@skrr-ai/cli 0.1.101 → 0.1.103

package/dist/commands/commitments/roster.d.ts

@@ -0,0 +1,15 @@
+import { BaseCommand } from '../../base-command';
+/**
+ * Every Commitment one agent holds — system roles included — with whether its
+ * loop is actually installed and working: what it watches, when it next wakes,
+ * whether the last check was stopped, and what it ran today.
+ */
+export default class CommitmentsRoster extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        agent: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/commitments/roster.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const commitments_1 = require("../../lib/commitments");
+const commitment_loop_status_1 = require("../../lib/commitment-loop-status");
+/**
+ * Every Commitment one agent holds — system roles included — with whether its
+ * loop is actually installed and working: what it watches, when it next wakes,
+ * whether the last check was stopped, and what it ran today.
+ */
+class CommitmentsRoster extends base_command_1.BaseCommand {
+    static description = "List an agent's commitments with each one's loop state (healthy, blocked, paused, unarmed, degraded, inactive, unknown)";
+    static examples = [
+        '<%= config.bin %> commitments roster --agent agent_abc123',
+        '<%= config.bin %> commitments roster --agent agent_abc123 --json',
+    ];
+    static flags = {
+        agent: core_1.Flags.string({ description: 'Agent ID', required: true }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(CommitmentsRoster);
+        try {
+            const roster = await commitments_1.commitmentApi.roster(flags.agent);
+            if (flags.json) {
+                this.log(JSON.stringify(roster, null, 2));
+                return;
+            }
+            for (const line of (0, commitment_loop_status_1.formatCommitmentRoster)(roster))
+                this.log(line);
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+    }
+}
+exports.default = CommitmentsRoster;

package/dist/commands/commitments/show.js

@@ -49,7 +49,7 @@ class CommitmentsShow extends base_command_1.BaseCommand {
             this.log(`Commitment ${args.id} not found.`);
             return;
         }
-        (0, commitments_1.renderCommitmentSummary)(response.commitment, (line) => this.log(line), response.latestCheck);
+        (0, commitments_1.renderCommitmentSummary)((0, commitments_1.withLiveAssessment)(response.commitment, response.operatingState), (line) => this.log(line), response.latestCheck);
         // Whose permissions a run uses (OSK-11975) — read from the operating state,
         // which carries the same projection preflight reports (OSK-12065).
         const autonomy = response.operatingState?.execution;

package/dist/commands/commitments/status.d.ts

@@ -0,0 +1,17 @@
+import { BaseCommand } from '../../base-command';
+/**
+ * Is this commitment's loop installed and working? Names the loop state and
+ * why, the next wakes, each watched source's access, the last stop and its
+ * fix, and today's runs and spend.
+ */
+export default class CommitmentsStatus extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        commitmentId: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/commitments/status.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const commitments_1 = require("../../lib/commitments");
+const commitment_loop_status_1 = require("../../lib/commitment-loop-status");
+/**
+ * Is this commitment's loop installed and working? Names the loop state and
+ * why, the next wakes, each watched source's access, the last stop and its
+ * fix, and today's runs and spend.
+ */
+class CommitmentsStatus extends base_command_1.BaseCommand {
+    static description = "Show whether a commitment's loop is installed and working: state, next wakes, source access, last stop, cost";
+    static examples = [
+        '<%= config.bin %> commitments status obj_abc123',
+        '<%= config.bin %> commitments status obj_abc123 --json',
+    ];
+    static args = {
+        commitmentId: core_1.Args.string({ ignoreStdin: true, description: 'Commitment ID', required: true }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(CommitmentsStatus);
+        try {
+            const status = await commitments_1.commitmentApi.loopStatus(args.commitmentId);
+            if (flags.json) {
+                this.log(JSON.stringify(status, null, 2));
+                return;
+            }
+            for (const line of (0, commitment_loop_status_1.formatCommitmentLoopStatus)(status))
+                this.log(line);
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+    }
+}
+exports.default = CommitmentsStatus;

