@outerlayer/cli 0.32.0 → 0.33.0-next.20261021171323

package/dist/{cli-DLUADCTG.js → cli-YQ64SSV3.js}

@@ -1,44 +1,44 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-7F2VPHP7.js';
-import './chunk-BCWVTWS7.js';
-import './chunk-4XPAQXJF.js';
+import { gatherDoctorChecks, doctorExitCode, summarizeChecks, renderDoctorText, recordWrapped, recordUnwrapped, recordRemoval, readManifest, recordInstall, recordStatusline } from './chunk-LSMF3EET.js';
+import './chunk-KURUM765.js';
+import './chunk-H6Y5D6J7.js';
 import './chunk-KT4CN6OU.js';
-import './chunk-XTKH5VAC.js';
-import { verifiedTrackerNames, TRACKERS } from './chunk-U4HMGT3L.js';
-import './chunk-3DSC2FN3.js';
-import './chunk-IGIGNYZK.js';
-import './chunk-HSUUTD4E.js';
-import './chunk-V36AOTBP.js';
-import { FIRST_VERSION_READING_AGENTS_SKILLS } from './chunk-QDDPVBIS.js';
-import './chunk-G2RRBBOX.js';
+import './chunk-QCDVKCHA.js';
+import { verifiedTrackerNames, TRACKERS } from './chunk-SOTJ2V3A.js';
+import './chunk-JKXTG3BV.js';
+import './chunk-HPOW2VCB.js';
+import './chunk-3H7NZPYG.js';
+import './chunk-GKNF4D62.js';
+import { FIRST_VERSION_READING_AGENTS_SKILLS } from './chunk-ZAJKEHIE.js';
+import './chunk-6C3ZVE62.js';
 import './chunk-G2JWZDFA.js';
 import { C, warnDeprecated, API_KEY_FLAG_DEPRECATION, NO_COLOR_FLAG, stripNoColor } from './chunk-ANPNT6PM.js';
-import './chunk-V6IYYQU3.js';
+import './chunk-FE3RTGJN.js';
 import './chunk-F3EF56LQ.js';
 import './chunk-PJDQPF5N.js';
 import './chunk-APSYTJ6I.js';
 import './chunk-KP6R7CV3.js';
 import './chunk-HDSDUTX4.js';
-import { hookFiredMarkerPath, installedCliDistDir } from './chunk-WRW6QCI6.js';
+import { hookFiredMarkerPath, installedCliDistDir } from './chunk-NHXJU7CM.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-I7RZHMXW.js';
 import './chunk-BKO6JEZI.js';
 import './chunk-HCVLP7XA.js';
 import { findGitDirs } from './chunk-BJ3KTMDH.js';
-import './chunk-UAFMC3PL.js';
-import './chunk-AKKVPUGK.js';
+import './chunk-XRQ7DABQ.js';
+import './chunk-YW4PEGLN.js';
 import './chunk-5BHIBJDA.js';
 import './chunk-CDDED64E.js';
 import { resolveVersion, resolvePackageVersion } from './chunk-RA3O54FC.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
 import { cliInvocation, packageRunnerOf } from './chunk-CRB3POP4.js';
 import { settingsPath, readSettings, SettingsParseError, listHookCandidates, PORTABLE_BIN, wrapHooks, writeSettings, unwrapHooks, REGISTERED_EVENTS, removeHooks, removeStatusline, cliBinResolvable, mergeHooks, repointWrappedHooks, AUTO_WRAP_EVENTS, mergeStatusline } from './chunk-URIZRCRY.js';
-import './chunk-HJUGOAM7.js';
+import './chunk-WXEPMPHK.js';
 import { cloneIsGoverned } from './chunk-YQR6E6OV.js';
 import { removeJournalHooks, removePreCommitGuardHook } from './chunk-TUSYOL2O.js';
-import './chunk-ZUOPFE22.js';
-import './chunk-IWFYKNAO.js';
+import './chunk-JUXATN46.js';
+import './chunk-3WW2TL7V.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import './chunk-XD4ZCMA4.js';
 import './chunk-MESOOLF4.js';
@@ -3658,14 +3658,14 @@ function apiKeyOption() {
   return new Option("--api-key <key>", `deprecated: use \`${cliInvocation()} login\` or OUTERLAYER_API_KEY`).hideHelp();
 }
 async function installStarterPackInRepo() {
-  const { installStarterPack, formatStarterPackOutput } = await import('./starter-pack-2WFNRGFA.js');
+  const { installStarterPack, formatStarterPackOutput } = await import('./starter-pack-6O7F6P7C.js');
   const cwd = process.cwd();
   let repoRoot = cwd;
   try {
     repoRoot = execFileSync("git", ["rev-parse", "--show-toplevel"], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || cwd;
   } catch {
   }
-  const { declareAgentsMdLayout, isAgentsMdLayout, skillsBaseFor } = await import('./layout-3ISIED6A.js');
+  const { declareAgentsMdLayout, isAgentsMdLayout, skillsBaseFor } = await import('./layout-OQ7EJUMH.js');
   const fresh = !isAgentsMdLayout(repoRoot) && !existsSync(join(repoRoot, ".outerlayer"));
   const result = installStarterPack({ repoRoot, base: fresh ? ".agents/skills" : skillsBaseFor(repoRoot) });
   if (fresh) declareAgentsMdLayout(repoRoot);
@@ -3791,7 +3791,7 @@ ${starter.output}`),
   }
 }
 async function installMachineSkillsForSetup() {
-  const { setupMachineSkills } = await import('./machine-skills-I4DB2CP3.js');
+  const { setupMachineSkills } = await import('./machine-skills-XWWYFNOZ.js');
   const result = setupMachineSkills(homeFromEnv());
   for (const failure of result.failures) process.stderr.write(`${C.yellow}!${C.reset} Could not write a maintained skill: ${failure}
 `);
@@ -3799,8 +3799,8 @@ async function installMachineSkillsForSetup() {
 ` : "";
 }
 async function realConnectDepsForCwd() {
-  const { realConnectDeps } = await import('./connect-cmd-K73AOVUR.js');
-  const { resolveRepoIdentity } = await import('./dist-BE3LYGNH.js');
+  const { realConnectDeps } = await import('./connect-cmd-HVHPNVAJ.js');
