@iowarp/clio-coder 0.3.8 → 0.4.0

package/src/cli/panes.ts

@@ -0,0 +1,35 @@
+import { printError } from "./shared.js";
+import { runToolsCommand } from "./tools.js";
+
+const HELP = `clio-coder panes install [--force] [--json]
+
+Install the pane multiplexer Clio drives. This is an alias for
+\`clio-coder tools install herdr\`; the toolchain command is where every pinned
+external program is managed, and \`clio-coder tools status herdr\` explains
+which copy Clio would run.
+`;
+
+/**
+ * The user-facing verb for the pane layer's one setup step.
+ *
+ * Panes are the feature; herdr is the program behind it. Naming the program in
+ * a command an operator types is a leak, so the alias exists and routes to the
+ * generic installer rather than the reverse.
+ */
+export async function runPanesCommand(argv: ReadonlyArray<string> = []): Promise<number> {
+	if (argv.includes("--help") || argv.includes("-h")) {
+		process.stdout.write(HELP);
+		return 0;
+	}
+	const [subcommand, ...rest] = argv;
+	if (subcommand === undefined) {
+		process.stdout.write(HELP);
+		return 2;
+	}
+	if (subcommand !== "install") {
+		printError(`unknown panes command: ${subcommand}`);
+		process.stderr.write(HELP);
+		return 2;
+	}
+	return runToolsCommand(["install", "herdr", ...rest]);
+}

package/src/cli/reset.ts

@@ -15,7 +15,7 @@ Each level clears exactly the root (or file) it names and nothing else.
 Levels (combinable except --all):
   --state       state root only (default). Holds every session transcript, so a
                 reset is the end of resume, /view, and the audit behind them.
-  --data        data root only: memory, evidence, evals (durable products)
+  --data        data root only: memory, evidence, evals, vendored tools (durable products)
   --cache       cache root only
   --auth        credentials.yaml only
   --config      settings.yaml only
@@ -42,7 +42,10 @@ Safety:
 const ROOT_NOTES: Readonly<Record<string, string>> = {
 	state:
 		"the state root holds every session transcript and the audit trail beside it; resume and /view lose their history",
-	data: "the data root holds durable products (memory, evidence, evals)",
+	// Vendored tools are named because they are the one durable product a reset
+	// cannot regenerate from anything local: getting them back is a download.
+	data:
+		"the data root holds durable products (memory, evidence, evals, and any vendored external tools, which a reinstall re-downloads)",
 };
 
 interface ParsedResetArgs {

package/src/cli/run.ts

@@ -11,6 +11,7 @@ import { createContextDomainModule } from "../domains/context/runtime.js";
 import type { DispatchContract, DispatchRequest } from "../domains/dispatch/contract.js";
 import { agentRoleFactsResolver, requestExecutionRole } from "../domains/dispatch/execution-role.js";
 import { createDispatchDomainModule } from "../domains/dispatch/index.js";
+import { configureRunEventJournal } from "../domains/dispatch/run-event-journal.js";
 import type { RunReceipt } from "../domains/dispatch/types.js";
 import { ensureClioState, LifecycleDomainModule } from "../domains/lifecycle/index.js";
 import {
@@ -158,6 +159,45 @@ export function explicitSkillPathErrors(skillPaths: ReadonlyArray<string>): stri
 	return errors;
 }
 
