@outerlayer/cli 0.33.0-next.20261023154943 → 0.33.0

package/CHANGELOG.md

@@ -1,5 +1,41 @@
 # @outerlayer/cli
 
+## 0.33.0
+
+### Minor Changes
+
+- ff838ea: Add `--compare <manifest>` to `outerlayer emit demo`. It takes a second run of the same demo and compares the stills taken after each check. The demo record, now version 2, marks each chapter `yes`, `no` or `not checked`, and names the step and region of a difference. `emit demo` reads manifests of version 1 and 2.
+- 432eeee: The demo manifest, version 3, names the test file that recorded the demo, and `outerlayer emit demo` stores it in the demo record. `emit demo --replaces <record id>` retires the old demo, and `outerlayer work demo --item <n>` prints the newest demo record. The amend skill records the demo again after it pushes.
+- 82d4e55: Add `demo.screenshot()` to `@outerlayer/playwright`. A demo test calls it where the result of a screenshot criterion shows. The manifest, now version 4, lists the frame. `outerlayer emit demo` stores the frame as a screenshot of the criterion when the criterion declares `screenshot` and every check of the chapter passed. It stores no frame in any other case, and says why. The demo record gains the stored frame's artifact id, and `--replaces` retires the old frame.
+- 68f0cc6: Add `outerlayer emit demo <manifest>`. It cuts a recorded video into one WebM clip for each chapter, narrates each chapter on your machine, and emits each clip as a video artifact. A chapter whose checks all passed is bound to its criterion. The first narrated run downloads a voice pack of about 400 MB to `~/.outerlayer/voice/`; `--no-narration` needs no download. `demo` is now a reserved emit name, so a validator file cannot declare it.
+- 2b9bc47: `outerlayer emit demo` uploads a demo's video once, and each chapter's proof is a time range of it, so a reviewer gets the whole demo with no extra storage. A recording over 8 MiB still falls back to one clip for each chapter. In `emit demo --json`, `clips` stays and each entry adds `range`, and a new `video` field names the whole video's artifact id or says it was left out for its size. The demo record is version 3.
+- 9eb87e9: On a `builtin:vm` runner, the repository's image now builds in a builder microVM that has no network device. A Dockerfile or devcontainer step reaches only the public hosts that `runner.build.allowHosts` lists. Set `runner.build.imageBuild` to `host` to build in the host's Docker, for example to pull from a private registry. A managed runner refuses `host`. The runner downloads its tools layer's pinned files on the host and checks each against its sha256: `gh`, `tini`, FFmpeg and the narration voice pack. So `allowHosts` does not need their hosts. When `runner.build.disk` changes, the next image build gets a new cache disk of that size. An image build in a builder microVM needs a `runner.build.disk` of `20g` or more. Before each one, the runner empties the layer cache if less than half of the cache disk is free, and a failed unpack names the free space.
+- 6ede2b7: In a microVM build, every program's TCP connections go through the runner's tunnel, including those of Maven, Gradle, `psql` and `ssh`, with no proxy settings. The tunnel applies `allowHosts` and refuses private ranges as before. No DNS query or UDP packet leaves the microVM.
+- beeb073: A runner build whose command runs `/build` now stops before its agent starts when the clone and the governed context hold no `build` skill, and the release says why. The runner log names each route it serves a build. The release records the requests and failures of each route. `outerlayer context show` prints the instructions and skills that a repository's builds receive. `outerlayer doctor` names a skill folder that a `.gitignore` rule keeps out of git. When several factories fit a repository, `outerlayer connect` and `outerlayer work build` use the one the config file names. `outerlayer init` treats a repository as set up only when `.outerlayer/skills/` or `.outerlayer/AGENTS.md` exists. The default build image includes `jq`.
+- cbfef98: A runner short of disk runs as many builds as fit instead of none. It also frees its image-build cache's unused space after each image build.
+- 8818aa0: `outerlayer spec edit` records the new body's criteria on the issue's work item, so the item is held to the criteria the issue states. Inside an agent session the edit still happens, and the command prints the `emit criteria` command to run yourself. A build that finds the item holds other criteria than the issue now reports a step on the item's Activity tab that says so.
+- 4fc4b3d: The evidence and build skills record every video proof as a chapter of the item's one demo, with `outerlayer emit demo`, so the Criteria tab plays the demo as one narrated video. A video is emitted on its own only when Playwright cannot drive the flow.