+  const { resolveRepoIdentity } = await import('./dist-MKY2BSYN.js');
   return {
     ...realConnectDeps(),
     home: homeFromEnv(),
@@ -3817,7 +3817,7 @@ function buildProgram(argv = process.argv) {
   const program2 = new Command();
   program2.name(cliInvocation()).description("OuterLayer \u2014 see what your coding agents actually do").enablePositionalOptions().version(resolveVersion()).hook("preAction", async (_root, command) => {
     if (command.opts().apiKey !== void 0) warnDeprecated(API_KEY_FLAG_DEPRECATION);
-    const { machineRefreshSkipped, refreshMachineSkills } = await import('./machine-skills-I4DB2CP3.js');
+    const { machineRefreshSkipped, refreshMachineSkills } = await import('./machine-skills-XWWYFNOZ.js');
     const names = [];
     for (let at = command; at?.parent; at = at.parent) names.push(at.name());
     if (!machineRefreshSkipped(names, command._hidden === true, argv)) refreshMachineSkills(homeFromEnv());
@@ -3874,8 +3874,8 @@ build, ../outerlayer-build/SKILL.md becomes ~/.agents/skills/outerlayer-build/SK
 what CLIs older than ${FIRST_VERSION_READING_AGENTS_SKILLS} do. \`` + cliInvocation() + " doctor` reports the same\nstates under Starter files.\n"
   ).action(async (opts) => {
     if (opts.update || opts.dryRun) {
-      const { runInitUpdateWithFleet, formatInitUpdate, updateFlagProblem } = await import('./init-update-PMDRKPA2.js');
-      const { fleetReadiness } = await import('./fleet-readiness-JEQ5ITV6.js');
+      const { runInitUpdateWithFleet, formatInitUpdate, updateFlagProblem } = await import('./init-update-OIFOUIAN.js');
+      const { fleetReadiness } = await import('./fleet-readiness-7ROJ54ZF.js');
       const problem = updateFlagProblem(opts);
       if (problem !== void 0) {
         fail(problem);
@@ -3892,7 +3892,7 @@ what CLIs older than ${FIRST_VERSION_READING_AGENTS_SKILLS} do. \`` + cliInvocat
     }
     let starterTemplate;
     if (opts.template !== void 0) {
-      const { assertKnownTemplate, StarterPackError } = await import('./starter-pack-2WFNRGFA.js');
+      const { assertKnownTemplate, StarterPackError } = await import('./starter-pack-6O7F6P7C.js');
       try {
         assertKnownTemplate(opts.template);
       } catch (err) {
@@ -3926,13 +3926,13 @@ what CLIs older than ${FIRST_VERSION_READING_AGENTS_SKILLS} do. \`` + cliInvocat
         if (changed.length > 0 && !opts.json) process.stdout.write(`Removed the claude function from ${changed.join(", ")}.
 `);
       }
-      const shell = !opts.remove && opts.shellFunction !== void 0 ? (await import('./init-cmd-ALBPEG7I.js')).applyShellFunctionFlag(opts.shellFunction, { home: homeFromEnv(), shellPath: process.env.SHELL }) : void 0;
+      const shell = !opts.remove && opts.shellFunction !== void 0 ? (await import('./init-cmd-STCU6RGY.js')).applyShellFunctionFlag(opts.shellFunction, { home: homeFromEnv(), shellPath: process.env.SHELL }) : void 0;
       if (opts.json) writeJson(shell === void 0 ? outcome.result : { ...outcome.result, shellFunction: { outcome: shell.outcome, reason: shell.reason } });
       else process.stdout.write(outcome.text + skillsLine + (shell?.text ?? ""));
       return;
     }
     await installMachineSkillsForSetup();
-    const { runInitCommand } = await import('./init-cmd-ALBPEG7I.js');
+    const { runInitCommand } = await import('./init-cmd-STCU6RGY.js');
     const code = await runInitCommand(
       { json: opts.json, factory: opts.factory, shellFunction: opts.shellFunction },
       {
@@ -3944,7 +3944,7 @@ what CLIs older than ${FIRST_VERSION_READING_AGENTS_SKILLS} do. \`` + cliInvocat
           return { ok, text, detail };
         },
         runAgentSetup: async () => {
-          const { runAgentSetup } = await import('./agent-setup-E7CMDUR5.js');
+          const { runAgentSetup } = await import('./agent-setup-NSUX64RU.js');
           return runAgentSetup({ cwd: process.cwd(), skillsLink: opts.skillsLink !== false });
         },
         runDoctorChecks: gatherDoctorChecks,
@@ -3953,7 +3953,7 @@ what CLIs older than ${FIRST_VERSION_READING_AGENTS_SKILLS} do. \`` + cliInvocat
           shellPath: process.env.SHELL,
           interactive: Boolean(process.stdin.isTTY && process.stderr.isTTY) && opts.json !== true,
           ask: async () => {
-            const { promptOnTerminal } = await import('./connect-cmd-K73AOVUR.js');
+            const { promptOnTerminal } = await import('./connect-cmd-HVHPNVAJ.js');
             const answer = await promptOnTerminal({
               message: `Should plain claude start Claude Code through ${cliInvocation()} claude? That is how a session in a governed repository gets its control plane. It adds one block to your zsh or bash startup file.`,
               options: [
@@ -3992,7 +3992,7 @@ linked (true, false, or null when it could not be checked) and, when false,
 linkUrl.
