@kilogent/runner 0.1.4 → 0.1.6

package/dist/cli.js

@@ -200,6 +200,22 @@ function effectiveAgentTools(agent) {
   };
 }
 
+// ../shared/dist/agentProposal.js
+var DRAFT_FIELDS = {
+  name: true,
+  emoji: true,
+  persona: true,
+  engine: true,
+  model: true,
+  credentialId: true,
+  contract: true,
+  tools: true,
+  autonomy: true,
+  riskyActions: true,
+  playbooks: true
+};
+var PROPOSAL_DRAFT_FIELDS = Object.keys(DRAFT_FIELDS);
+
 // ../shared/dist/assistant.js
 var ASSISTANT_ACTOR_ID = "assistant";
 var ASSISTANT_NAME = "Workspace assistant";
@@ -272,7 +288,18 @@ var CONFIG_DOCS = {
    * installs, and keeping them out of a package the app also reads keeps a surface a captain can
    * edit from ever naming a version.
    */
-  engines: "engines"
+  engines: "engines",
+  /**
+   * `crewConfig/launch` — whether the product is open, and what the front gate says while it is
+   * not. Defaults live in `@lumi/crew-shared/launch.ts`.
+   *
+   * THE ONLY `crewConfig` DOCUMENT A SIGNED-OUT BROWSER MAY READ, and the rule is written for
+   * this id alone (packages/crew/firestore.rules). The login page has to say the right thing
+   * BEFORE the Google button is pressed and there is no session at that point — so `assistant`,
+   * which holds the shipped prompt, and `engines`, which holds the fleet's versions, stay closed
+   * beside it rather than a collection-wide read being opened for one boolean.
+   */
+  launch: "launch"
 };
 var DEFAULT_ASSISTANT_MODEL = "gemini-3.1-flash-lite";
 var DEFAULT_DAILY_CAP_USD = 0.1;
@@ -341,24 +368,46 @@ var DEFAULT_FREE_CONTRACT = `# Finish in one reply
 You get a small budget per message and only a person's message starts you. Your own reply does not
 wake you again, so finish your thought rather than promising to continue.
 
-# When somebody describes their business
-This is the most useful conversation you will have with a new workspace. Give them a real answer,
-not a questionnaire.
+# When somebody describes their business, or asks who to hire
+"Who should I hire", "what crew should I start with", "who would help here" and anyone describing
+what their company does are all the SAME REQUEST, and it is the most useful conversation you will
+have with a new workspace.
+
+THEY ARE ASKING ABOUT AI AGENTS ON THIS WORKSPACE, NOT ABOUT PEOPLE. Never answer with advice on
+writing a job advert, hiring a contractor or finding a person, and never suggest putting a role on
+the board as a task. An agent here is a thing they can switch on this afternoon.
 
-Propose a crew: three to five agents, each with a name, one line on what it would own, and how work
+Sketch the crew: three to five agents, each with a name, one line on what it would own, and how work
 passes between them. Use their words for their work, not ours. Be concrete enough that they can
 disagree with it.
 
-DO NOT CREATE THE AGENTS. Designing one properly is careful work and you are the light-weight half
-of this product; say what you would build and let the workspace's own crew-builder do it once it is
-set up. Never claim you have created something you have not.
+YOU CANNOT CREATE AN AGENT HERE, AND YOU CANNOT OFFER TO. There is no tool on this path that makes
+one, so both of these are false and the second is worse:
+
+  reporting  \u2014 "I have created", "I have added", "I have set up", "these are now on your workspace"
+  offering   \u2014 "I can set them up now", "shall I create them", "say the word and I will", "which one
+               would you like me to start with"
+
+The first sends somebody to the Agents page to look for crew that is not there. The second gets a
+"yes please" you cannot act on, which is the same lie with a delay on it.
 
-Write the proposal into the library with knowledge_write so it survives \u2014 this conversation scrolls
-out of view, and whoever builds the crew later needs to read it back. Say that you saved it, and
-name the slug.
+NEVER SAY A SEAT, A PLAN OR A BILL HAS CHANGED OR WILL CHANGE. "This adds three paid seats" is a
+statement about something happening; nothing in this conversation touches billing at all. If seats
+are worth mentioning, they are what a crew WOULD cost once somebody adds it.
 
-Then say plainly what is still missing before any of it can run, and stop. One clear sentence beats
-a sales pitch, and the person is already looking at the buttons.
+Speak conditionally throughout \u2014 "I would start with", "this one would own", "you could add".
+
+THEN END BY SAYING WHO DOES BUILD IT, and end there. Once this workspace has a machine online the
+assistant runs on it instead \u2014 on their own AI credential, with time to read the repositories and
+the board first \u2014 and puts each agent in front of them as a card they add with one press or open and
+change. That is where a crew actually gets built, and it is why the sketch above is a sketch:
+designing a persona, a contract with real boundaries, a tool whitelist and an autonomy level is
+careful work, and you are the light-weight half of this product.
+
+THE CARDS APPEAR IN THIS CONVERSATION, NOT ON ANOTHER PAGE. Never send somebody to the Agents page
+to find them \u2014 there is nothing waiting there, and a person who goes looking finds an empty roster
+and no way to tell what went wrong. The setup facts you were given above say which step is actually
+outstanding; name that one, and stop there. Do not ask which agent to start with.
 
 # What you can promise
 Nothing runs on this workspace until it has a subscription and a machine. Never imply otherwise,
@@ -372,11 +421,29 @@ Nothing you do in this session is visible to anybody until you call chat_send. T
 person hears from you. End the session with run_report so the next run knows what happened.
 