+/**
+ * The TUI's verdict for a command-shaped token the registry does not own,
+ * applied to a headless task. Returns the refusal message, or null when the
+ * task is not an unknown command.
+ *
+ * `parseSlashCommand` is the canonical shape test and the canonical registry
+ * walk, so a token that is one word of letters, digits, hyphens, or colons and
+ * names no command lands here exactly as it does in the editor. Prose keeps
+ * reaching the model: an absolute path such as `/home/user/notes` carries a
+ * separator and is not one word, and `\/tmp is full` is the same escape the
+ * editor honors.
+ *
+ * A prompt template claims the token before the refusal does. Only membership
+ * is checked, not expansion: a template that exists but refuses (an untrusted
+ * project root, an unreadable body) has its own message, which the headless
+ * boot path already prints from the expansion itself. Deciding that here would
+ * duplicate the trust rules and put two refusals on one token.
+ *
+ * Both modules are imported lazily, so a task that does not start with a slash
+ * pays for neither. The laziness is a startup-cost choice and nothing more: for
+ * bundle partitioning a dynamic import is worse than a static one, because a
+ * dynamically imported module becomes a chunk split point by itself. What keeps
+ * this edge safe is the other end. `slash-commands.ts` is a declared CLI seam
+ * whose own imports stay off the interactive render graph, so reaching it does
+ * not make this file a second reacher of the chunk the instant shell's Stage 0
+ * closure sits on. Boundaries rule6 in `tests/boundaries/check-boundaries.ts`
+ * holds both halves of that.
+ */
+export async function unknownSlashCommandRefusal(task: string): Promise<string | null> {
+	if (!task.trim().startsWith("/")) return null;
+	const { parseSlashCommand } = await import("../interactive/slash-commands.js");
+	const command = parseSlashCommand(task);
+	if (command.kind !== "unknown-command") return null;
+	const { loadPromptTemplates } = await import("../domains/resources/index.js");
+	const templates = loadPromptTemplates({ cwd: process.cwd() });
+	if (templates.items.some((template) => template.name === command.token)) return null;
+	return `/${command.token} is not a command. Type /help for the list.`;
+}
+
 export async function runClioRun(
 	args: ReadonlyArray<string>,
 	options: { apiKey?: string; noContextFiles?: boolean; noSkills?: boolean; skillPaths?: ReadonlyArray<string> } = {},
@@ -218,6 +258,15 @@ export async function runClioRun(
 			if (!assembled) return 2;
 
 			if (parsed.agentId === undefined) {
+				// A mistyped slash command is a usage error, not a task. Refusing it
+				// here keeps it from booting a session and spending a model turn on a
+				// command that was never run, which is what the TUI has always done
+				// and what docs/extensions-and-sharing.md documents for both surfaces.
+				const slashRefusal = await unknownSlashCommandRefusal(assembled.prompt);
+				if (slashRefusal !== null) {
+					process.stderr.write(`clio-coder run: ${slashRefusal}\n`);
+					return 2;
+				}
 				// An explicit --target override is a one-run target; a missing id is an
 				// operator config error, not an assistant response. Reject it before the
 				// headless turn so the resolver diagnostic never streams to stdout as a
@@ -314,11 +363,20 @@ async function runDispatch(
 		createDispatchDomainModule({
 			getSettings: () => effectiveSettings,
 			autonomyOverride: parsed.autonomy !== undefined,
+			// This path iterates `handle.events` itself and builds no dispatch
+			// event registry, so the domain is the only thing that can write the
+			// run's durable transcript.
+			journalRunEvents: true,
 		}),
 		LifecycleDomainModule,
 	]);
 	const config = loaded.getContract<ConfigContract>("config");
 	const baseSettings = config?.get() ?? readSettings();
+	// Install `panes.journal` the same way the interactive composition root
+	// does. The journal never reads settings.yaml itself: it sits on the
+	// dispatch event path, where a settings read would be both a cost and a
+	// throw site.
+	configureRunEventJournal(baseSettings.panes.journal);
 	effectiveSettings =
 		parsed.autonomy === undefined ? baseSettings : { ...structuredClone(baseSettings), autonomy: parsed.autonomy };
 	const dispatch = loaded.getContract<DispatchContract>("dispatch");