package/dist/commands/commitments/update.js

@@ -103,11 +103,11 @@ JSON
             options: [...commitments_1.COMMITMENT_WATCHED_SOURCES],
         }),
         'watch-space': core_1.Flags.string({
-            description: 'Space to watch (repeatable). Accepts a space id, ref, or unique title. Implies --watch space.',
+            description: 'One Space to watch. Accepts a space id, ref, or unique title. Implies --watch space.',
             multiple: true,
         }),
         'watch-monitor': core_1.Flags.string({
-            description: 'Signal Monitor id to watch (repeatable). Implies --watch monitor.',
+            description: 'One Signal Monitor id to watch. Implies --watch monitor.',
             multiple: true,
         }),
         cadence: core_1.Flags.string({
@@ -187,7 +187,8 @@ JSON
                         ? { reviewPolicy: (0, commitment_product_1.normalizeTaskReviewPolicy)(flags['task-review-policy']) }
                         : {}),
                 };
-                payload.expectedVersion ??= current?.version;
+                if (payload.expectedVersion === undefined)
+                    payload.expectedVersion = current?.version;
             }
             const declaredDelivery = payload.delivery;
             if (declaredDelivery?.reviewPolicy !== undefined)
@@ -270,15 +271,13 @@ JSON
                 monitorIds: (0, triggers_1.splitRepeated)(flags['watch-monitor']),
             });
             if (built) {
-                // Flags replace the selected source SET, not the declarations of a
-                // retained binding. In particular agent_run's named keys are JSON
-                // authored; rebuilding a bare source silently erased them (OSK-15110).
+                // A flag edit selects the full replacement set. Keep sensing declarations
+                // only for a binding it still names; explicit JSON is the authored base.
                 const declarations = Array.isArray(payload.watchedSources)
-                    ? payload.watchedSources
+                    ? (0, commitments_1.normalizeWatchedSourceDeclarations)(payload.watchedSources)
                     : current?.watchedSources ?? [];
                 payload.watchedSources = built.map((next) => {
-                    const scopeKey = next.source === 'space' ? 'spaceId'
-                        : next.source === 'monitor' ? 'monitorId' : undefined;
+                    const scopeKey = next.source === 'space' ? 'spaceId' : next.source === 'monitor' ? 'monitorId' : undefined;
                     const nextConfig = next.config;
                     const prior = declarations.find((binding) => binding?.source === next.source &&
                         (!scopeKey || binding.config?.[scopeKey] === nextConfig?.[scopeKey]));
@@ -321,6 +320,18 @@ JSON
                     cadence.mode = flags['cadence-mode'];
                 if (flags.timezone)
                     cadence.timezone = flags.timezone;
+                // A daily cadence runs at set times and has no interval, so `--cadence 6h`
+                // on one was stored as an `intervalMs` nothing reads: the command succeeded,
+                // the version moved, and the cadence still read "daily 08:00". Refuse it and
+                // say what would do what was meant (OSK-15418).
+                if (flags.cadence && cadence.mode === 'daily') {
+                    const at = Array.isArray(cadence.times) && cadence.times.length
+                        ? ` at ${cadence.times.join(', ')}`
+                        : '';
+                    this.error(`This commitment's cadence is daily${at}, which has no interval, so --cadence ${flags.cadence} would change nothing. ` +
+                        `To check every ${flags.cadence} instead, add --cadence-mode interval. ` +
+                        'To change the daily times, use --from-json with cadence.times.', { exit: 1 });
+                }
                 // A mode change must not carry the previous mode's fields into the
                 // replacement. Keep explicitly authored fields so invalid combinations
                 // are refused rather than silently discarding what the user requested.
@@ -371,6 +382,9 @@ JSON
                 Object.prototype.hasOwnProperty.call(finalEnvelope, 'maxConcurrentRuns')) {
                 throw new Error('An autonomous Agent cannot change owner Commitment concurrency policy. Ask the owner to run this update outside the Agent session.');
             }
+            if (Array.isArray(payload.watchedSources)) {
+                payload.watchedSources = (0, commitments_1.normalizeWatchedSourceDeclarations)(payload.watchedSources);
+            }
         }
         catch (err) {
             this.error(err.message, { exit: 1 });