 # Building the crew
-You can create agents, and on this path you should. If the library holds a crew proposal, read it
-back and build what it describes rather than asking for the description again.
+THIS IS THE PATH WHERE CREW GETS DESIGNED, and you are the half of the product that can do it. Read
+what the workspace actually holds first \u2014 its repositories, its board, its knowledge library, what
+it has been asking for \u2014 and let that decide the crew rather than the paragraph you were given.
+
+When somebody asks who to hire, or describes what their company does: call chat_send with your
+answer, then call propose_agents with the messageId it returns. The cards land under that reply and
+a captain adds each one with a press, or opens it and changes anything first.
+
+A PERSONA AND A CONTRACT ARE NOT OPTIONAL, and the tool refuses a proposal without them. They are
+what make the thing an agent rather than a job title: the persona is the line the roster shows,
+written in its own first-person voice, and the contract is the markdown it reads before every run \u2014
+Mission, Responsibilities, Boundaries. There is no workspace default for either, so leaving one out
+is a hole rather than an inherited setting.
 
-Say what each agent is for in one line, and say that every agent adds a paid seat to this
-workspace. Never create one nobody asked for.`;
+EVERYTHING ELSE: SET ONLY WHAT YOU HAVE A REASON FOR. Tools, autonomy, model, credential and
+playbooks all have a workspace default, so a field you leave out is shown as "not proposed" and
+takes it \u2014 which is honest, while a whitelist or a model id you guessed at is a wrong answer wearing
+a confident face. What you DID go and read is worth setting, and that reading is the whole reason a
+proposal from here beats one from the included model.
+
+If the conversation already holds cards nobody answered, do not propose the same crew again.
+
+Say that each agent adds a paid seat, and never create one nobody asked for.`;
 function text(value, cap = MAX_ASSISTANT_CONTRACT_CHARS) {
   if (typeof value !== "string")
     return void 0;
@@ -558,6 +625,22 @@ var COLLECTIONS = {
    * `messages`, and the path is only ever composed from `chats` above it.
    */
   chatMessages: "messages",
+  /**
+   * `ships/{shipId}/chats/{chatId}/proposals/{proposalId}` — crew the assistant has proposed in
+   * this conversation, and what the captain decided about each (PRD §15.86).
+   *
+   * UNDER THE CHAT, not under the Ship, and that placement carries three things for free. Its
+   * visibility is the chat's: `chatVisible()` already answers "may this person read this thread",
+   * and a proposal is a paragraph of that thread. Its lifetime is the chat's: `deleteChatDeep`
+   * drains it with the messages, so a deleted conversation leaves no crew nobody remembers being
+   * offered. And the app's listener is chat-scoped, which is the only scope any reader wants.
+   *
+   * THE DECISION LIVES HERE RATHER THAN ON THE MESSAGE because `messages` is `allow update: if
+   * false` and must stay so — the whole thread's integrity rests on it. A proposal is the opposite
+   * kind of thing: it is written once by the assistant and then answered, days later, by a person.
+   * Those are two documents, not one.
+   */
+  chatProposals: "proposals",
   /** `ships/{shipId}/agents/{agentId}` — the crew: one doc = one configured agent. */
   agents: "agents",
   /** `ships/{shipId}/agents/{agentId}/workflows/{workflowId}` — that agent's playbooks. */
@@ -1277,14 +1360,14 @@ import os from "node:os";
 import path from "node:path";
 
 // src/version.ts
-var RUNNER_VERSION = true ? "0.1.4" : "0.0.0-dev";
+var RUNNER_VERSION = true ? "0.1.6" : "0.0.0-dev";
 var RUNNER_PACKAGE = true ? "@kilogent/runner" : "@kilogent/runner-dev";
 var RUNNER_BIN = true ? "kilogent-runner" : "kilogent-runner-dev";
 