package/src/cli/skills-inventory.ts

@@ -0,0 +1,185 @@
+/**
+ * Fixed machine-readable projection of this installation's installed skills.
+ *
+ * `skills list --json` already emits a machine-readable listing, and a GUI host
+ * reading it gets two things wrong. Without `--all` it sees only the skills the
+ * model may load, which is `trusted && !disableModelInvocation`, so a surface
+ * rendering trust and invocability off that payload prints "trusted" and
+ * "allowed" on every row and structurally cannot print anything else. And the
+ * rows it does get are the full loaded records, carrying the SKILL.md body, the
+ * file path, the base directory, and two content hashes, so every consumer has
+ * to re-derive the same redaction.
+ *
+ * This command answers both. It loads once, reports every installed skill
+ * whether or not the model can reach it, says which ones it can, and carries
+ * only fields that are safe by construction. It is a separate subcommand rather
+ * than a flag on `skills inspect`, because that one names a skill and a fixed
+ * read a host may run must take no identifier at all.
+ *
+ * Held back deliberately: the skill body, its file path, its base directory,
+ * both hashes, the install and registry URLs, and the free-text loader
+ * diagnostics. Whether a skill has an upstream to update from crosses; where
+ * that upstream is does not.
+ *
+ * Marketplace discovery is deliberately not here. `library list --json` already
+ * folds `discoverMarketplaceSkills` into its catalog, so every installable
+ * skill already crosses through that read, and a second one would report the
+ * same rows under a different name.
+ */
+
+import {
+	loadSkills,
+	type ResourceDiagnostic,
+	type Skill,
+	type SkillCatalogInvalidReason,
+	skillCatalogValidity,
+} from "../domains/resources/index.js";
+
+/** Wire bound on the emitted skill list. */
+const MAX_SKILLS_INVENTORY_SKILLS = 64;
+/** Wire bound on each skill's declared tool policy. */
+const MAX_SKILLS_INVENTORY_TOOLS = 32;
+
+const TOOL_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]*$/;
+
+type SkillAuditState = "pass" | "warn" | "fail" | "unknown" | "not-reported";
+
+interface SkillsInventoryDiagnosticCounts {
+	readonly errors: number;
+	readonly warnings: number;
+	readonly collisions: number;
+}
+
+interface SkillsInventorySkill {
+	readonly name: string;
+	readonly description: string;
+	readonly scope: string;
+	readonly source: string;
+	/** Whether the skill's root is trusted enough for the model to see it at all. */
+	readonly trusted: boolean;
+	/** Whether the skill's own frontmatter permits model invocation. */
+	readonly modelInvocable: boolean;
+	/**
+	 * The effective answer, which is both of the above.
+	 *
+	 * Reported rather than left to be inferred because it is the fact an
+	 * operator is actually asking about, and because a listing filtered to it
+	 * cannot state it.
+	 */
+	readonly modelVisible: boolean;
+	readonly precedence: number;
+	readonly diagnostics: SkillsInventoryDiagnosticCounts;
+	/** Tools the skill narrows itself to. The harness intersects these with host policy. */
+	readonly allowedTools: readonly string[];
+	readonly disallowedTools: readonly string[];
+	/** True when a dispatched worker installed this, rather than the operator. */
+	readonly installedByWorker: boolean;
+	/** True when provenance records an upstream, so `skills update` has something to fetch. */
+	readonly updatable: boolean;
+	readonly audit: SkillAuditState;
+	readonly installedAt: string | null;
+	readonly updatedAt: string | null;
+}
+
+interface SkillsInventorySnapshot {
+	readonly version: 1;
+	readonly generatedAt: string;
+	/** The verdict `skills validate` reaches, from the rule both callers share. */
+	readonly valid: boolean;
+	readonly invalidReason: SkillCatalogInvalidReason | null;
+	/** Every installed skill the loader resolved, before the wire bound. */
+	readonly total: number;
+	/** How many of those the model may actually load by name. */
+	readonly modelVisible: number;
+	readonly diagnostics: SkillsInventoryDiagnosticCounts;
+	readonly skills: readonly SkillsInventorySkill[];
+	readonly skillsTruncated: boolean;
+}
+
+const AUDIT_STATES: ReadonlySet<string> = new Set(["pass", "warn", "fail", "unknown"]);
+
+function countDiagnostics(diagnostics: ReadonlyArray<ResourceDiagnostic>): SkillsInventoryDiagnosticCounts {
+	let errors = 0;
+	let warnings = 0;
+	let collisions = 0;
+	for (const diag of diagnostics) {
+		if (diag.type === "error") errors += 1;
+		else if (diag.type === "collision") collisions += 1;
+		else warnings += 1;
+	}
+	return { errors, warnings, collisions };
+}
+
+/**
+ * Tool names are already-crossing identifiers: the agent catalog carries the
+ * same class. They are re-enforced structurally here anyway, because a skill's
+ * frontmatter is operator-authored and the loader does not hold it to a shape.
+ */
+function toolPolicy(value: ReadonlyArray<string> | undefined): string[] {
+	if (value === undefined) return [];
+	const tools: string[] = [];
+	for (const tool of value) {
+		if (tools.length >= MAX_SKILLS_INVENTORY_TOOLS) break;
+		if (typeof tool !== "string" || tool.length > 64 || !TOOL_PATTERN.test(tool)) continue;
+		if (!tools.includes(tool)) tools.push(tool);
+	}
+	return tools;
+}
+
+function timestamp(value: string | undefined): string | null {
+	if (value === undefined) return null;
+	const parsed = Date.parse(value);
+	return Number.isFinite(parsed) ? new Date(parsed).toISOString() : null;
+}
+
+function projectSkill(skill: Skill): SkillsInventorySkill {
+	const provenance = skill.provenance;
+	const audit = provenance?.audit;
+	return {
+		name: skill.name,
+		description: skill.description,
+		scope: skill.scope,
+		source: skill.source,
+		trusted: skill.trusted,
+		modelInvocable: !skill.disableModelInvocation,
+		modelVisible: skill.trusted && !skill.disableModelInvocation,
+		precedence: skill.precedence,
+		diagnostics: countDiagnostics(skill.diagnostics),
+		allowedTools: toolPolicy(skill.allowedTools),
+		disallowedTools: toolPolicy(skill.disallowedTools),
+		installedByWorker: provenance?.installedBy === "worker",
+		// The URL itself is a host-side fact; that one exists is what tells the
+		// operator whether an update has anywhere to come from.
+		updatable: provenance?.installUrl !== undefined || provenance?.registryUrl !== undefined,
+		audit: audit !== undefined && AUDIT_STATES.has(audit) ? (audit as SkillAuditState) : "not-reported",
+		installedAt: timestamp(provenance?.installedAt),
+		updatedAt: timestamp(provenance?.updatedAt),
+	};
+}
+
+function skillsInventorySnapshot(now: () => number = Date.now, cwd: string = process.cwd()): SkillsInventorySnapshot {
+	const list = loadSkills({ cwd });
+	const validity = skillCatalogValidity(list);
+	const projected = list.items.map(projectSkill);
+	const skills = projected.slice(0, MAX_SKILLS_INVENTORY_SKILLS);
+	return {
+		version: 1,
+		generatedAt: new Date(now()).toISOString(),
+		valid: validity.ok,
+		invalidReason: validity.reason,
+		total: projected.length,
+		modelVisible: projected.filter((skill) => skill.modelVisible).length,
+		diagnostics: countDiagnostics(list.diagnostics),
+		skills,
+		skillsTruncated: skills.length < projected.length,
+	};
+}
+
+export function runSkillsInventory(args: ReadonlyArray<string>): number {
+	if (args.length !== 1 || args[0] !== "--json") {
+		process.stderr.write("clio-coder skills inventory: usage: clio-coder skills inventory --json\n");
+		return 2;
+	}
+	process.stdout.write(`${JSON.stringify(skillsInventorySnapshot(), null, 2)}\n`);
+	return 0;
+}

