chunk-DLY22KHX.js';
+import './chunk-V6IYYQU3.js';
+import './chunk-AM3GMWQK.js';
 import './chunk-PJDQPF5N.js';
-import './chunk-R7TMTFJP.js';
-import './chunk-DWVAG73B.js';
-import { claudeEnvPath } from './chunk-N5EEEKT6.js';
-import './chunk-OOUHNKKX.js';
+import './chunk-IRF2FKB5.js';
+import './chunk-SOWXLIDN.js';
+import { claudeEnvPath } from './chunk-WHCDULC4.js';
+import './chunk-RJDJFRRY.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-2O5KA67H.js';
 import './chunk-BKO6JEZI.js';
 import './chunk-FGF52V4V.js';
 import './chunk-HCVLP7XA.js';
 import './chunk-BJ3KTMDH.js';
-import './chunk-JGML2VUN.js';
+import './chunk-AKKVPUGK.js';
 import './chunk-5BHIBJDA.js';
 import './chunk-CDDED64E.js';
 import './chunk-RA3O54FC.js';
@@ -70,8 +71,8 @@ import './chunk-CRB3POP4.js';
 import './chunk-URIZRCRY.js';
 import './chunk-YQR6E6OV.js';
 import './chunk-TUSYOL2O.js';
-import './chunk-RKOTJQVG.js';
-import './chunk-QZBXLLTV.js';
+import './chunk-ZUOPFE22.js';
+import './chunk-IWFYKNAO.js';
 import './chunk-VNVZDWO3.js';
 import { parseRunnerEnv } from './chunk-XD4ZCMA4.js';
 import './chunk-MESOOLF4.js';

package/dist/{chunk-YYGXCRIW.js → chunk-2ZMJFGOZ.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { MAX_ALLOW_HOSTS, allowHostProblem } from './chunk-UXYLWVTQ.js';
 import { parseSize } from './chunk-YJLHUKYS.js';
-import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-N5EEEKT6.js';
+import { isRefusedInConfig, resolveDestinations, isReservedVariable } from './chunk-WHCDULC4.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { existsSync, statSync, accessSync, constants, readFileSync } from 'fs';
 import { hostname } from 'os';

package/dist/{chunk-JYVBEWBC.js → chunk-3F7RC3UA.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { builtinKind } from './chunk-YYGXCRIW.js';
+import { builtinKind } from './chunk-2ZMJFGOZ.js';
 import { parseSize } from './chunk-YJLHUKYS.js';
-import { runnerDir } from './chunk-DWVAG73B.js';
-import { CLAUDE_CREDENTIAL_ID, CLAUDE_ENV_FILE, credentialLineIn, withoutCredentialLines } from './chunk-N5EEEKT6.js';
+import { runnerDir } from './chunk-SOWXLIDN.js';
+import { CLAUDE_CREDENTIAL_ID, CLAUDE_ENV_FILE, credentialLineIn, withoutCredentialLines } from './chunk-WHCDULC4.js';
 import { FD_SLOTS_PER_BUILD, FD_STORE_ENV } from './chunk-XD4ZCMA4.js';
 import { existsSync, readFileSync, writeFileSync, chmodSync, renameSync } from 'fs';
 import { dirname, join } from 'path';

package/dist/{chunk-JZJLKTZT.js → chunk-3IDNLZPR.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { WorkCommandError, postJson } from './chunk-X7SFJZIG.js';
-import { defaultGitRunner, materializeContext, isStagingWriteFault, lookupGoverningSource } from './chunk-TG7FAHRP.js';
-import { signingFetchFor } from './chunk-KJIUFOC4.js';
-import { signerFor } from './chunk-R7TMTFJP.js';
-import { SHIM_DIR, stagedContextDir, contextHomeDir, deliveryDir, keptContextDir } from './chunk-DWVAG73B.js';
+import { WorkCommandError, postJson } from './chunk-DBRB26R7.js';
+import { defaultGitRunner, materializeContext, isStagingWriteFault, lookupGoverningSource } from './chunk-DLY22KHX.js';
+import { signingFetchFor } from './chunk-AM3GMWQK.js';
+import { signerFor } from './chunk-IRF2FKB5.js';
+import { SHIM_DIR, stagedContextDir, contextHomeDir, deliveryDir, keptContextDir } from './chunk-SOWXLIDN.js';
 import { unsupportedLayout, layoutRefusalReason, composeDelivery } from './chunk-FGF52V4V.js';
 import { SHIM_SCRIPT, GOVERNANCE_VARIABLE } from './chunk-HCVLP7XA.js';
 import { readDegraded, readContextManifest, readSourceCache } from './chunk-YQR6E6OV.js';