 // src/config.ts
 var IS_DEV_BUILD = RUNNER_PACKAGE.endsWith("-dev");
 var DEFAULT_PROJECT_ID = IS_DEV_BUILD ? "lumi-afb7d" : "kilogent-crew-prod";
-var DEFAULT_MCP_URL = IS_DEV_BUILD ? "https://dev.app.kilogent.com/mcp" : "https://app.kilogent.com/mcp";
+var DEFAULT_MCP_URL = IS_DEV_BUILD ? "https://dev-app-kilogent.web.app/mcp" : "https://app.kilogent.com/mcp";
 var LEGACY_DIR_NAME = ".crew-runner";
 var DIR_NAME = `.${RUNNER_BIN}`;
 var LUMI_DIR_NAME = ".lumi-runner";
@@ -3273,10 +3356,10 @@ async function claudeHealthCheck(binOverride) {
   const bin = binOverride ?? claudeBinary();
   return new Promise((resolve) => {
     let settled = false;
-    const done = (health) => {
+    const done = (health2) => {
       if (settled) return;
       settled = true;
-      resolve({ ...health, binary: bin });
+      resolve({ ...health2, binary: bin });
     };
     let stdout = "";
     const child = spawn3(bin, ["--version"], { env: withNodeOnPath(), stdio: ["ignore", "pipe", "ignore"] });
@@ -3806,10 +3889,10 @@ async function codexHealthCheck(binOverride) {
   const bin = binOverride ?? codexBinary();
   return new Promise((resolve) => {
     let settled = false;
-    const done = (health) => {
+    const done = (health2) => {
       if (settled) return;
       settled = true;
-      resolve({ ...health, binary: bin });
+      resolve({ ...health2, binary: bin });
     };
     let stdout = "";
     const child = spawn4(bin, ["--version"], { env: withNodeOnPath(), stdio: ["ignore", "pipe", "ignore"] });
@@ -4026,7 +4109,7 @@ function filterLocal(servers, input) {
       continue;
     }
     input.log(
-      `MCP connection "${server.key}" skipped: local MCP is off for this Ship on this machine \u2014 run \`lumi-runner config set local-mcp on --ship ${input.shipId}\` here to allow it.`
+      `MCP connection "${server.key}" skipped: local MCP is off for this Ship on this machine \u2014 run \`${RUNNER_BIN} config set local-mcp on --ship ${input.shipId}\` here to allow it.`
     );
   }
   return kept;
@@ -4051,7 +4134,7 @@ async function probeAndReport(input) {
     await report(input, {
       ok: false,
       toolNames: [],
-      error: `This machine has not allowed this Ship to run local MCP connections. On the machine, run: lumi-runner config set local-mcp on --ship ${shipId}`
+      error: `This machine has not allowed this Ship to run local MCP connections. On the machine, run: ${RUNNER_BIN} config set local-mcp on --ship ${shipId}`
     });
     return;
   }
@@ -4108,7 +4191,7 @@ async function probeStdio(server) {
           send(child, 1, "initialize", {
             protocolVersion: PROTOCOL_VERSION,
             capabilities: {},
-            clientInfo: { name: "lumi-runner", version: RUNNER_VERSION }
+            clientInfo: { name: RUNNER_BIN, version: RUNNER_VERSION }
           });
           await replies.waitFor(1, () => stderr);
           child.stdin.write(
@@ -4148,7 +4231,7 @@ async function probeHttp(server) {
   await post(1, "initialize", {
     protocolVersion: PROTOCOL_VERSION,
     capabilities: {},
-    clientInfo: { name: "lumi-runner", version: RUNNER_VERSION }
+    clientInfo: { name: RUNNER_BIN, version: RUNNER_VERSION }
   });
   return toolNamesFrom(await post(2, "tools/list", {}));
 }
@@ -5249,9 +5332,9 @@ async function installEngine(input) {
         return { ok: false, ran: true, detail: installed.detail };
       }
       const bin = engineBinPath(root, engineId, pkg.binName);
-      const health = await input.healthCheck(bin);
-      if (!health.ok || health.binary !== bin) {
-        const detail = health.ok ? `npm reported success, but the check ran ${health.binary ?? "something else"} rather than ${bin} \u2014 the install did not land where this runner looks.` : health.detail;
+      const health2 = await input.healthCheck(bin);
+      if (!health2.ok || health2.binary !== bin) {
+        const detail = health2.ok ? `npm reported success, but the check ran ${health2.binary ?? "something else"} rather than ${bin} \u2014 the install did not land where this runner looks.` : health2.detail;
         recordEngineInstall(root, engineId, { outcome: "failed", at: Date.now(), detail: detail.slice(0, 400) });
         return { ok: false, ran: true, detail };
       }
@@ -5378,6 +5461,7 @@ function decideUpdate(f) {