package/src/cli/skills.ts

@@ -8,6 +8,7 @@ import {
 	type ResourceDiagnostic,
 	type Skill,
 	type SkillUpdateReport,
+	skillCatalogValidity,
 	updateSkills,
 } from "../domains/resources/index.js";
 import { formatColumns, printError, printOk } from "./shared.js";
@@ -18,6 +19,7 @@ Manage local Clio and Agent Skills-compatible skills.
 
 Commands:
   clio-coder skills list [--json] [--all]
+  clio-coder skills inventory --json
   clio-coder skills search <query> [--json]
   clio-coder skills inspect <name> [--json]
   clio-coder skills validate [path] [--json]
@@ -27,6 +29,10 @@ Commands:
   clio-coder skills sync [--force]
   clio-coder skills eval <name|path> [--scenario <id>] [--target <id>] [--workspace <path>] [--timeout <seconds>] [--trust-fixtures] [--allow-network] [--json]
 
+inventory is the fixed machine-readable read a GUI host may run. Unlike a bare
+list it reports every installed skill, not only the ones the model may load, and
+says which are which; it carries no body, path, hash, or install URL.
+
 search covers installed skills plus the local marketplace: CLIO_CODER_SKILL_CATALOG_DIR,
 a repo skills/ catalog, or the catalog and skill-marketplace.json index the
 installed clio-coder package carries. Installing from the shipped catalog copies
@@ -249,6 +255,12 @@ function validationLoad(pathArg: string | undefined): ReturnType<typeof loadSkil
 }
 