 `
   ).action(async (opts) => {
-    const { runConnectCommand } = await import('./connect-cmd-K73AOVUR.js');
+    const { runConnectCommand } = await import('./connect-cmd-HVHPNVAJ.js');
     const code = await runConnectCommand({ factory: opts.factory, json: opts.json }, await realConnectDepsForCwd(), {
       stdout: process.stdout,
       stderr: process.stderr
@@ -4031,7 +4031,7 @@ Every later command reads the saved file, so none of them needs a key on
 its command line. A saved key is checked for real on the first \`sync\`.
 `
   ).action(async (opts) => {
-    const { runLoginCommand, realLoginDeps } = await import('./login-browser-NTVVDJF7.js');
+    const { runLoginCommand, realLoginDeps } = await import('./login-browser-KP7YVYTN.js');
     const code = await runLoginCommand(
       {
         browser: opts.browser !== false,
@@ -4064,13 +4064,13 @@ code is 1: revoke the token on /profile/security.
     "\nIncremental: only sessions newer than the last checkpoint ship. The tier\nis applied on this machine before anything leaves it; `--dry-run` prints\nexactly what would. The hook-triggered background sync runs `--quiet`.\nExit 2 means the server rejected at least one session.\n"
   ).action(async (opts) => {
     if (opts.link !== void 0) {
-      const { lookupArtifactLink } = await import('./artifact-link-cmd-VY6OM7S5.js');
+      const { lookupArtifactLink } = await import('./artifact-link-cmd-IGVFGHC2.js');
       const found = lookupArtifactLink(opts.link);
       if (found.ok) process.stdout.write(found.url + "\n");
       else fail(found.reason);
       return;
     }
-    const { runSync, SyncConfigError, SyncTransportError } = await import('./sync-cmd-NISS7HJJ.js');
+    const { runSync, SyncConfigError, SyncTransportError } = await import('./sync-cmd-O6UIF4QJ.js');
     try {
       const result = await runSync({
         url: opts.url,
@@ -4101,7 +4101,7 @@ code is 1: revoke the token on /profile/security.
     if (invokedCommandToken(argv) === "watch") {
       warnDeprecated(`\`${cliInvocation()} watch\` is now \`${cliInvocation()} daemon\`; the old name will be removed in a future release.`);
     }
-    const { runWatch } = await import('./watch-VSTJUIRH.js');
+    const { runWatch } = await import('./watch-5HMOSQ4Z.js');
     await runWatch({ once: opts.once });
   });
   program2.command("hook <event>", { hidden: true }).description("capture-hook fast path, installed by `init`").action(() => {
@@ -4191,7 +4191,7 @@ code is 1: revoke the token on /profile/security.
     process.exitCode = await runBuildCommand({ dir: opts.dir, argv: command });
   });
   program2.command("session-sender", { hidden: true }).description("stream a runner build's sessions to its work item while the build runs").action(async () => {
-    const { runSessionSender } = await import('./session-sender-S6KG6VOM.js');
+    const { runSessionSender } = await import('./session-sender-PHQ6PJVD.js');
     try {
       await runSessionSender();
     } catch (err) {
@@ -4234,7 +4234,7 @@ async function runCli(processArgv) {
   await buildProgram(argv).parseAsync(argv);
 }
 async function compileContext(opts) {
-  const { runEmit, EmitError } = await import('./emit-cmd-PSD7AAKJ.js');
+  const { runEmit, EmitError } = await import('./emit-cmd-T7NIBSF3.js');
   try {
     const result = runEmit({ cwd: opts.dir, check: opts.check, json: opts.json });
     if (result.exitCode !== 0) process.exitCode = result.exitCode;
@@ -4275,7 +4275,8 @@ A person's pass or fail on one criterion's proof is recorded on that
 criterion's thread instead \u2014 see \`${cliInvocation()} work comment\`.
 
 Subcommands: \`emit artifact <file>\` for screenshots, recordings, reports and
-logs; \`emit finding\` / \`emit findings <file>\` to record a problem in the factory;
+logs; \`emit demo <manifest>\` for a narrated demo with one chapter per criterion;
+\`emit finding\` / \`emit findings <file>\` to record a problem in the factory;
 \`emit criteria <file>\` to record a work item's acceptance criteria;
 \`emit step <name>\` to report that you started a step.
 Compiling .outerlayer/ moved to \`${cliInvocation()} context emit\`.
@@ -4286,7 +4287,7 @@ Compiling .outerlayer/ moved to \`${cliInvocation()} context emit\`.
       await compileContext({ dir: opts.dir, check: opts.check, json: opts.json });
       return;
     }
-    const { runEmitResult, EmitResultError } = await import('./emit-result-cmd-YQ5DZMMR.js');
+    const { runEmitResult, EmitResultError } = await import('./emit-result-cmd-PFQ6HSVN.js');
     try {
       const result = await runEmitResult({
         name,
@@ -4337,7 +4338,7 @@ everywhere, bytes and deep link untouched; a still-queued one is cancelled
 locally so it never uploads. One correction can retire several duplicates.