   if (f.current === DEV_VERSION) return { update: false, reason: "dev-build" };
   if (!f.autoUpdate) return { update: false, reason: "disabled" };
   const service2 = f.service();
+  if (service2.state === "unsupported") return { update: false, reason: "service-unsupported" };
   if (service2.state !== "running") return { update: false, reason: "service-not-running" };
   if (!service2.execPath || service2.execPath !== f.cliPath) {
     return { update: false, reason: "foreign-unit" };
@@ -5401,6 +5485,8 @@ function describeRefusal(reason, f) {
       return `Auto-update is off (\`${RUNNER_BIN} config set autoUpdate on\` to enable).`;
     case "service-not-running":
       return `Auto-update needs the background service (this daemon would have nothing to restart it). Run \`${RUNNER_BIN} service install\`, or \`${RUNNER_BIN} update\` by hand.`;
+    case "service-unsupported":
+      return `This machine has no service supervisor, so a daemon that exited would not come back \u2014 auto-update is off for it. Run \`${RUNNER_BIN} update\` and restart it yourself.`;
     case "foreign-unit":
       return `This process is not the one the installed service runs, so auto-update is off for it. Run \`${RUNNER_BIN} update\` if you meant to upgrade the installed copy.`;
     case "no-npm":
@@ -5523,7 +5609,13 @@ async function refreshEngineTools(input) {
   for (const engineId of input.engineIds) {
     if (seen.has(engineId)) continue;
     seen.add(engineId);
-    out.push(await refreshOne(engineId, input, now));
+    try {
+      out.push(await refreshOne(engineId, input, now));
+    } catch (e) {
+      const detail = e instanceof Error ? e.message : String(e);
+      input.log(`Engine "${engineId}" could not be checked: ${detail}`);
+      out.push({ engineId, state: "failed", detail: detail.slice(0, 300) });
+    }
   }
   return out;
 }
@@ -5550,7 +5642,7 @@ async function refreshOne(engineId, input, now) {
     target: choice.version,
     platform: process.platform,
     autoInstall: input.autoInstall,
-    npmPresent: npmPresentOnce(),
+    npmPresent: input.npmPresent ?? npmPresentOnce(),
     marker,
     locked: false,
     record: record ?? null,
@@ -5561,17 +5653,17 @@ async function refreshOne(engineId, input, now) {
     return describeRefused(engineId, input, marker, decision.reason);
   }
   input.onState?.({ engineId, state: "installing", version: choice.version });
-  const outcome = await installEngine({
+  const outcome = await (input.install ?? installEngine)({
     root,
     engineId,
     version: choice.version,
-    healthCheck: (bin) => getDriver(engineId).healthCheck(bin),
+    healthCheck: (bin) => health(input, engineId, bin),
     log: log2,
     now
   });
   if (outcome.ok) return { engineId, state: "ready", version: choice.version };
   log2(`Could not install "${engineId}": ${outcome.detail.slice(0, 200)}`);
-  const fallback = await unmanagedVersion(engineId);
+  const fallback = await unmanagedVersion(input, engineId);
   if (fallback && !policy.blocked.includes(fallback)) {
     return { engineId, state: "unmanaged", version: fallback, detail: "Using a copy already on this machine \u2014 this runner cannot update or roll it back." };
   }
@@ -5612,11 +5704,14 @@ function npmPresentOnce() {
     return answer;
   };
 }
-async function unmanagedVersion(engineId) {
+function health(input, engineId, bin) {
+  return input.driverHealth ? input.driverHealth(engineId, bin) : getDriver(engineId).healthCheck(bin);
+}
+async function unmanagedVersion(input, engineId) {
   try {
-    const health = await getDriver(engineId).healthCheck();
-    if (!health.ok) return null;
-    const match = /(\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?)/.exec(health.detail ?? "");
+    const probe2 = await health(input, engineId);
+    if (!probe2.ok) return null;
+    const match = /(\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?)/.exec(probe2.detail ?? "");
     return match?.[1] ?? null;
   } catch {
     return null;
@@ -5632,6 +5727,9 @@ function engineSet(engineIds) {
   if (engines.size === 0) engines.add(DEFAULT_ENGINE_ID);
   return engines;
 }
+function enginesForCredentials(credentials) {
+  return [...new Set(credentials.map((c) => c.engine).filter((id) => isKnownEngine(id)))];
+}
 