 export async function runSkillsCommand(argv: ReadonlyArray<string>): Promise<number> {
+	// Routed before the shared parser so the fixed read stays exactly fixed: no
+	// skills flag can reach it, and no flag it does not name can be spent on it.
+	if (argv[0] === "inventory") {
+		const { runSkillsInventory } = await import("./skills-inventory.js");
+		return runSkillsInventory(argv.slice(1));
+	}
 	let parsed: Parsed;
 	try {
 		parsed = parse(argv);
@@ -365,19 +377,10 @@ export async function runSkillsCommand(argv: ReadonlyArray<string>): Promise<num
 				return 2;
 			}
 			const list = validationLoad(pathArg);
-			// A scanned file that produced no loaded skill is malformed, and a
-			// collision drops a skill: both make the catalog invalid, as does any
-			// hard error. Benign warnings (name/path mismatch, name format,
-			// description length) attach to a file that still loaded, so their path
-			// is among the loaded skills and they do not fail validation.
-			const loadedPaths = new Set(list.items.map((skill) => skill.filePath));
-			const hasInvalidDiagnostic = list.diagnostics.some(
-				(diag) =>
-					diag.type === "error" ||
-					diag.type === "collision" ||
-					(diag.type === "warning" && diag.path !== undefined && !loadedPaths.has(diag.path)),
-			);
-			const ok = list.items.length > 0 && !hasInvalidDiagnostic;
+			// The rule itself lives in the loader, because `skills inspect --json`
+			// reports the same verdict to a GUI host and a verdict that drifts
+			// between the terminal and the browser is worse than no verdict.
+			const { ok } = skillCatalogValidity(list);
 			if (parsed.json) {
 				process.stdout.write(`${JSON.stringify({ ok, skills: list.items, diagnostics: list.diagnostics }, null, 2)}\n`);
 			} else {

package/src/cli/targets.ts

@@ -14,6 +14,7 @@ import { ConfigDomainModule } from "../domains/config/index.js";
 import { ensureClioState } from "../domains/lifecycle/index.js";
 import type { ProvidersContract, TargetStatus } from "../domains/providers/contract.js";
 import {
+	endpointCapacityForStatus,
 	isDispatchEligibleRuntime,
 	isOrchestratorEligibleRuntime,
 	ProvidersDomainModule,
@@ -24,7 +25,7 @@ import type { CapabilityFlags } from "../domains/providers/types/capability-flag
 import type { RuntimeTier } from "../domains/providers/types/runtime-descriptor.js";
 import { runConfigureCommand, runTargetRemove, runTargetRename } from "./configure.js";
 import { printError, printOk } from "./shared.js";
-import { column, terminalColumns, truncate } from "./text-layout.js";
+import { column, terminalColumns, truncate, wrapPlain } from "./text-layout.js";
 
 const HEADER: ReadonlyArray<string> = ["id", "tier", "runtime", "auth", "url", "model", "health", "caps", "notes"];
 type ProviderOutputTier = RuntimeTier | "unknown";
@@ -805,9 +806,11 @@ export interface TargetTableRow {
 	health: string;
 	caps: string;
 	notes: string;
+	/** Full degraded-health reason, kept separately so a narrow table can repeat it below the row. */
+	diagnostic?: string;
 }
 
-type TargetTableColumn = keyof TargetTableRow;
+type TargetTableColumn = Exclude<keyof TargetTableRow, "diagnostic">;
 type TargetTableWidths = Record<TargetTableColumn, number>;
 
 const TABLE_COLUMNS: ReadonlyArray<TargetTableColumn> = [
@@ -918,20 +921,35 @@ export function formatTargetTable(
 	rows: ReadonlyArray<TargetTableRow>,
 	width: number,
 	paintHealth: (cell: string, row: TargetTableRow) => string = (cell) => cell,
-): { header: string; rows: ReadonlyArray<string> } {
+): { header: string; rows: ReadonlyArray<string>; details: ReadonlyArray<ReadonlyArray<string>> } {
 	const widths = tableWidths(rows, width);
 	const line = (cells: ReadonlyArray<string>): string => cells.join(" ".repeat(TABLE_GAP)).trimEnd();
+	const formatted = rows.map((row) => {
+		const cells = TABLE_COLUMNS.map((key) => column(row[key], widths[key]));
+		const plain = line(cells);
+		const rendered =
+			plain.length > width
+				? truncate(plain, width)
+				: line(cells.map((cell, index) => (TABLE_COLUMNS[index] === "health" ? paintHealth(cell, row) : cell)));
+		const diagnosticFits = !row.diagnostic || (plain.length <= width && widths.notes >= row.diagnostic.length);
+		const details = diagnosticFits ? [] : targetDiagnosticDetails(row.diagnostic ?? "", width);
+		return { rendered, details };
+	});
 	return {
 		header: truncate(line(TABLE_COLUMNS.map((key, index) => column(HEADER[index] ?? key, widths[key]))), width),
-		rows: rows.map((row) => {
-			const cells = TABLE_COLUMNS.map((key) => column(row[key], widths[key]));
-			const plain = line(cells);
-			if (plain.length > width) return truncate(plain, width);
-			return line(cells.map((cell, index) => (TABLE_COLUMNS[index] === "health" ? paintHealth(cell, row) : cell)));
-		}),
+		rows: formatted.map(({ rendered }) => rendered),
+		details: formatted.map(({ details }) => details),
 	};
 }
 