 `
   ).action(async (file, opts) => {
-    const { runEmitArtifact, EmitArtifactError } = await import('./emit-artifact-cmd-NCK3VCDM.js');
+    const { runEmitArtifact, EmitArtifactError } = await import('./emit-artifact-cmd-YRRXCZAI.js');
     let pr;
     if (opts.pr !== void 0) {
       pr = parseTrackerNumber(opts.pr);
@@ -4367,6 +4368,60 @@ locally so it never uploads. One correction can retire several duplicates.
       throw err;
     }
   });
+  emitCmd.command("demo <manifest>").description("Emit a narrated demo: one video artifact for each chapter of a recorded manifest").option("--no-narration", "store the clips with no speech; needs neither espeak-ng nor the voice pack").option("--item <number>", "work item whose recorded criteria the chapters are checked against").option("--pr <number>", "pull request number to anchor to, outside a recorded session").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
+    "after",
+    `
+  ${cliInvocation()} emit demo test-results/demo/manifest.json --item 412
+
+The manifest is the JSON file \`@outerlayer/playwright\` writes next to its video. Each chapter
+becomes one WebM clip (VP9 video, Opus speech) and is emitted as a video artifact. A chapter whose
+checks all passed is bound to its criterion; a chapter with a failed check, and an opening chapter
+with no criterion, is stored unbound. The manifest is then emitted as the demo record.
+Needs ffmpeg and ffprobe on PATH, and espeak-ng unless --no-narration is given. The first narrated
+run downloads the voice pack (about 400 MB) to ~/.outerlayer/voice/ and checks it against pinned
+sha256 hashes. Every refusal comes before the first upload. Exit 1 means a chapter had a failed
+check: its clip and the record are stored all the same.
+`
+  ).action(async (manifest, opts) => {
+    const { runEmitDemo, EmitDemoError } = await import('./emit-demo-cmd-RJPSISCC.js');
+    let item;
+    if (opts.item !== void 0) {
+      item = parseTrackerNumber(opts.item);
+      if (item === void 0) {
+        fail(trackerNumberError("--item", opts.item));
+        return;
+      }
+    }
+    let pr;
+    if (opts.pr !== void 0) {
+      pr = parseTrackerNumber(opts.pr);
+      if (pr === void 0) {
+        fail(trackerNumberError("--pr", opts.pr));
+        return;
+      }
+    }
+    try {
+      const result = await runEmitDemo({
+        manifest,
+        noNarration: opts.narration === false,
+        item,
+        pr,
+        json: opts.json,
+        url: opts.url,
+        apiKey: opts.apiKey,
+        appId: opts.appId
+      });
+      for (const failure of result.failures) process.stderr.write(`${C.red}\u2717${C.reset} ${failure}
+`);
+      if (result.exitCode !== 0) process.exitCode = result.exitCode;
+    } catch (err) {
+      if (err instanceof EmitDemoError) {
+        fail(err.message);
+        return;
+      }
+      throw err;
+    }
+  });
   emitCmd.command("finding").description("Record one finding: a problem you hit in the factory").requiredOption("--id <id>", "client id \u2014 re-emitting the same id replaces it").option("--category <context|flaky-test|tooling|environment|defect|other>", "what kind of problem this is").requiredOption("--title <text>", "one sentence").requiredOption("--file <path>", "the file the problem is in, or the instruction's own path").option("--line <number>", "line number in --file").option("--rule-path <path>", "the instruction's own path \u2014 required for a context finding").option("--rule-line <number>", "line number in --rule-path").option("--rule-quote <text>", "the instruction's quoted sentence \u2014 required unless --rule-relation is missing").option("--rule-relation <wrong|broken|missing>", "how the instruction fails \u2014 required for a context finding").requiredOption("--where <label>", 'where this was recorded, e.g. "build session"').option("--detail <text>", "what happened, a few paragraphs").option("--cause <text>", 'what is actually wrong, or "unknown"').option("--suggestion <text>", "what would help").option("--command <text>", "the command that misbehaved").option("--error <text>", "the first error line").option("--test <name>", "the test name, for a flaky test").option("--symbol <name>", "the function the problem is in, for a defect").option("--started-at <event>", "event id where you hit the problem (default: first output showing --error)").option("--ended-at <event>", "event id where you got past it (default: the newest event)").option("--untimed", "record no time, only when the problem cost none in this session").option("--find <text>", "list this session's events that contain the text, and record nothing").option("--problem <id>", "a problem this finding reports; repeat for each one (needs --link-reason)", (value, previous = []) => [...previous, value]).option("--link-reason <text>", "why the finding reports each --problem").option("--new", "record a new problem instead of linking an existing one").option("--trace-id <id>", "the session's trace id, when there is one").option("--turn <number>", "turn index within the session").option("--round <number>", "round number, when there is one").addOption(new Option("--subject <value>").hideHelp()).addOption(new Option("--kind <value>").hideHelp()).addOption(new Option("--severity <value>").hideHelp()).addOption(new Option("--verdict <value>").hideHelp()).addOption(new Option("--fixed").hideHelp()).addOption(new Option("--source <value>").hideHelp()).option("--head-sha <sha>", "the commit this batch was recorded against").option("--context-source-sha <sha>", "the context-source commit this batch was recorded against").option("--item <number>", "work item to record on directly, by its number in this factory").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").addHelpText(
     "after",
     `
@@ -4396,7 +4451,7 @@ recent events with their ids. --find <text> searches all of them.
 item that session was launched for is used automatically.