package/dist/commands/commitments/work-plan.d.ts

@@ -0,0 +1,11 @@
+import { BaseCommand } from '../../base-command';
+export default class CommitmentsWorkPlan extends BaseCommand {
+    static description: string;
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/commitments/work-plan.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const commitments_1 = require("../../lib/commitments");
+class CommitmentsWorkPlan extends base_command_1.BaseCommand {
+    static description = 'Read permission-filtered delegated assignments and workflow episodes for a responsibility';
+    static args = { id: core_1.Args.string({ description: 'Commitment ID', required: true, ignoreStdin: true }) };
+    static flags = { json: core_1.Flags.boolean({ description: 'Output the complete public work-plan projection as JSON' }) };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(CommitmentsWorkPlan);
+        try {
+            const plan = await commitments_1.commitmentApi.workPlan(args.id);
+            if (flags.json) {
+                this.log(JSON.stringify(plan, null, 2));
+                return;
+            }
+            for (const key of ['assignments', 'episodes']) {
+                const rows = plan[key];
+                this.log(`${key}: ${Array.isArray(rows) ? rows.length : 'unavailable'}`);
+                if (Array.isArray(rows))
+                    for (const row of rows) {
+                        if (typeof row === 'object' && row !== null)
+                            this.log(`  ${JSON.stringify(row)}`);
+                    }
+            }
+            this.log(`Coverage: ${JSON.stringify(plan.coverage ?? {})}`);
+            this.log(`Coordinator: ${JSON.stringify(plan.coordinatorState ?? {})}`);
+        }
+        catch (error) {
+            this.handleApiError(error);
+        }
+    }
+}
+exports.default = CommitmentsWorkPlan;

package/dist/commands/compass/effective-policy.d.ts

@@ -0,0 +1,12 @@
+import { BaseCommand } from '../../base-command';
+export default class CompassEffectivePolicy extends BaseCommand {
+    static description: string;
+    static args: {
+        compassId: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        agent: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/compass/effective-policy.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const compasses_1 = require("../../lib/compasses");
+class CompassEffectivePolicy extends base_command_1.BaseCommand {
+    static description = 'Read a Compass policy revision, effective defaults and field provenance';
+    static args = { compassId: core_1.Args.string({ description: 'Compass ID', required: true, ignoreStdin: true }) };
+    static flags = {
+        agent: core_1.Flags.string({ description: 'Agent ID that owns the Compass', required: true }),
+        json: core_1.Flags.boolean({ description: 'Output the complete policy and provenance as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(CompassEffectivePolicy);
+        try {
+            const policy = await compasses_1.compassApi.effectivePolicy(args.compassId, { agentId: flags.agent });
+            if (flags.json) {
+                this.log(JSON.stringify(policy, null, 2));
+                return;
+            }
+            this.log(`Compass ${policy.compassId}, revision ${policy.compassVersion}: ${policy.status}`);
+            this.log(`Applies to runtime: ${policy.appliesToRuntime === true ? 'yes' : 'no'}`);
+            this.log(`Autonomy defaults: ${JSON.stringify(policy.autonomy ?? {})}`);
+            this.log(`Communication defaults: ${JSON.stringify(policy.communication ?? {})}`);
+            this.log(`Authority: ${policy.authority ?? 'unknown'}`);
+            this.log(`Field provenance: ${JSON.stringify(policy.fieldProvenance ?? {})}`);
+        }
+        catch (error) {
+            this.handleApiError(error);
+        }
+    }
+}
+exports.default = CompassEffectivePolicy;

package/dist/commands/compass/update.d.ts

@@ -1,4 +1,15 @@
 import { BaseCommand } from '../../base-command';
+/**
+ * The server fences every compass write on the version the caller last saw
+ * (`expectedVersion`, required), so a stale writer gets a conflict instead of
+ * silently overwriting a newer revision. Precedence: an explicit flag, then a
+ * value the caller put in `--json-body` (passed through untouched, so an invalid
+ * one is the server's to refuse), then the current version read just now.
+ */
+export declare function resolveExpectedVersion(explicit: number | undefined, fileBody: Record<string, unknown>, fetchCurrentVersion: () => Promise<number>): Promise<{
+    version: unknown;
+    source: 'flag' | 'json-body' | 'current';
+}>;
 /**
  * `skrr compass update <compass-id> --agent <id>`
  *
@@ -24,6 +35,7 @@ export default class CompassUpdate extends BaseCommand {
         status: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         invariant: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         reason: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'expected-version': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'json-body': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
     };
     run(): Promise<void>;