+- 4c51ec6: `outerlayer work proofs` lists each proof an item declares as current, out of date or missing at the checkout's head. It exits 1 when any proof is left, and 2 when it cannot tell. The build and amend skills run it before they end.
+
+### Patch Changes
+
+- a212c93: The shipped skills tell the agent to write the `npx -y @outerlayer/cli` fallback in full each time, because zsh runs a command kept in a shell variable as one command name and fails with exit 127.
+- 671ceda: A governed build fetches its control plane before the image is built, so a failed fetch ends the build in seconds. The runner tries a failed fetch once more, gives each fetch 30 seconds, and names a refused credential only when git refused it. Other failures give git's error or the time limit.
+- 04c1646: The default build image, used for a repository with no devcontainer configuration, now holds a C compiler, make, Python with venv and pip, unzip and jq.
+- fe21b06: The default build image, used for a repository with no devcontainer configuration, now holds Chromium, its system libraries and the Playwright video encoder, so a build can capture screenshots and videos as proof.
+- f4b9d9c: `outerlayer emit demo` gives every clip of a narrated demo an audio track as long as the clip. Silence follows each line, and a chapter with no line gets a silent track, so clips played one after another keep each line with its chapter.
+- d31f998: MicroVM builds keep running when their runner restarts, however many builds the runner has run before. The runner also logs when its service's descriptor store is full, and names each descriptor it could not take out.
+- 701260a: Maven 3.9 and later in a runner build reaches Maven Central through the runner's tunnel, with no settings file of your own.
+- 3d54e29: A microVM build command that exits before it reads all of its input reports its own exit status. Before, the runner could report a connection error, "write EPIPE", instead.
+- 80747d3: A microVM build no longer fails while its image builds with "the exec agent could not be reached: write EPIPE". When an image build fails because the builder's Docker engine panicked, the error now shows the engine's panic line.
+- 45d3a2f: A launch that replaces a checkout's skill link directory tries again to remove the old one when something was added to it during the removal, so no `.old-*` directory is left behind.
+- 48425af: The runner claims nothing while its builds' disks cannot all fit on the host, and `outerlayer doctor` says so.
+- 82b31ff: Runner housekeeping removes the tagged images the runner built that no image record names and no unfinished build uses, once they are an hour old, with the root disks made from them. Images left by an earlier way of building, or by pruned records, no longer fill the disk.
+- 0c94177: A runner that fails a start-up check before its first heartbeat now sends one start-up report to OuterLayer. This includes the runner image's check of the Docker that the container reaches, and the work on builds that an earlier runner left. The report holds the host name, the CLI version, the failed check and the error message, with terminal control codes and secrets removed. The runner sends no report when another runner already runs on the same config, or when the gateway refused its key. It waits at most 5 seconds for the report. A gateway that predates the report ignores it, and the runner still stops with the same error.
+- 5648b3a: A runner reports whether it can update itself, and why not. When the gateway refuses a claim because the runner's version is too old, the runner logs the lowest version it accepts and the step that updates it, once. The step matches how the runner runs. A claim carries the CLI's version, so `outerlayer work claim` is not refused for an old runner on the same machine.
+- f2e27cb: A build gives every criterion with no stated proof a proof from what it promises: a video for a flow a person sees, a screenshot for one state, and a test for an outcome no screen shows. The `spec` and `writing-specs` skills ask for a proof form on every criterion a user can see.
+- b42151d: A Claude Code session's stored cost counts each model request once. When Claude Code ran a tool call while a reply still streamed, the reply's tokens were counted once for each tool call, and the session cost read up to 70% too high.
+
 ## 0.32.0
 
 ### Minor Changes

package/dist/build-info.json

@@ -1 +1 @@
-{"id":"2026-10-23T15:51:40.272Z+f2e27cb","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}
+{"id":"2026-10-23T18:10:50.201Z+1ad7157","root":"/home/runner/_work/outerlayer/outerlayer","pkg":"outerlayer"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@outerlayer/cli",
-  "version": "0.33.0-next.20261023154943",
+  "version": "0.33.0",
   "description": "OuterLayer CLI — commands: init, claude, connect, doctor, login, logout, sync, daemon (alias: watch), emit, findings, work, spec, runner, hooks, mcp, context. Capture and sync coding-agent sessions, and record proof of factory work.",
   "license": "Apache-2.0",
   "author": "Magu Studios, Inc.",