 `
   ).action(async (opts) => {
-    const { runEmitFinding, refuseRemovedFindingFlags, EmitFindingError } = await import('./emit-finding-cmd-OUG72OQA.js');
+    const { runEmitFinding, refuseRemovedFindingFlags, EmitFindingError } = await import('./emit-finding-cmd-6FVW3GGK.js');
     try {
       refuseRemovedFindingFlags(opts);
       const result = await runEmitFinding({
@@ -4463,7 +4518,7 @@ the whole batch. "untimed": true records one with no time on purpose.
 that session was launched for is used automatically.
 `
   ).action(async (file, opts) => {
-    const { runEmitFindings, EmitFindingError } = await import('./emit-finding-cmd-OUG72OQA.js');
+    const { runEmitFindings, EmitFindingError } = await import('./emit-finding-cmd-6FVW3GGK.js');
     try {
       const result = await runEmitFindings({
         file,
@@ -4498,7 +4553,7 @@ command, the command exits 0, and \`sync\` sends it later. If the gateway refuse
 the step, the command prints why and exits 1.
 `
   ).action(async (name, opts) => {
-    const { runEmitStep, EmitStepError } = await import('./emit-step-cmd-QJXSHSQF.js');
+    const { runEmitStep, EmitStepError } = await import('./emit-step-cmd-U32Y4PZJ.js');
     try {
       await runEmitStep({
         name,
@@ -4541,7 +4596,7 @@ of the item, and a (proof: <kind>) annotation names its proof.
   ${cliInvocation()} emit criteria acceptance/412-login.md --item 412
 `
   ).action(async (file, opts) => {
-    const { runEmitCriteria, EmitCriteriaError } = await import('./emit-criteria-cmd-GTCZWV4B.js');
+    const { runEmitCriteria, EmitCriteriaError } = await import('./emit-criteria-cmd-PSQORVHS.js');
     try {
       const result = await runEmitCriteria({
         file,
@@ -4565,9 +4620,9 @@ function registerSpecCommands(program2) {
   const specCmd = program2.command("spec").description("Find, file and edit the issue a spec lives in, in your factory's tracker");
   const credentialOptions = (command) => command.option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)");
   const run = async (action) => {
-    const { WorkCommandError } = await import('./work-cmd-B7YCAK5M.js');
+    const { WorkCommandError } = await import('./work-cmd-3G26E3NL.js');
     try {
-      await action(await import('./spec-cmd-4RD3A55B.js'));
+      await action(await import('./spec-cmd-SAMHN5FU.js'));
     } catch (err) {
       if (err instanceof WorkCommandError) {
         fail(err.message);
@@ -4602,7 +4657,7 @@ Prints each problem the item covers with its id, its reports and its result.
 session was launched for is used.
 `
   ).action(async (opts) => {
-    const { runFindingsShow, FindingsCommandError } = await import('./findings-cmd-DYDEHJFI.js');
+    const { runFindingsShow, FindingsCommandError } = await import('./findings-cmd-AMYNXO3S.js');
     try {
       const result = await runFindingsShow({
         item: opts.item,
@@ -4630,7 +4685,7 @@ Give exactly one of --fixed and --not-fixed, and a --note. Run it again for the
 problem to replace the earlier result. A problem the item does not cover is refused.
 `
   ).action(async (problem, opts) => {
-    const { runFindingsResult, FindingsCommandError } = await import('./findings-cmd-DYDEHJFI.js');
+    const { runFindingsResult, FindingsCommandError } = await import('./findings-cmd-AMYNXO3S.js');
     try {
       const result = await runFindingsResult({
         problem,
@@ -4671,7 +4726,7 @@ takes it, and prints the line that starts your session on it. That
 session links itself and holds the item's lease while it works.
 `
   ).action(async (opts) => {
-    const { runWorkBuild, WorkCommandError } = await import('./work-cmd-B7YCAK5M.js');
+    const { runWorkBuild, WorkCommandError } = await import('./work-cmd-3G26E3NL.js');
     try {
       await runWorkBuild(opts);
     } catch (err) {
@@ -4694,7 +4749,7 @@ renews that session's own 20-minute lease, unless --no-lease or
 --ended is given, or another worker already holds a live one.
 `
   ).action(async (number, opts) => {
-    const { runWorkLinkSession, WorkCommandError } = await import('./work-cmd-B7YCAK5M.js');
+    const { runWorkLinkSession, WorkCommandError } = await import('./work-cmd-3G26E3NL.js');
     try {
       await runWorkLinkSession({ ...opts, number, noLease: opts.lease === false, logFailures: opts.logFailures === true });
     } catch (err) {
@@ -4718,8 +4773,8 @@ criterion's new proof; --ready hands the thread back to a person. At
 most one action flag may be given.
 `
   ).action(async (opts) => {
-    const { runWorkComment, WorkCommentCommandError } = await import('./work-comment-cmd-2X55NLNL.js');
-    const { WorkCommandError } = await import('./work-cmd-B7YCAK5M.js');
+    const { runWorkComment, WorkCommentCommandError } = await import('./work-comment-cmd-S6EGHGHL.js');
+    const { WorkCommandError } = await import('./work-cmd-3G26E3NL.js');
     try {
       await runWorkComment(opts);
     } catch (err) {
@@ -4740,8 +4795,8 @@ criterion that carries proof or a comment, each with who is waiting
 on whom next.