 // src/service.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
@@ -5658,6 +5756,15 @@ function run(command, args) {
     out: `${result.stdout ?? ""}${result.stderr ?? ""}`.trim()
   };
 }
+function systemdPresent() {
+  try {
+    if (!fs12.existsSync("/run/systemd/system")) return false;
+    const probe2 = process.platform === "win32" ? "where" : "which";
+    return spawnSync2(probe2, ["systemctl"], { stdio: "ignore" }).status === 0;
+  } catch {
+    return false;
+  }
+}
 function cliPath() {
   return fileURLToPath(import.meta.url);
 }
@@ -5840,6 +5947,21 @@ ${envLines}
 WantedBy=default.target
 `;
 }
+function linuxStatusFrom(facts) {
+  if (!facts.systemdPresent) {
+    return {
+      state: "unsupported",
+      detail: "This machine has no systemd, so there is no background service to install \u2014 it is a container, or a Linux that does not use one."
+    };
+  }
+  if (!facts.unitExists) return { state: "not-installed", detail: "No systemd user unit installed." };
+  return {
+    state: facts.isActive === "active" ? "running" : "installed",
+    detail: `systemd user unit is ${facts.isActive || "unknown"}.`,
+    unitPath: facts.unitPath,
+    ...facts.exec ?? {}
+  };
+}
 function serviceStatus() {
   if (process.platform === "darwin") {
     const unitPath = launchAgentPath();
@@ -5859,14 +5981,16 @@ function serviceStatus() {
   }
   if (process.platform === "linux") {
     const unitPath = systemdUnitPath();
-    if (!fs12.existsSync(unitPath)) return { state: "not-installed", detail: "No systemd user unit installed." };
-    const active = run("systemctl", ["--user", "is-active", LINUX_UNIT]);
-    return {
-      state: active.out === "active" ? "running" : "installed",
-      detail: `systemd user unit is ${active.out || "unknown"}.`,
+    const present = systemdPresent();
+    const unitExists = fs12.existsSync(unitPath);
+    const isActive = present && unitExists ? run("systemctl", ["--user", "is-active", LINUX_UNIT]).out : "";
+    return linuxStatusFrom({
+      systemdPresent: present,
+      unitExists,
+      isActive,
       unitPath,
-      ...execFacts(unitPath, parseSystemdCliPath, parseSystemdEnv)
-    };
+      exec: unitExists ? execFacts(unitPath, parseSystemdCliPath, parseSystemdEnv) : void 0
+    });
   }
   if (process.platform === "win32") {
     const query7 = run("schtasks", ["/Query", "/TN", WINDOWS_TASK]);
@@ -5880,6 +6004,11 @@ function serviceStatus() {
   return { state: "unsupported", detail: `No service integration for ${process.platform}.` };
 }
 function installService() {
+  if (process.platform === "linux" && !systemdPresent()) {
+    throw new ServiceError(
+      `This machine has no systemd, so there is no background service to install. Run \`${RUNNER_BIN} start\` to keep the daemon up \u2014 in Docker, make that the container's command.`
+    );
+  }
   const notes = [];
   fs12.mkdirSync(logDir(), { recursive: true, mode: 448 });
   for (const unit of removeLegacyService()) {
@@ -6180,6 +6309,7 @@ async function startDaemon() {
   const shipCredentials = /* @__PURE__ */ new Map();
   const heldCredentialIds = /* @__PURE__ */ new Map();
   const loginsInFlight = /* @__PURE__ */ new Map();
+  const enginesBeingEnsured = /* @__PURE__ */ new Set();
   const unsubsByShip = /* @__PURE__ */ new Map();
   const listenerError = (shipId, what) => (e) => {
     if (isEnrolmentGone(e)) {
@@ -6355,6 +6485,15 @@ async function startDaemon() {
               ensureEngine: (engineId) => ensureEngineForCaller(engineId)
             }).catch((e) => log2(`Sign-in for ${credential.id} ended abnormally: ${e instanceof Error ? e.message : e}`)).finally(() => loginsInFlight.delete(credential.id));
           }
+          for (const engineId of enginesForCredentials(list)) {
+            if (enginesBeingEnsured.has(engineId)) continue;
+            const known = engineToolStates.get(engineId)?.state;
+            if (known === "ready" || known === "installing" || known === "unmanaged") continue;
+            enginesBeingEnsured.add(engineId);
+            void ensureEngineForCaller(engineId).then((result) => {
+              if (!result.ok) log2(`Engine "${engineId}" is named by a credential on Ship ${shipId}: ${result.detail}`);
+            }).catch((e) => log2(`Could not install "${engineId}": ${e instanceof Error ? e.message : e}`)).finally(() => enginesBeingEnsured.delete(engineId));
+          }
           poke();
         },
         // ITS OWN ERROR HANDLER, not `listenerError`, for the reason the mcp_servers listener
@@ -7319,7 +7458,10 @@ ${harder.transcript}`
     if (shipIds.length === 0) return;
     checkingEngines = true;
     try {
-      const engineIds = engineSet(agentEngines.values());
+      const engineIds = engineSet([
+        ...agentEngines.values(),
+        ...[...shipCredentials.values()].flatMap((list) => enginesForCredentials(list))
+      ]);
       const firstShip = shipIds[0];
       const policySnap = await getDoc8(
         doc9(sess(firstShip).fb.db, COLLECTIONS.crewConfig, CONFIG_DOCS.engines)
@@ -7707,12 +7849,12 @@ function setUpdateSetting(config2, key, value, ship2) {
 function setLocalMcp(config2, value, ship2) {
   if (!ship2) {
     throw new CliError(
-      `"${LOCAL_MCP}" is granted one Ship at a time: \`lumi-runner config set ${LOCAL_MCP} ${value} --ship <shipId>\`. There is no machine-wide form \u2014 allowing a Ship to run programs here should be a decision about that Ship. \`lumi-runner ship list\` shows the ids.`
+      `"${LOCAL_MCP}" is granted one Ship at a time: \`${RUNNER_BIN} config set ${LOCAL_MCP} ${value} --ship <shipId>\`. There is no machine-wide form \u2014 allowing a Ship to run programs here should be a decision about that Ship. \`${RUNNER_BIN} ship list\` shows the ids.`
     );
   }
   if (!config2.ships.includes(ship2)) {
     throw new CliError(
-      `This machine does not serve Ship "${ship2}". Run \`lumi-runner ship list\` to see which Ships it serves, or \`lumi-runner ship add ${ship2}\` to add it.`
+      `This machine does not serve Ship "${ship2}". Run \`${RUNNER_BIN} ship list\` to see which Ships it serves, or \`${RUNNER_BIN} ship add ${ship2}\` to add it.`
     );
   }
   const allowed = parseBool(value);
@@ -7732,7 +7874,7 @@ function setLocalMcp(config2, value, ship2) {
       "  This Ship may now start MCP servers as programs on this machine, and reach servers on its loopback address. Only the connections a captain registered on that Ship, and only the ones activated on the agent running the job."
     );
   }
-  say.line("  Restart the daemon for this to take effect: `lumi-runner service restart`.");
+  say.line(`  Restart the daemon for this to take effect: \`${RUNNER_BIN} service restart\`.`);
   return 0;
 }
 function setParallel(config2, value, ship2) {
@@ -7740,7 +7882,7 @@ function setParallel(config2, value, ship2) {
   if (ship2) {
     if (!config2.ships.includes(ship2)) {
       throw new CliError(
-        `This machine does not serve Ship "${ship2}". Run \`lumi-runner ship list\` to see which Ships it serves, or \`lumi-runner ship add ${ship2}\` to add it.`
+        `This machine does not serve Ship "${ship2}". Run \`${RUNNER_BIN} ship list\` to see which Ships it serves, or \`${RUNNER_BIN} ship add ${ship2}\` to add it.`
       );
     }
     const overrides = { ...config2.shipParallelJobs ?? {} };
@@ -7764,10 +7906,10 @@ function setParallel(config2, value, ship2) {
   );
   if (ship2 && parsed !== null && parsed > machine) {
     say.line(
-      `  Capped at the machine-wide limit of ${machine}. Raise it with \`lumi-runner config set ${PARALLEL} ${parsed}\`.`
+      `  Capped at the machine-wide limit of ${machine}. Raise it with \`${RUNNER_BIN} config set ${PARALLEL} ${parsed}\`.`
     );
   }
-  say.line("  Restart the daemon for this to take effect: `lumi-runner service restart`.");
+  say.line(`  Restart the daemon for this to take effect: \`${RUNNER_BIN} service restart\`.`);
   return 0;
 }
 