package/dist/commands/compass/update.js

@@ -1,10 +1,26 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveExpectedVersion = resolveExpectedVersion;
 const core_1 = require("@oclif/core");
 const base_command_1 = require("../../base-command");
 const prompt_1 = require("../../lib/prompt");
 const compasses_1 = require("../../lib/compasses");
 const web_url_1 = require("../../lib/web-url");
+/**
+ * The server fences every compass write on the version the caller last saw
+ * (`expectedVersion`, required), so a stale writer gets a conflict instead of
+ * silently overwriting a newer revision. Precedence: an explicit flag, then a
+ * value the caller put in `--json-body` (passed through untouched, so an invalid
+ * one is the server's to refuse), then the current version read just now.
+ */
+async function resolveExpectedVersion(explicit, fileBody, fetchCurrentVersion) {
+    if (explicit !== undefined)
+        return { version: explicit, source: 'flag' };
+    if (fileBody.expectedVersion !== undefined) {
+        return { version: fileBody.expectedVersion, source: 'json-body' };
+    }
+    return { version: await fetchCurrentVersion(), source: 'current' };
+}
 /**
  * `skrr compass update <compass-id> --agent <id>`
  *
@@ -22,6 +38,7 @@ class CompassUpdate extends base_command_1.BaseCommand {
         '<%= config.bin %> compass update agch_abc --agent agent_xyz --title "Reliability & cost"',
         '<%= config.bin %> compass update agch_abc --agent agent_xyz --invariant "p99 under 300ms" --reason "new SLO"',
         '<%= config.bin %> compass update agch_abc --agent agent_xyz --json-body ./compass.json',
+        '<%= config.bin %> compass update agch_abc --agent agent_xyz --title "New" --expected-version 4',
     ];
     static args = {
         compassId: core_1.Args.string({ ignoreStdin: true, description: 'Compass ID', required: true }),
@@ -37,6 +54,11 @@ class CompassUpdate extends base_command_1.BaseCommand {
             multiple: true,
         }),
         reason: core_1.Flags.string({ description: 'Why — recorded on the revision ledger' }),
+        'expected-version': core_1.Flags.integer({
+            min: 1,
+            description: 'Compass version this change is based on; the update is refused if it moved. ' +
+                'Defaults to the version read at the start of this command.',
+        }),
         'json-body': core_1.Flags.string({ description: 'Path to a JSON file with the full body' }),
     };
     async run() {
@@ -61,6 +83,11 @@ class CompassUpdate extends base_command_1.BaseCommand {
         }
         let compass;
         try {
+            const expected = await resolveExpectedVersion(flags['expected-version'], fileBody, async () => (await compasses_1.compassApi.get(args.compassId, { agentId: flags.agent })).version);
+            body.expectedVersion = expected.version;
+            if (expected.source === 'current' && !flags.json) {
+                this.logToStderr(`No --expected-version given; updating from the current version (v${String(expected.version)}).`);
+            }
             compass = await compasses_1.compassApi.update(args.compassId, body);
         }
         catch (err) {

package/dist/commands/daemon/logs.d.ts

@@ -1,4 +1,5 @@
 import { Command } from '@oclif/core';
+import { execRuntimeBinaryCapture } from '../../lib/exec-runtime-binary';
 /**
  * `skrr daemon logs` — forwards to `oversky logs`, which resolves the
  * per-profile log directory (the daemon owns that mapping, and it varies by
@@ -55,6 +56,43 @@ export declare function resolveLegacyDaemonLogPath(flags: Pick<DaemonLogsFlags,
     home?: string;
     env?: NodeJS.ProcessEnv;
 }): string;
+/** The profile `logs` addresses: --profile, then the profile environment variable, then the pin. */
+export declare function resolveDaemonLogsProfile(flags: Pick<DaemonLogsFlags, 'profile'>, options?: {
+    home?: string;
+    env?: NodeJS.ProcessEnv;
+}): string;
+/**
+ * Log files the installed launchd definition for this profile sends output to
+ * (OSK-15993). The desktop supervisor starts the daemon with
+ * `--log-file ~/Library/Logs/Skrr/daemon.app.log` and redirects stderr to
+ * `daemon.stderr.log`, so the profile's `logs/` directory can hold a file
+ * nobody has written for a week. Read-only: the plist is parsed, never loaded.
+ */
+export declare function installedServiceLogCandidates(profile: string, stderr: boolean, options?: {
+    home?: string;
+    platform?: NodeJS.Platform;
+}): string[];
+/**
+ * Pick the file the legacy fallback reads. An old daemon cannot say which file
+ * it writes, so the most recently written of the profile log and the installed
+ * service's logs is the best evidence of the live one — and whenever that is
+ * not the profile log, the choice is said out loud rather than made silently.
+ */
+export declare function chooseLegacyFallbackLog(args: {
+    profilePath: string;
+    serviceCandidates: readonly string[];
+    mtimeOf: (filePath: string) => number | null;
+}): {
+    path: string;
+    note: string | null;
+};
+/**
+ * Ask the installed runtime which file `logs` will read — the same live-aware
+ * answer it uses itself — so the age banner describes the file actually shown.
+ * Null when the runtime cannot answer in time; the banner is then skipped
+ * rather than printed about a file that may not be the one shown.
+ */
+export declare function resolveForwardedLogPath(flags: Pick<DaemonLogsFlags, 'stderr' | 'profile'>, capture?: typeof execRuntimeBinaryCapture): Promise<string | null>;
 /** Read a bounded trailing window, so an unrotated legacy err log is safe. */
 export declare function readDaemonLogTail(filePath: string, maxLines: number): string[];
 /**
@@ -65,7 +103,7 @@ export declare function readDaemonLogTail(filePath: string, maxLines: number): s
  * `completeTaskDurably`. Every flag declared on the command must appear here,
  * or it parses successfully and is then silently dropped.
  */
-export declare function buildOverskyLogsArgs(flags: DaemonLogsFlags): string[];
+export declare function buildDaemonLogsArgs(flags: DaemonLogsFlags): string[];
 export default class DaemonLogs extends Command {
     static aliases: string[];
     static description: string;