 `
   ).action(async (opts) => {
-    const { runWorkThreads, WorkCommentCommandError } = await import('./work-comment-cmd-2X55NLNL.js');
-    const { WorkCommandError } = await import('./work-cmd-B7YCAK5M.js');
+    const { runWorkThreads, WorkCommentCommandError } = await import('./work-comment-cmd-S6EGHGHL.js');
+    const { WorkCommandError } = await import('./work-cmd-3G26E3NL.js');
     try {
       await runWorkThreads(opts);
     } catch (err) {
@@ -4765,8 +4820,8 @@ still running, or that an older runner released, has no log and the
 command exits 1.
 `
   ).action(async (opts) => {
-    const { runWorkLogs, WorkLogsCommandError } = await import('./work-logs-cmd-2CE5B2DP.js');
-    const { WorkCommandError } = await import('./work-cmd-B7YCAK5M.js');
+    const { runWorkLogs, WorkLogsCommandError } = await import('./work-logs-cmd-RQILRNHS.js');
+    const { WorkCommandError } = await import('./work-cmd-3G26E3NL.js');
     try {
       await runWorkLogs(opts);
     } catch (err) {
@@ -4789,8 +4844,8 @@ item is not built again until a new build request. Exits 1 when no host
 build is running for the item.
 `
   ).action(async (opts) => {
-    const { runWorkStop, WorkStopCommandError } = await import('./work-stop-cmd-CWNLRQKE.js');
-    const { WorkCommandError } = await import('./work-cmd-B7YCAK5M.js');
+    const { runWorkStop, WorkStopCommandError } = await import('./work-stop-cmd-AGZWXGRP.js');
+    const { WorkCommandError } = await import('./work-cmd-3G26E3NL.js');
     try {
       await runWorkStop(opts);
     } catch (err) {
@@ -4811,7 +4866,7 @@ deletes anything \u2014 the item is removed from Work only once no
 live addition remains on it.
 `
   ).action(async (opts) => {
-    const { runWorkRemove, WorkCommandError } = await import('./work-cmd-B7YCAK5M.js');
+    const { runWorkRemove, WorkCommandError } = await import('./work-cmd-3G26E3NL.js');
     try {
       await runWorkRemove(opts);
     } catch (err) {
@@ -4823,7 +4878,7 @@ live addition remains on it.
     }
   });
   workCmd.command("status").description("Show one item's stage, gate ledger, and additions").option("--item <number>", "the item's number inside this factory").option("--issue <number>", "issue number, or a Linear/Jira key like ENG-123").option(TRACKER_OPTION_FLAG, "tracker for a keyed --issue, when both hold the key").option("--repo <owner/name>", "repository for an issue number (default: the checkout's remote)").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").action(async (opts) => {
-    const { runWorkStatus, WorkCommandError } = await import('./work-cmd-B7YCAK5M.js');
+    const { runWorkStatus, WorkCommandError } = await import('./work-cmd-3G26E3NL.js');
     try {
       await runWorkStatus(opts);
     } catch (err) {
@@ -4835,7 +4890,7 @@ live addition remains on it.
     }
   });
   workCmd.command("list").description("List live work items for this factory").option("--stage <spec|build|review>", "filter by stage").option("--section <attention|waiting|flowing>", "filter by Queue section").option("--repo <owner/name>", "repository (default: the current checkout's remote)").option("--unclaimed", "only items with no live lease").option("--claimed", "only items with a live lease, held by a host or a local session").option("--startable", "only items a host can start: a build request, no open PR, no live lease").option("--needs <amend>", "only items with a thread waiting on an agent").option("--json", "machine-readable JSON output").option("--url <url>", "cloud base URL (or OUTERLAYER_URL / config)").addOption(apiKeyOption()).option("--app-id <id>", "factory id the key is bound to (or OUTERLAYER_APP_ID / config)").action(async (opts) => {
-    const { runWorkList, WorkCommandError } = await import('./work-cmd-B7YCAK5M.js');
+    const { runWorkList, WorkCommandError } = await import('./work-cmd-3G26E3NL.js');
     try {
       await runWorkList(opts);
     } catch (err) {
@@ -4856,7 +4911,7 @@ by a different key is refused; claiming again with the same key extends
 it. --host is a label only.
 `
   ).action(async (opts) => {
-    const { runWorkClaim, WorkCommandError } = await import('./work-claim-cmd-27OJUZ56.js');
+    const { runWorkClaim, WorkCommandError } = await import('./work-claim-cmd-6W7BW4O6.js');
     try {
       await runWorkClaim(opts);
     } catch (err) {
@@ -4876,7 +4931,7 @@ Extends the live lease this API key holds. Refused with a 410 if the
 lease has expired, or a 403 if a different key holds it.
 `
   ).action(async (opts) => {
-    const { runWorkRenew, WorkCommandError } = await import('./work-claim-cmd-27OJUZ56.js');
+    const { runWorkRenew, WorkCommandError } = await import('./work-claim-cmd-6W7BW4O6.js');
     try {
       await runWorkRenew(opts);
     } catch (err) {
@@ -4908,7 +4963,7 @@ applies to a host's lease only. A later tool call in the session
 takes the lease again.
 `
   ).action(async (opts) => {
-    const { runWorkRelease, WorkCommandError } = await import('./work-claim-cmd-27OJUZ56.js');
+    const { runWorkRelease, WorkCommandError } = await import('./work-claim-cmd-6W7BW4O6.js');
     try {
       await runWorkRelease(opts);
     } catch (err) {
@@ -4935,7 +4990,7 @@ Idempotent: declaring the same pull request twice is a no-op.
 needs your own login; an agent session or a factory key is refused.