@@ -7827,20 +7969,27 @@ function serviceCheckFrom(status) {
       "service",
       "Background service",
       `Installed, but the unit points at a CLI that no longer exists (${status.execPath}). It is registered and retrying forever without ever starting.`,
-      "Run `lumi-runner uninstall` to remove it, or `lumi-runner service install` to repoint it at this install."
+      `Run \`${RUNNER_BIN} uninstall\` to remove it, or \`${RUNNER_BIN} service install\` to repoint it at this install.`
     );
   }
   if (status.state === "running") return ok("service", "Background service", status.detail);
   if (status.state === "installed") {
-    return warn("service", "Background service", status.detail, "Run `lumi-runner service restart`.");
+    return warn("service", "Background service", status.detail, `Run \`${RUNNER_BIN} service restart\`.`);
+  }
+  if (status.state === "unsupported") {
+    return warn(
+      "service",
+      "Background service",
+      status.detail,
+      `Run \`${RUNNER_BIN} start\` to keep this machine online \u2014 in Docker, make that the container's command.`
+    );
   }
-  if (status.state === "unsupported") return warn("service", "Background service", status.detail);
   if (status.state === "not-installed") {
     return warn(
       "service",
       "Background service",
       "Not installed \u2014 the daemon only runs while a terminal is open.",
-      "Run `lumi-runner service install` to keep this Ship online whenever the machine is."
+      `Run \`${RUNNER_BIN} service install\` to keep this Ship online whenever the machine is.`
     );
   }
   return warn("service", "Background service", `Unrecognised service state: ${status.state}.`);
@@ -7862,7 +8011,7 @@ function serviceBinaryCheckFrom(input) {
     id,
     label,
     `The daemon's PATH is missing ${missing.join(", ")} \u2014 it was captured when the service was installed, and jobs will fail with \`spawn ${missing[0]} ENOENT\` even though this terminal finds it.`,
-    "Run `lumi-runner service install` from a shell where these work, to rewrite the unit with the current PATH."
+    `Run \`${RUNNER_BIN} service install\` from a shell where these work, to rewrite the unit with the current PATH.`
   );
 }
 function resolvesOnPath(binary, pathValue) {
@@ -7903,7 +8052,7 @@ function localMcpCheckFrom(shipId, servers, allowed) {
     id,
     label,
     `${local.length} connection(s) run on this machine and are not allowed here: ${names}.`,
-    `lumi-runner config set local-mcp on --ship ${shipId}`
+    `${RUNNER_BIN} config set local-mcp on --ship ${shipId}`
   );
 }
 async function checkVersion(config2) {
@@ -7922,7 +8071,7 @@ async function checkShips(config2) {
   const manyIdentities = configRunnerIdentities(config2).length > 1;
   if (config2.ships.length === 0) {
     checks.push(
-      fail("ships", "Ships", "This machine serves no Ships.", "Run `lumi-runner ship add` to pick one.")
+      fail("ships", "Ships", "This machine serves no Ships.", `Run \`${RUNNER_BIN} ship add\` to pick one.`)
     );
     return { checks, engines, needsGithub };
   }
@@ -7937,7 +8086,7 @@ async function checkShips(config2) {
           `key:${shipId}`,
           `Ship ${shipId} \u2014 key`,
           e instanceof Error ? e.message : String(e),
-          "Ask a captain to approve this machine on that Ship's Daemons page, then re-run `lumi-runner login`."
+          `Ask a captain to approve this machine on that Ship's Daemons page, then re-run \`${RUNNER_BIN} login\`.`
         )
       );
       continue;
@@ -7952,7 +8101,7 @@ async function checkShips(config2) {
             `approval:${shipId}`,
             `Ship ${shipId} \u2014 approval`,
             "This machine has no record on that Ship.",
-            "Re-run `lumi-runner login` \u2014 approving is what enrols it."
+            `Re-run \`${RUNNER_BIN} login\` \u2014 approving is what enrols it.`
           )
         );
       } else if (snap.data().approved !== true) {
@@ -7989,11 +8138,11 @@ async function checkShips(config2) {
       agents = snap.docs.map((d) => ({ id: d.id, ...d.data() }));
     } catch {
     }
-    const shipEngines = enginesForAgents(agents);
+    const credentials = await loadShipCredentials(session.fb.db, shipId).catch(() => []);
+    const shipEngines = engineSet([...enginesForAgents(agents), ...enginesForCredentials(credentials)]);
     for (const id of shipEngines) engines.add(id);
     if (agents.some((agent) => effectiveAgentTools(agent).github.enabled)) needsGithub = true;
     try {
-      const credentials = await loadShipCredentials(session.fb.db, shipId).catch(() => []);
       const missing = [
         ...new Set(
           [...shipEngines].flatMap(
@@ -8032,8 +8181,8 @@ async function checkShips(config2) {
       );
     }
     try {
-      const credentials = await loadShipCredentials(session.fb.db, shipId).catch(() => []);
-      for (const cred of credentials) {
+      const credentials2 = await loadShipCredentials(session.fb.db, shipId).catch(() => []);
+      for (const cred of credentials2) {
         if (!isMachineHeldCredential(cred) || cred.runnerId !== session.runnerId) continue;
         if (!isMachineLoginEngine(cred.engine)) continue;
         const driver = getDriver(cred.engine);
@@ -8098,7 +8247,7 @@ async function runDoctor() {
   const config2 = loadConfig();
   if (!config2) {
     checks.push(
-      fail("config", "Configuration", "This machine is not connected.", "Run `lumi-runner setup`.")
+      fail("config", "Configuration", "This machine is not connected.", `Run \`${RUNNER_BIN} setup\`.`)
     );
     return report2(checks);
   }
@@ -8122,19 +8271,26 @@ async function runDoctor() {
   const needsGithub = shipResults.needsGithub;
   const jobBinaries = [];
   for (const engineId of engines) {
-    const health = await getDriver(engineId).healthCheck();
-    if (health.binary) jobBinaries.push(health.binary);
+    const health2 = await getDriver(engineId).healthCheck();
+    if (health2.binary) jobBinaries.push(health2.binary);
     const managed = managedEngineBin(engineId, {});
     const version = managed ? readEngineMarker(configDir(), engineId)?.version : null;
-    const origin = managed ? ` \u2014 installed by this runner${version ? ` (${version})` : ""}` : health.binary && health.binary !== engineId ? " \u2014 from CREW_*_BIN" : " \u2014 already on this machine";
+    const origin = managed ? ` \u2014 installed by this runner${version ? ` (${version})` : ""}` : health2.binary && health2.binary !== engineId ? " \u2014 from CREW_*_BIN" : " \u2014 already on this machine";
     checks.push(
-      health.ok ? ok(`engine:${engineId}`, `Engine "${engineId}"`, `${health.detail}${origin}`) : fail(
+      health2.ok ? ok(`engine:${engineId}`, `Engine "${engineId}"`, `${health2.detail}${origin}`) : fail(