package/dist/{chunk-QFNFBQCG.js → chunk-3YLHIXLR.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { sanitizeTerminal } from './chunk-BUP5N3X6.js';
-import { remoteLookupFailed } from './chunk-UHU7H57K.js';
-import { isAgentsMdLayout } from './chunk-5B7BEQPR.js';
-import { DEFAULT_DASHBOARD } from './chunk-HOU33DW5.js';
-import { cliFetch, resolveGatewayCredentials } from './chunk-KJIUFOC4.js';
+import { sanitizeTerminal } from './chunk-HSUUTD4E.js';
+import { remoteLookupFailed } from './chunk-FTGJ3DPV.js';
+import { isAgentsMdLayout } from './chunk-QDDPVBIS.js';
+import { DEFAULT_DASHBOARD } from './chunk-G2RRBBOX.js';
+import { cliFetch, resolveGatewayCredentials } from './chunk-AM3GMWQK.js';
 import { readCloudConfig } from './chunk-PJDQPF5N.js';
 import { writeRepoConnection, findGitDirs, readRepoConnection } from './chunk-BJ3KTMDH.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
@@ -61,8 +61,8 @@ Then run \`${cliInvocation()} connect\` again.
 
 // src/connect-cmd.ts
 var REQUEST_TIMEOUT_MS = 15e3;
-var COMMIT_LINE = "Commit and push .outerlayer/ so the factory reads your policy and skills. No checks run on your pull requests until the policy is on your default branch.";
-var AGENTS_LAYOUT_COMMIT_LINE = "Commit and push .outerlayer/, AGENTS.md, .agents/, .mcp.json and .claude/skills so the factory reads your policy and skills. No checks run on your pull requests until the policy is on your default branch.";
+var COMMIT_LINE = "Commit and push .outerlayer/ so the factory reads your policy and skills. No checks run on a pull request until the policy is on the branch it targets.";
+var AGENTS_LAYOUT_COMMIT_LINE = "Commit and push .outerlayer/, AGENTS.md, .agents/, .mcp.json and .claude/skills so the factory reads your policy and skills. No checks run on a pull request until the policy is on the branch it targets.";
 var COMMIT_PATHS = [":/.outerlayer"];
 var AGENTS_LAYOUT_COMMIT_PATHS = [":/.outerlayer", ":/AGENTS.md", ":/.agents", ":/.mcp.json", ":/.claude/skills"];
 function inAgentsMdLayout(cwd) {

package/dist/{chunk-QBF462QH.js → chunk-44CGGHJF.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-DWVAG73B.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-SOWXLIDN.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';
 

package/dist/{chunk-AV5MJY45.js → chunk-5HZDPOJI.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { DEFAULT_UNIT_NAME } from './chunk-JYVBEWBC.js';
-import { RUNNER_FILE_MODE } from './chunk-DWVAG73B.js';
-import { claudeEnvPath, withoutCredentialLines } from './chunk-N5EEEKT6.js';
+import { DEFAULT_UNIT_NAME } from './chunk-3F7RC3UA.js';
+import { RUNNER_FILE_MODE } from './chunk-SOWXLIDN.js';
+import { claudeEnvPath, withoutCredentialLines } from './chunk-WHCDULC4.js';
 import { parseRunnerEnv } from './chunk-XD4ZCMA4.js';
 import { existsSync, readFileSync, writeFileSync, renameSync, rmSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-OO6OADZN.js → chunk-6CNNRO53.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { BRIDGE_ADDRESS, TUNNEL_PORT, BRIDGE_CIDR } from './chunk-RXFKXZJS.js';
-import { EXEC_PORT } from './chunk-DIQN5SEL.js';
+import { BRIDGE_ADDRESS, TUNNEL_PORT, BRIDGE_CIDR } from './chunk-TN2XMMD7.js';
+import { EXEC_PORT } from './chunk-TKJISBV6.js';
 import { startTimeOf } from './chunk-JBJTC3UU.js';
-import { RELAY_PORT } from './chunk-N5EEEKT6.js';
+import { RELAY_PORT } from './chunk-WHCDULC4.js';
 import { spawn, spawnSync } from 'child_process';
 import { symlinkSync, lstatSync, writeFileSync, chmodSync, mkdirSync } from 'fs';
 