 `
   ).action(async (number, opts) => {
-    const { runWorkPr, WorkPrCommandError } = await import('./work-pr-cmd-MT246E2A.js');
+    const { runWorkPr, WorkPrCommandError } = await import('./work-pr-cmd-D3PJJQOX.js');
     try {
       await runWorkPr({ ...opts, number });
     } catch (err) {
@@ -4960,8 +5015,8 @@ login, then declares the pull request on the item, as \`work pr\` does.
 Run it again after a change to the title or description.
 `
   ).action(async (opts) => {
-    const { runWorkOpenPr, WorkOpenPrCommandError } = await import('./work-open-pr-cmd-Q3HZJPSD.js');
-    const { WorkCommandError } = await import('./work-cmd-B7YCAK5M.js');
+    const { runWorkOpenPr, WorkOpenPrCommandError } = await import('./work-open-pr-cmd-5CDP6KOF.js');
+    const { WorkCommandError } = await import('./work-cmd-3G26E3NL.js');
     try {
       await runWorkOpenPr(opts);
     } catch (err) {
@@ -4978,7 +5033,7 @@ function registerRunnerCommands(program2) {
   const configOption = "the cloud config file to run against (default: ~/.outerlayer/config.json)";
   runnerCmd.command("start").description("Run the loop: claim work, run it, report, clean up, repeat").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-3JRFDYZL.js');
-    const { start, RunnerStartError } = await import('./loop-XDJYLT4D.js');
+    const { start, RunnerStartError } = await import('./loop-NUW7SSZY.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-BMFAUQAI.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     try {
@@ -4997,8 +5052,8 @@ function registerRunnerCommands(program2) {
     "\nReads OUTERLAYER_URL, OUTERLAYER_APP_ID, OUTERLAYER_API_KEY, OUTERLAYER_RUNNER_NAME and one Claude credential\n(CLAUDE_CODE_OAUTH_TOKEN or ANTHROPIC_API_KEY) from the environment. OUTERLAYER_AGENT\nis optional and defaults to claude. On a later start it refuses variables that disagree with the config in the volume.\nThe image sets OUTERLAYER_RUNNER_IMAGE; outside the image, use `runner start`.\n"
   ).action(async () => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-3JRFDYZL.js');
-    const { containerStart } = await import('./container-start-4RJRBPVB.js');
-    const { start, RunnerStartError } = await import('./loop-XDJYLT4D.js');
+    const { containerStart } = await import('./container-start-DP3N72CK.js');
+    const { start, RunnerStartError } = await import('./loop-NUW7SSZY.js');
     const { RunnerAlreadyRunningError } = await import('./pidfile-BMFAUQAI.js');
     try {
       const result = await containerStart({
@@ -5018,7 +5073,7 @@ function registerRunnerCommands(program2) {
   });
   runnerCmd.command("check").description("Validate the config, the hooks and the key, and print the effective settings").option("--config <path>", configOption).action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-3JRFDYZL.js');
-    const { runRunnerCheck } = await import('./check-COMHCLXW.js');
+    const { runRunnerCheck } = await import('./check-3TQJDGKM.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const result = await runRunnerCheck(configPath);
     if (!result.ok) {
@@ -5052,7 +5107,7 @@ function registerRunnerCommands(program2) {
     }
     try {
       if (opts.service === true) {
-        const { installServiceCommand } = await import('./command-JRWYFDNM.js');
+        const { installServiceCommand } = await import('./command-RFVCDSJV.js');
         const result2 = await installServiceCommand({
           configPath,
           print: opts.print,
@@ -5108,7 +5163,7 @@ To keep it running, run ${C.yellow}${cliInvocation()} runner install --service${
       return;
     }
     const { defaultRunnerConfigPath } = await import('./config-3JRFDYZL.js');
-    const { uninstallServiceCommand } = await import('./command-JRWYFDNM.js');
+    const { uninstallServiceCommand } = await import('./command-RFVCDSJV.js');
     const result = await uninstallServiceCommand({ configPath: opts.config ?? defaultRunnerConfigPath(), unitName: opts.unitName, home: homeFromEnv() });
     if (result.ok) for (const line of result.lines) process.stdout.write(`${C.green}\u2713${C.reset} ${line}
 `);
@@ -5136,10 +5191,10 @@ already in claude.env is used.
 `
   ).action(async (opts) => {
     const { defaultRunnerConfigPath, RunnerConfigError } = await import('./config-3JRFDYZL.js');
-    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-SYNDV44H.js');
-    const { obtainRunnerKey, runnerKeyLogin } = await import('./runner-key-7QNJNPQ6.js');
-    const { detectMachine } = await import('./machine-GC4MZB5W.js');
-    const { chooseVm, runVmInit, VmInitError } = await import('./init-CSXI3OQH.js');
+    const { prepareRunnerInit, runRunnerInit, RunnerInitError, writeRunnerInit } = await import('./init-QDUIHSTK.js');
+    const { obtainRunnerKey, runnerKeyLogin } = await import('./runner-key-YHAJFEGN.js');
+    const { detectMachine } = await import('./machine-BJ7TT3B7.js');
+    const { chooseVm, runVmInit, VmInitError } = await import('./init-CHWFDK23.js');
     const { AGENT_COMMANDS, credentialFromStdin, isAgentName, restartForCredential, RunnerEnvError } = await import('./runner-env-66RAFIDJ.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     if (opts.agent !== void 0 && !isAgentName(opts.agent)) {
@@ -5154,7 +5209,7 @@ already in claude.env is used.