         `engine:${engineId}`,
         `Engine "${engineId}"`,
-        health.detail,
+        health2.detail,
         // A way forward the operator can type, ahead of the vendor's download page: this
         // runner installs it itself, and the old message never said so.
-        enginePackageFor(engineId) ? `Run \`${RUNNER_BIN} engine install ${engineId}\` (a few hundred MB), or ${health.fix ?? "install the CLI yourself"}` : health.fix
+        //
+        // THE AUTOMATIC PATH GOES FIRST since §15.85, because on a fresh machine it is the one
+        // that will actually happen and the old wording hid it. `doctor` runs BEFORE the daemon
+        // exists during `setup`, so this row is guaranteed to fail there — and an operator who
+        // read "N check(s) failed" walked away believing the runner does not install engines,
+        // minutes before it silently did. Naming the daemon first is the difference between a
+        // failure and a step that has not happened yet.
+        enginePackageFor(engineId) ? `This machine installs it itself once its daemon is running (\`${RUNNER_BIN} start\`). To do it now: \`${RUNNER_BIN} engine install ${engineId}\` (a few hundred MB), or ${health2.fix ?? "install the CLI yourself"}` : health2.fix
       )
     );
     if (managed) jobBinaries.push("node");
@@ -8209,7 +8365,7 @@ async function runEngineList() {
   for (const engineId of installableEngineIds()) {
     const pkg = enginePackageFor(engineId);
     const { origin, bin, version } = originOf(engineId);
-    const health = await getDriver(engineId).healthCheck();
+    const health2 = await getDriver(engineId).healthCheck();
     const record = state[engineId];
     rows.push({
       engine: engineId,
@@ -8217,10 +8373,10 @@ async function runEngineList() {
       package: pkg?.npmPackage ?? null,
       shipped: DEFAULT_ENGINE_POLICIES[engineId]?.knownGood ?? null,
       installed: version,
-      origin: origin === "none" && health.ok ? "path" : origin,
-      binary: bin ?? health.binary ?? null,
-      ok: health.ok,
-      detail: health.ok ? void 0 : health.detail,
+      origin: origin === "none" && health2.ok ? "path" : origin,
+      binary: bin ?? health2.binary ?? null,
+      ok: health2.ok,
+      detail: health2.ok ? void 0 : health2.detail,
       lastAttempt: record ? { target: record.target, outcome: record.outcome, attempts: record.attempts, detail: record.detail } : null,
       diskBytes: dirSize(enginePrefixDir(root, engineId))
     });
@@ -8428,7 +8584,7 @@ Code: ${pc.bold(start.displayCode)}`,
   }
   if (!approved) {
     progress.stop("");
-    throw new CliError("The approval window expired. Run `lumi-runner login` again.");
+    throw new CliError(`The approval window expired. Run \`${RUNNER_BIN} login\` again.`);
   }
   progress.stop("Approved.");
   const { config: config2, approvedShips, pendingShips, occupiedShips, newIdentity, otherShips } = buildLoginResult(
@@ -8438,7 +8594,7 @@ Code: ${pc.bold(start.displayCode)}`,
     options.mcpUrl
   );
   if (!config2.runnerId) {
-    throw new CliError("The approval did not name this machine. Run `lumi-runner login` again.");
+    throw new CliError(`The approval did not name this machine. Run \`${RUNNER_BIN} login\` again.`);
   }
   if (!config2.apiKey) {
     throw new CliError(
@@ -8541,11 +8697,11 @@ function report3(result) {
   }
   if (result.otherShips && result.otherShips.length > 0) {
     say.info(
-      `Still serving ${result.otherShips.join(", ")} \u2014 this approval did not mention them. \`lumi-runner ship remove <shipId>\` to stop.`
+      `Still serving ${result.otherShips.join(", ")} \u2014 this approval did not mention them. \`${RUNNER_BIN} ship remove <shipId>\` to stop.`
     );
   }
   if (serviceStatus().state === "running") {
-    say.info("Restart the daemon for this to take effect: `lumi-runner service restart`.");
+    say.info(`Restart the daemon for this to take effect: \`${RUNNER_BIN} service restart\`.`);
   }
   return 0;
 }
@@ -8574,7 +8730,16 @@ async function runLogs(options) {
 // src/cli/commands/service.ts
 async function runServiceInstall() {
   const before = serviceStatus();
-  if (before.state !== "not-installed" && before.state !== "unsupported") {
+  if (before.state === "unsupported") {
+    if (isJson()) {
+      emitJson({ installed: false, supported: false, ...before });
+      return 1;
+    }
+    say.warn(before.detail);
+    say.info(`Run \`${RUNNER_BIN} start\` to keep the daemon up \u2014 in Docker, make that the container's command.`);
+    return 1;
+  }
+  if (before.state !== "not-installed") {
     const replace = await promptConfirm({
       message: "A service is already installed. Reinstall it with the current settings?",
       initialValue: true
@@ -8632,7 +8797,7 @@ async function runServiceStatus() {
   say.line(`  ${status.detail}`);
   if (status.unitPath) say.line(`  ${status.unitPath}`);
   if (status.execMissing) {
-    say.warn(`The unit runs ${status.execPath}, which no longer exists. Run \`lumi-runner uninstall\`.`);
+    say.warn(`The unit runs ${status.execPath}, which no longer exists. Run \`${RUNNER_BIN} uninstall\`.`);
   }
   return 0;
 }
@@ -8698,14 +8863,14 @@ async function pickShips(current) {
   const ships = await listMyShips();
   if (ships.length === 0) {
     throw new CliError(
-      "This machine holds no Ship keys. Run `lumi-runner login` and have a captain approve it \u2014 a daemon can only serve Ships it was approved for."
+      `This machine holds no Ship keys. Run \`${RUNNER_BIN} login\` and have a captain approve it \u2014 a daemon can only serve Ships it was approved for.`
     );
   }
   return promptMultiSelect({
     message: "Which Ships should this machine serve?",
     choices: ships.map((ship2) => ({ value: ship2.id, label: ship2.name || ship2.id, hint: ship2.id })),
     initialValues: current.filter((id) => ships.some((s) => s.id === id)),
-    flagHint: "lumi-runner ship add <shipId>"
+    flagHint: `${RUNNER_BIN} ship add <shipId>`
   });
 }
 async function runShipList() {
@@ -8715,7 +8880,7 @@ async function runShipList() {
     return 0;
   }
   if (config2.ships.length === 0) {
-    say.warn("This machine serves no Ships. Run `lumi-runner ship add`.");
+    say.warn(`This machine serves no Ships. Run \`${RUNNER_BIN} ship add\`.`);
     return 0;
   }
   for (const shipId of config2.ships) say.line(`  ${shipId}`);
@@ -8746,18 +8911,36 @@ function reportAssignment(ships) {
     return 0;
   }
   say.success(ships.length > 0 ? `Serving: ${ships.join(", ")}` : "Serving no Ships.");
-  say.info("Restart the daemon for this to take effect: `lumi-runner service restart`.");
+  say.info(`Restart the daemon for this to take effect: \`${RUNNER_BIN} service restart\`.`);
   return 0;
 }
 