package/dist/commands/daemon/logs.js

@@ -5,8 +5,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.describeLogAge = describeLogAge;
 exports.resolveLegacyDaemonLogPath = resolveLegacyDaemonLogPath;
+exports.resolveDaemonLogsProfile = resolveDaemonLogsProfile;
+exports.installedServiceLogCandidates = installedServiceLogCandidates;
+exports.chooseLegacyFallbackLog = chooseLegacyFallbackLog;
+exports.resolveForwardedLogPath = resolveForwardedLogPath;
 exports.readDaemonLogTail = readDaemonLogTail;
-exports.buildOverskyLogsArgs = buildOverskyLogsArgs;
+exports.buildDaemonLogsArgs = buildDaemonLogsArgs;
 const core_1 = require("@oclif/core");
 const node_fs_1 = require("node:fs");
 const node_os_1 = require("node:os");
@@ -62,6 +66,11 @@ function describeLogAge(mtimeMs, now = Date.now()) {
     };
 }
 function resolveLegacyDaemonLogPath(flags, options = {}) {
+    const home = options.home ?? (0, node_os_1.homedir)();
+    return node_path_1.default.join(home, '.skrr', 'profiles', resolveDaemonLogsProfile(flags, options), 'logs', flags.stderr ? 'daemon.err.log' : 'daemon.log');
+}
+/** The profile `logs` addresses: --profile, then the profile environment variable, then the pin. */
+function resolveDaemonLogsProfile(flags, options = {}) {
     const home = options.home ?? (0, node_os_1.homedir)();
     const env = options.env ?? process.env;
     // An explicit --profile outranks the environment, as it does everywhere else.
@@ -81,7 +90,106 @@ function resolveLegacyDaemonLogPath(flags, options = {}) {
             // An absent/corrupt sticky selector must match the daemon's default.
         }
     }
-    return node_path_1.default.join(home, '.skrr', 'profiles', profile ?? 'default', 'logs', flags.stderr ? 'daemon.err.log' : 'daemon.log');
+    return profile ?? 'default';
+}
+/**
+ * Log files the installed launchd definition for this profile sends output to
+ * (OSK-15993). The desktop supervisor starts the daemon with
+ * `--log-file ~/Library/Logs/Skrr/daemon.app.log` and redirects stderr to
+ * `daemon.stderr.log`, so the profile's `logs/` directory can hold a file
+ * nobody has written for a week. Read-only: the plist is parsed, never loaded.
+ */
+function installedServiceLogCandidates(profile, stderr, options = {}) {
+    if ((options.platform ?? process.platform) !== 'darwin')
+        return [];
+    const plist = node_path_1.default.join(options.home ?? (0, node_os_1.homedir)(), 'Library', 'LaunchAgents', `ai.skrr.daemon.${profile}.plist`);
+    let xml;
+    try {
+        xml = (0, node_fs_1.readFileSync)(plist, 'utf8');
+    }
+    catch {
+        return [];
+    }
+    const unescape = (v) => v
+        .replace(/&lt;/g, '<')
+        .replace(/&gt;/g, '>')
+        .replace(/&quot;/g, '"')
+        .replace(/&apos;/g, "'")
+        .replace(/&amp;/g, '&');
+    const stringFor = (key) => {
+        const m = new RegExp(`<key>\\s*${key}\\s*</key>\\s*<string>([\\s\\S]*?)</string>`).exec(xml);
+        return m?.[1]?.trim() ? unescape(m[1].trim()) : null;
+    };
+    if (stderr) {
+        const errPath = stringFor('StandardErrorPath');
+        return errPath ? [errPath] : [];
+    }
+    const out = [];
+    const array = /<key>\s*ProgramArguments\s*<\/key>\s*<array>([\s\S]*?)<\/array>/.exec(xml);
+    if (array?.[1]) {
+        const args = [...array[1].matchAll(/<string>([\s\S]*?)<\/string>/g)].map((m) => unescape(m[1].trim()));
+        const at = args.lastIndexOf('--log-file');
+        if (at >= 0 && args[at + 1] && !args[at + 1].startsWith('-'))