package/dist/{chunk-MFI55TNI.js → chunk-7YSR636F.js}

@@ -2,10 +2,10 @@
 import { createRequire } from 'node:module';
 import { parseSize } from './chunk-YJLHUKYS.js';
 import { RecipeError, BUILDKIT_IMAGE } from './chunk-SJZL5F3F.js';
-import { compareVersions } from './chunk-UHU7H57K.js';
-import { ensureHostKey } from './chunk-R7TMTFJP.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-DWVAG73B.js';
-import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-N5EEEKT6.js';
+import { compareVersions } from './chunk-FTGJ3DPV.js';
+import { ensureHostKey } from './chunk-IRF2FKB5.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE, runnerDir, jobsDir } from './chunk-SOWXLIDN.js';
+import { CLAUDE_PORT, JOB_MOUNT, GATEWAY_PORT, GATEWAY_SOCKET, CLAUDE_SOCKET, RELAY_PORT, DESTINATION_BASE_PORT } from './chunk-WHCDULC4.js';
 import { JOIN_DIR, RELAY_ID, JOIN_SOCKET, TARGET_GATEWAY, TARGET_CLAUDE, destinationTarget, RELAY_USER } from './chunk-MESOOLF4.js';
 import { StringDecoder } from 'string_decoder';
 import { spawn } from 'child_process';
@@ -155,8 +155,10 @@ var JUDGE_DIR = "/outerlayer/judge";
 var JUDGE_HOME = `${JUDGE_DIR}/home`;
 var JUDGE_TREE = `${JUDGE_DIR}/tree`;
 var JUDGE_REPORT = `${JUDGE_DIR}/report.html`;
+var JUDGE_ITEMS = `${JUDGE_DIR}/items.json`;
 var JUDGE_PROGRAM = "/opt/outerlayer/claude/bin/claude";
 var MAX_REPORT_BYTES = 5 * 1024 * 1024;
+var MAX_ITEMS_BYTES = 1024 * 1024;
 var JUDGE_MAX_TURNS = 60;
 var JUDGE_PATH = "/opt/outerlayer/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
 var JUDGE_TOOLS = "Read,Grep,Glob,Write";
@@ -184,7 +186,7 @@ function judgeCommand(input) {
     JUDGE_TOOLS,
     "--allowedTools",
     // A path that starts with two slashes is absolute in a permission rule.
-    `Read(/${JUDGE_DIR}/**),Edit(/${JUDGE_REPORT})`,
+    `Read(/${JUDGE_DIR}/**),Edit(/${JUDGE_REPORT}),Edit(/${JUDGE_ITEMS})`,
     "--add-dir",
     JUDGE_TREE,
     "--permission-mode",
@@ -197,6 +199,20 @@ function judgeCommand(input) {
   ];
   return { argv, env, cwd: JUDGE_DIR };
 }
+function withAnswerProtocol(brief, subjects) {
+  const inputs = subjects === "criteria" ? `\`${JUDGE_DIR}/criteria.json\` lists the criteria to judge, \`${JUDGE_DIR}/citations.json\` the tests that cite each one, \`${JUDGE_DIR}/diff.patch\` the change and \`${JUDGE_TREE}/\` the files of the pushed commit.` : `\`${JUDGE_DIR}/diff.patch\` holds the change and \`${JUDGE_TREE}/\` the files of the pushed commit.`;
+  const items = subjects === "criteria" ? `one entry per criterion in criteria.json, with its id: \`{"items":[{"id":"<criterion id>","result":"pass"|"fail","reason":"<one to three sentences>"}]}\`. A criterion you do not list fails.` : `your overall result and, when you judged separate parts, one entry per part with an id you choose (a file path or a short name): \`{"result":"pass"|"fail","items":[{"id":"<part>","result":"pass"|"fail","reason":"<one to three sentences>"}]}\`. A failing part fails the whole.`;
+  return `${brief.trimEnd()}
+
+## How to answer
+
+This section comes from the factory host and overrides any other answer format above. ${inputs}
+
+Write your answer as JSON to \`${JUDGE_ITEMS}\`: ${items} A reason quotes the decisive assertion or names what is missing.
+
+Then end your reply with one line \`unmet: <id>\` for each failing ${subjects === "criteria" ? "criterion" : "part"}, and a final line that is exactly \`result: pass\` or \`result: fail\`.
+`;
+}
 var HASH_SCRIPT = 'const fs=require("fs"),c=require("crypto");const p=fs.realpathSync(process.argv[1]);process.stdout.write(c.createHash("sha256").update(fs.readFileSync(p)).digest("hex")+" "+p+"\\n")';
 var HASH_ARGV = ["/opt/outerlayer/bin/node", "-e", HASH_SCRIPT, JUDGE_PROGRAM];
 function parseProgramHash(stdout) {
@@ -715,4 +731,4 @@ ${result.stderr}`)) throw outOfMemory(builder, req.logPath);
   };
 }
 