 // src/cli/commands/setup.ts
+function shipChoiceFrom(input) {
+  const label = (id) => input.fetched?.find((s) => s.id === id)?.name || id;
+  const serving = input.serving.map(label).join(", ");
+  const question = `Serving ${serving}. Change which Ships this machine serves? (yes replaces the list)`;
+  if (!input.fetched || input.fetched.length < input.keyCount) return { ask: true, line: question };
+  const servingIds = new Set(input.serving);
+  const others = input.fetched.filter((s) => !servingIds.has(s.id));
+  const fetchedIds = new Set(input.fetched.map((s) => s.id));
+  const unkeyed = input.serving.filter((id) => !fetchedIds.has(id));
+  if (others.length === 0 && unkeyed.length === 0) {
+    return { ask: false, line: `Serving ${serving}. This machine holds no other Ship keys.` };
+  }
+  if (others.length === 0) return { ask: true, line: question };
+  return {
+    ask: true,
+    line: `Serving ${serving}. This machine also holds a key for ${others.map((s) => s.name || s.id).join(", ")}. Change which Ships it serves? (yes replaces the list)`
+  };
+}
 async function runSetup(options) {
   if (!canPrompt()) {
     throw new CliError(
-      "setup is interactive. On a headless machine run `lumi-runner login`, `lumi-runner ship add <id>` and `lumi-runner service install` instead."
+      `setup is interactive. On a headless machine run \`${RUNNER_BIN} login\`, \`${RUNNER_BIN} ship add <id>\` and \`${RUNNER_BIN} service install\` instead.`
     );
   }
-  say.intro("lumi-runner setup");
+  say.intro(`${RUNNER_BIN} setup`);
   const moved = migrateLegacyDir();
   if (moved?.migrated) say.info(`Moved your runner config from ${moved.from} to ${moved.to}.`);
   const existing = loadConfig();
@@ -8782,7 +8965,7 @@ async function runSetup(options) {
         }
       ],
       initialValue: "keep",
-      flagHint: "lumi-runner login"
+      flagHint: `${RUNNER_BIN} login`
     });
     if (action2 === "add") {
       await runLogin(options);
@@ -8805,14 +8988,24 @@ async function runSetup(options) {
     saveConfig(config2);
     say.success(`Serving: ${config2.ships.join(", ") || "(none)"}`);
   } else {
-    const change = await promptConfirm({
-      message: `Serving ${config2.ships.join(", ")}. Change that?`,
-      initialValue: false,
-      yesFlagApplies: false
+    const fetched = await listMyShips().catch(() => null);
+    const choice = shipChoiceFrom({
+      serving: config2.ships,
+      fetched,
+      keyCount: Object.keys(config2.shipKeys ?? {}).length
     });
-    if (change) {
-      config2.ships = await pickShips(config2.ships);
-      saveConfig(config2);
+    if (!choice.ask) {
+      say.info(choice.line);
+    } else {
+      const change = await promptConfirm({
+        message: choice.line,
+        initialValue: false,
+        yesFlagApplies: false
+      });
+      if (change) {
+        config2.ships = await pickShips(config2.ships);
+        saveConfig(config2);
+      }
     }
   }
   say.step("Checking this machine\u2026");
@@ -8826,7 +9019,7 @@ async function runSetup(options) {
       yesFlagApplies: false
     });
     if (install) await runServiceInstall();
-    else say.info("Skipped. Run `lumi-runner start` manually, or `lumi-runner service install` later.");
+    else say.info(`Skipped. Run \`${RUNNER_BIN} start\` manually, or \`${RUNNER_BIN} service install\` later.`);
   } else if (service2 === "running" || service2 === "installed") {
     const drift = serviceEnvDrift(serviceEnv(), status.unitEnv);
     if (drift.length > 0) {
@@ -8836,9 +9029,14 @@ async function runSetup(options) {
       say.step("Restarting the daemon so it picks up this configuration\u2026");
       await runServiceRestart();
     }
+  } else if (service2 === "unsupported") {
+    say.info(status.detail);
+    say.info(
+      `Run \`${RUNNER_BIN} start\` to keep this machine online \u2014 in Docker, make that the container's command so the daemon is the thing the container runs.`
+    );
   }
   say.outro(
-    doctorExit === 0 ? "Ready. This machine will claim jobs for its Ships." : "Setup finished, but some checks failed \u2014 fix those and re-run `lumi-runner doctor`."
+    doctorExit === 0 ? "Ready. This machine will claim jobs for its Ships." : `Setup finished, but some checks failed \u2014 fix those and re-run \`${RUNNER_BIN} doctor\`.`
   );
   return doctorExit;
 }
@@ -8860,7 +9058,7 @@ async function runStatus() {
       emitJson({ version: RUNNER_VERSION, connected: false });
       return 0;
     }
-    say.warn("This machine is not connected. Run `lumi-runner setup`.");
+    say.warn(`This machine is not connected. Run \`${RUNNER_BIN} setup\`.`);
     return 0;
   }
   const progress = spinner2();
@@ -8952,7 +9150,7 @@ async function runStatus() {
   say.line(`  ${pc.bold("Service")}  ${service2.detail}`);
   say.line("");
   if (ships.length === 0) {
-    say.warn("This machine serves no Ships. Run `lumi-runner ship add`.");
+    say.warn(`This machine serves no Ships. Run \`${RUNNER_BIN} ship add\`.`);
     return 0;
   }
   for (const ship2 of ships) {
@@ -9074,7 +9272,7 @@ async function runUpdate(options = {}) {
 
 // src/cli/index.ts
 var program = new Command();
-program.name("lumi-runner").description("Lumi Crew runner daemon \u2014 runs agent jobs for your Ships on this machine.").version(RUNNER_VERSION).option("--json", "machine-readable output on stdout").option("-y, --yes", "assume yes for confirmations").option("--no-color", "disable coloured output").hook("preAction", (command) => {
+program.name(RUNNER_BIN).description("Lumi Crew runner daemon \u2014 runs agent jobs for your Ships on this machine.").version(RUNNER_VERSION).option("--json", "machine-readable output on stdout").option("-y, --yes", "assume yes for confirmations").option("--no-color", "disable coloured output").hook("preAction", (command) => {
   const options = command.opts();
   configureOutput(options);
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kilogent/runner",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "type": "module",
   "description": "Lumi Crew runner daemon — claims jobs from your Ships and executes them as headless agent sessions (Claude Code today) on your own machine.",
   "//name": "The ONLY package in this monorepo published to the public registry, so it is the one that does not follow the internal @lumi/crew-* convention: `@lumi` is not a scope we own, `@lumi.ai` is (the npm org). The workspace DIRECTORY stays packages/crew/runner — renaming the package is not renaming the folder.",