     try {
       let credential;
       if (agent !== void 0) {
-        const { readPipedKey } = await import('./login-browser-NTVVDJF7.js');
+        const { readPipedKey } = await import('./login-browser-KP7YVYTN.js');
         credential = credentialFromStdin(
           await readPipedKey(process.stdin, {
             onWaiting: () => process.stderr.write(`runner init is waiting for Claude's credential on stdin; close stdin to use the one already in claude.env
@@ -5290,7 +5345,7 @@ ${C.yellow}The runner will not update itself: ${installErr.message}${C.reset}
       let serviceUp = false;
       let restart;
       if (installedLayout) {
-        const { installServiceCommand } = await import('./command-JRWYFDNM.js');
+        const { installServiceCommand } = await import('./command-RFVCDSJV.js');
         const service = await installServiceCommand({
           configPath,
           entryPath: process.argv[1] ?? "",
@@ -5335,10 +5390,10 @@ Next:
     "\nA repository governed by a control plane builds the control plane's image, at the commit\nthe gateway has stored for it. A repository that governs itself fetches the head of its\ndefault branch into the runner's cache. Either way it reads .devcontainer/devcontainer.json\nand builds the image with the devcontainer CLI. Settings\nthat reach the host or widen the container's privileges are ignored and listed. The\nimage holds this CLI and a pinned Claude Code. Nothing runs inside the image.\n"
   ).action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-3JRFDYZL.js');
-    const { buildRepositoryImage, RecipeError } = await import('./build-7QD3VJ6U.js');
+    const { buildRepositoryImage, RecipeError } = await import('./build-HU24C46Z.js');
     const { currentCliBuild } = await import('./cli-build-K56DK4DS.js');
-    const { createDockerHost } = await import('./docker-CVRCHNYC.js');
-    const { builderSpec } = await import('./builder-REQJGZJP.js');
+    const { createDockerHost } = await import('./docker-6G6IF4YO.js');
+    const { builderSpec } = await import('./builder-VFREWHZA.js');
     const { loadRunnerConfig } = await import('./config-3JRFDYZL.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const loaded = (() => {
@@ -5350,11 +5405,11 @@ Next:
     })();
     const memory = loaded?.build?.memory ?? "8g";
     try {
-      const { ensureRunnerIdentity } = await import('./runner-identity-D3XUB36T.js');
+      const { ensureRunnerIdentity } = await import('./runner-identity-FL67WQIA.js');
       await ensureRunnerIdentity(configPath, { log: (line) => console.error(line) }).catch((err) => {
         console.error(`the runner's Docker identity could not be stored: ${err instanceof Error ? err.message : String(err)}`);
       });
-      const { imageTargetFor } = await import('./governing-source-JSYW4RCL.js');
+      const { imageTargetFor } = await import('./governing-source-DYJQCHKU.js');
       const target = await imageTargetFor({ config: loaded, repository: opts.repository, fetchImpl: fetch });
       if (!target.ok) {
         if (opts.json) {
@@ -5418,7 +5473,7 @@ Next:
   });
   runnerCmd.command("stop").description("Take no more work; finish running jobs, then exit").option("--config <path>", "the cloud config file naming the runner to stop").option("--now", "end running jobs immediately, with outcome stopped").action(async (opts) => {
     const { defaultRunnerConfigPath } = await import('./config-3JRFDYZL.js');
-    const { requestStop } = await import('./loop-XDJYLT4D.js');
+    const { requestStop } = await import('./loop-NUW7SSZY.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const { runnerImageVersion } = await import('./image-tag-NM2YT2J2.js');
     await requestStop(configPath, Boolean(opts.now), void 0, { image: runnerImageVersion() !== void 0 });
@@ -5426,8 +5481,8 @@ Next:
   runnerCmd.command("status").description("List running jobs; with --recent, finished ones too").option("--config <path>", "the cloud config file naming the runner to inspect").option("--recent", "also list finished jobs, newest first, capped at 20").option("--json", "machine-readable JSON output").action(async (opts) => {
     const { defaultRunnerConfigPath, loadRunnerConfig } = await import('./config-3JRFDYZL.js');
     const { jobsDir, runnerDir } = await import('./paths-OK2EZS7W.js');
-    const { listJobFiles, runnerProcessState } = await import('./loop-XDJYLT4D.js');
-    const { renderStatus } = await import('./status-ZR2N44KU.js');
+    const { listJobFiles, runnerProcessState } = await import('./loop-NUW7SSZY.js');
+    const { renderStatus } = await import('./status-QWLX2CCV.js');
     const { readHousekeepingRecord } = await import('./record-26AH6WDB.js');
     const path2 = await import('path');
     const configPath = opts.config ?? defaultRunnerConfigPath();
@@ -5487,7 +5542,7 @@ Next:
   });
   runnerCmd.command("logs").argument("<item>", "the work item's number in the factory").description("Print the newest attempt's log for one item").option("--config <path>", "the cloud config file naming the runner to inspect").option("-f, --follow", "keep printing as the log grows").action(async (itemArg, opts) => {
     const { defaultRunnerConfigPath } = await import('./config-3JRFDYZL.js');
-    const { listJobFiles } = await import('./loop-XDJYLT4D.js');
+    const { listJobFiles } = await import('./loop-NUW7SSZY.js');
     const { newestAttempt, logPathFor, tail, RunnerLogsError } = await import('./logs-C3RJ3ZTC.js');
     const configPath = opts.config ?? defaultRunnerConfigPath();
     const item = parseTrackerNumber(itemArg);