+/** Indented diagnostic text that retains every word when the table row cannot. */
+function targetDiagnosticDetails(diagnostic: string, width: number): string[] {
+	const indent = 2;
+	return wrapPlain(`reason: ${diagnostic}`, Math.max(8, width - indent), indent).map((line, index) =>
+		index === 0 ? `${" ".repeat(indent)}${line}` : line,
+	);
+}
+
 function renderTable(providers: ProvidersContract, entries: ReadonlyArray<TargetStatus>): void {
 	const sorted = [...entries].sort(compareStatusByTier);
 	const table = formatTargetTable(
@@ -950,10 +968,12 @@ function renderTable(providers: ProvidersContract, entries: ReadonlyArray<Target
 			process.stdout.write(`${chalk.bold(table.header)}\n`);
 		}
 		process.stdout.write(`${table.rows[index] ?? ""}\n`);
+		for (const detail of table.details[index] ?? []) process.stdout.write(`${detail}\n`);
 	}
 }
 
 export function targetTableRow(providers: ProvidersContract, status: TargetStatus): TargetTableRow {
+	const diagnostic = degradedHealthDiagnostic(status);
 	return {
 		id: status.target.id,
 		tier: statusTier(status),
@@ -964,6 +984,7 @@ export function targetTableRow(providers: ProvidersContract, status: TargetStatu
 		health: status.health.status,
 		caps: capabilityBadges(status.capabilities),
 		notes: formatNotes(status),
+		...(diagnostic ? { diagnostic } : {}),
 	};
 }
 
@@ -1044,22 +1065,29 @@ export function formatContextWindow(
 		: `ctx ${window}`;
 }
 
-function formatNotes(status: TargetStatus): string {
+export function formatNotes(status: TargetStatus): string {
 	const parts: string[] = [];
+	const diagnostic = degradedHealthDiagnostic(status);
+	// The health diagnosis leads because gateway, context, and residency facts
+	// are supplementary once the target says it cannot serve its default model.
+	if (diagnostic) parts.push(diagnostic);
+	const endpoint = endpointCapacityForStatus(status);
+	if (endpoint) parts.push(`slots ${endpoint.limit}`);
 	if (status.target.gateway) parts.push("gateway");
 	if (status.runtime?.auth === "oauth") parts.push("oauth");
 	if (status.runtime?.auth === "claude-cli") parts.push("claude-cli");
 	if (status.capabilities.contextWindow > 0) parts.push(formatContextWindow(status));
 	if (!status.available && status.reason) parts.push(status.reason);
-	// A reachable target that cannot serve its own default is degraded, and the
-	// row has to say why or the model column reads as a model that works.
-	if (status.health.status === "degraded" && status.health.lastError) parts.push(status.health.lastError);
 	const residency = residentModelsSummary(status.discoveredModelStates);
 	if (residency) parts.push(residency);
 	if (status.probeNotes && status.probeNotes.length > 0) parts.push(`note: ${status.probeNotes.join("; ")}`);
 	return parts.join(" ");
 }
 
+function degradedHealthDiagnostic(status: TargetStatus): string | null {
+	return status.health.status === "degraded" && status.health.lastError ? status.health.lastError : null;
+}
+
 function statusTier(status: TargetStatus): ProviderOutputTier {
 	return status.runtime?.tier ?? "unknown";
 }
@@ -1120,6 +1148,7 @@ interface SerializedStatus {
 	tier: ProviderOutputTier;
 	detectedReasoning: boolean | null;
 	reasoningCandidateModelId: string | null;
+	endpointCapacity?: ReturnType<typeof endpointCapacityForStatus>;
 }
 
 function serializeStatus(
@@ -1141,6 +1170,8 @@ function serializeStatus(
 		detectedReasoning: extras.detectedReasoning,
 		reasoningCandidateModelId: extras.candidateModelId,
 	};
+	const endpointCapacity = endpointCapacityForStatus(status);
+	if (endpointCapacity !== null) out.endpointCapacity = endpointCapacity;
 	if (status.contextWindowProvenance !== undefined) {
 		out.contextWindowProvenance = status.contextWindowProvenance;
 	}