-export { BUILD_LABEL, COMMAND_DIR, HASH_ARGV, JUDGE_DIR, JUDGE_MAX_TURNS, JUDGE_PROGRAM, JUDGE_REPORT, MAX_REPORT_BYTES, MIN_BUILDX_VERSION, RUNNER_LABEL, builderName, builderNameFor, builderSpec, buildxState, childEnvironment, containerExecArgs, containerRunArgs, createDockerHost, dockerIdentity, ensureBuilder, ensureFailureCount, ensureRunnerIdentity, isOutOfMemory, judgeCommand, parseProgramHash, pathLabelValue, prepareRunArgs, proxyEnvironment, readJobFile, readJobFileChecked, readRunnerIdentity, resolveDevcontainerCli, runnerLabelValue, spawnRun, trackImageBuild, writeJobFile };
+export { BUILD_LABEL, COMMAND_DIR, HASH_ARGV, JUDGE_DIR, JUDGE_ITEMS, JUDGE_MAX_TURNS, JUDGE_PROGRAM, JUDGE_REPORT, MAX_ITEMS_BYTES, MAX_REPORT_BYTES, MIN_BUILDX_VERSION, RUNNER_LABEL, builderName, builderNameFor, builderSpec, buildxState, childEnvironment, containerExecArgs, containerRunArgs, createDockerHost, dockerIdentity, ensureBuilder, ensureFailureCount, ensureRunnerIdentity, isOutOfMemory, judgeCommand, parseProgramHash, pathLabelValue, prepareRunArgs, proxyEnvironment, readJobFile, readJobFileChecked, readRunnerIdentity, resolveDevcontainerCli, runnerLabelValue, spawnRun, trackImageBuild, withAnswerProtocol, writeJobFile };

package/dist/{chunk-JGML2VUN.js → chunk-AKKVPUGK.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'node:module';
 import { MAINTAINED_SKILLS } from './chunk-CDDED64E.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';
-import { splitRawFile } from './chunk-RKOTJQVG.js';
+import { splitRawFile } from './chunk-ZUOPFE22.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, readdirSync } from 'fs';
 import { join, dirname } from 'path';
 import { fileURLToPath } from 'url';

package/dist/{chunk-KJIUFOC4.js → chunk-AM3GMWQK.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readCloudConfigStrict, readCloudConfig, cloudConfigPath } from './chunk-PJDQPF5N.js';
-import { signRunnerRequest, signerFor } from './chunk-R7TMTFJP.js';
+import { signRunnerRequest, signerFor } from './chunk-IRF2FKB5.js';
 import { readRepoConnection, findGitDirs } from './chunk-BJ3KTMDH.js';
 import { PLAIN_VERSION, recordCliVersion, removeRecordedVersion } from './chunk-5BHIBJDA.js';
 import { resolvePackageVersion } from './chunk-RA3O54FC.js';

package/dist/{emit-finding-cmd-W2FU4CCF.js → chunk-B5CQJBZ2.js}

@@ -1,34 +1,16 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { launchRefusalForSession } from './chunk-ESVW4MJY.js';
-import { detectActiveSession, autoConnect, transcriptPathForSession } from './chunk-NMIYK2G2.js';
-import './chunk-QFNFBQCG.js';
-import './chunk-BUP5N3X6.js';
-import { resolveRepoIdentity, defaultProjectsDir, findTranscripts, sessionIdFromPath, scrubText } from './chunk-UHU7H57K.js';
-import './chunk-5B7BEQPR.js';
-import './chunk-HOU33DW5.js';
-import './chunk-G2JWZDFA.js';
+import { detectActiveSession, autoConnect, transcriptPathForSession } from './chunk-SJ4DX2AD.js';
+import { resolveRepoIdentity, defaultProjectsDir, findTranscripts, sessionIdFromPath, scrubText } from './chunk-FTGJ3DPV.js';
 import { C } from './chunk-ANPNT6PM.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-KJIUFOC4.js';
-import './chunk-PJDQPF5N.js';
-import './chunk-R7TMTFJP.js';
-import './chunk-DWVAG73B.js';
-import './chunk-N5EEEKT6.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-AM3GMWQK.js';
 import { readLatestProvenanceForSession } from './chunk-ZJSNLVCE.js';
-import './chunk-BJ3KTMDH.js';
-import './chunk-JGML2VUN.js';
-import './chunk-5BHIBJDA.js';
-import './chunk-CDDED64E.js';
-import './chunk-RA3O54FC.js';
 import { launchedItemForSession } from './chunk-T2Q7ISPE.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import './chunk-RKOTJQVG.js';
-import { FindingBatchSchema, FindingsResponseSchema, SAME_PROBLEM_RULES } from './chunk-QZBXLLTV.js';
+import { FindingBatchSchema, FindingsResponseSchema, SAME_PROBLEM_RULES } from './chunk-IWFYKNAO.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import './chunk-XD4ZCMA4.js';
-import './chunk-MESOOLF4.js';
-import './chunk-Z5GEFMRW.js';
 import { readFileSync, existsSync } from 'fs';
 import { join, dirname, basename } from 'path';
 
@@ -580,4 +562,4 @@ async function runEmitFindings(opts) {
   });
 }
 
-export { EmitFindingError, refuseRemovedFindingFlags, runEmitFinding, runEmitFindings };
+export { EmitFindingError, detectUploadSessionId, refuseRemovedFindingFlags, resolveUploadTarget, runEmitFinding, runEmitFindings };

package/dist/{chunk-KBB3CQTW.js → chunk-B6OYEP3K.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-W3K6GBXY.js';
-import { MIN_ENGINE_MAJOR } from './chunk-5Q4NDYQP.js';
-import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-AV5MJY45.js';
-import { runnerCredentialProblem } from './chunk-YYGXCRIW.js';
-import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-DWVAG73B.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-XRRSFHKV.js';
+import { MIN_ENGINE_MAJOR } from './chunk-QQJGL7LG.js';
+import { hasStoredCredential, AGENT_COMMANDS, storeClaudeCredential, credentialFromStdin, isAgentName } from './chunk-5HZDPOJI.js';
+import { runnerCredentialProblem } from './chunk-2ZMJFGOZ.js';
+import { runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-SOWXLIDN.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import { dirname } from 'path';
 

package/dist/{chunk-ITAIEJ2T.js → chunk-BCWVTWS7.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { mcpTargetPath, INIT_STDIO_ENTRY, INIT_DOCS_ENTRY, DOCS_MCP_SERVER_NAME } from './chunk-KT4CN6OU.js';
-import { POLICY_CONTENT, VALIDATOR_FILES, VALIDATORS_DIR, POLICY_PATH } from './chunk-SATUCMAJ.js';
-import { skillsBaseFor } from './chunk-5B7BEQPR.js';
+import { POLICY_CONTENT, VALIDATOR_FILES, VALIDATORS_DIR, POLICY_PATH } from './chunk-XTKH5VAC.js';
+import { skillsBaseFor } from './chunk-QDDPVBIS.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
-import { resolvePackRoot, OUTERLAYER_SKILLS_BASE, skillDir, loadTemplateFiles, rewriteSkillPaths, restoreSkillPaths, TEMPLATE_SKILLS } from './chunk-JGML2VUN.js';
+import { resolvePackRoot, OUTERLAYER_SKILLS_BASE, skillDir, loadTemplateFiles, rewriteSkillPaths, restoreSkillPaths, TEMPLATE_SKILLS } from './chunk-AKKVPUGK.js';
 import { cliInvocation } from './chunk-CRB3POP4.js';
-import { hasSymlinkComponent } from './chunk-VWFOKRYS.js';
+import { hasSymlinkComponent } from './chunk-HJUGOAM7.js';
 import { cloneIsGoverned } from './chunk-YQR6E6OV.js';
 import { createHash } from 'crypto';
 import { existsSync, readFileSync } from 'fs';

package/dist/{chunk-O47BTZSN.js → chunk-D3LS7E7U.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { isVersion, compareVersions } from './chunk-TQMI335S.js';
-import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-DWVAG73B.js';
+import { RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-SOWXLIDN.js';
 import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'fs';
 import { join } from 'path';