+            out.push(args[at + 1]);
+    }
+    const stdoutPath = stringFor('StandardOutPath');
+    if (stdoutPath)
+        out.push(stdoutPath);
+    return out;
+}
+/**
+ * Pick the file the legacy fallback reads. An old daemon cannot say which file
+ * it writes, so the most recently written of the profile log and the installed
+ * service's logs is the best evidence of the live one — and whenever that is
+ * not the profile log, the choice is said out loud rather than made silently.
+ */
+function chooseLegacyFallbackLog(args) {
+    const profileMtime = args.mtimeOf(args.profilePath);
+    let best = null;
+    for (const file of args.serviceCandidates) {
+        if (node_path_1.default.resolve(file) === node_path_1.default.resolve(args.profilePath))
+            continue;
+        const mtime = args.mtimeOf(file);
+        if (mtime === null)
+            continue;
+        if (!best || mtime > best.mtime)
+            best = { file, mtime };
+    }
+    if (!best || (profileMtime !== null && profileMtime >= best.mtime)) {
+        return { path: args.profilePath, note: null };
+    }
+    return {
+        path: best.file,
+        note: `Showing ${best.file}, the installed service's log: it was written more recently than ` +
+            (profileMtime === null
+                ? `the profile log ${args.profilePath}, which does not exist.`
+                : `the profile log ${args.profilePath}, which has not been written since.`) +
+            ' This daemon predates `logs`, so it cannot name its live log itself.',
+    };
+}
+/**
+ * Ask the installed runtime which file `logs` will read — the same live-aware
+ * answer it uses itself — so the age banner describes the file actually shown.
+ * Null when the runtime cannot answer in time; the banner is then skipped
+ * rather than printed about a file that may not be the one shown.
+ */
+async function resolveForwardedLogPath(flags, capture = exec_runtime_binary_1.execRuntimeBinaryCapture) {
+    try {
+        const out = await capture(buildDaemonLogsArgs({ ...flags, path: true }), {
+            timeoutMs: 5_000,
+        });
+        if (out.code !== 0)
+            return null;
+        const lines = out.stdout
+            .split('\n')
+            .map((l) => l.trim())
+            .filter(Boolean);
+        const last = lines.at(-1);
+        return last && node_path_1.default.isAbsolute(last) ? last : null;
+    }
+    catch {
+        return null;
+    }
 }
 /** Read a bounded trailing window, so an unrotated legacy err log is safe. */
 function readDaemonLogTail(filePath, maxLines) {
@@ -114,7 +222,7 @@ function readDaemonLogTail(filePath, maxLines) {
  * `completeTaskDurably`. Every flag declared on the command must appear here,
  * or it parses successfully and is then silently dropped.
  */
-function buildOverskyLogsArgs(flags) {
+function buildDaemonLogsArgs(flags) {
     return [
         // The runtime's own global option, placed before the subcommand.
         ...(flags.profile ? ['--profile', flags.profile] : []),
@@ -174,31 +282,46 @@ class DaemonLogs extends core_1.Command {
     ];
     async run() {
         const { flags } = await this.parse(DaemonLogs);
-        const args = buildOverskyLogsArgs(flags);
-        // Before ANY log content, on stderr so it never pollutes a pipe. `--path`
-        // is exempt: its whole contract is one path on stdout.
-        if (!flags.path) {
+        const args = buildDaemonLogsArgs(flags);
+        const showAge = (filePath) => {
+            // Before ANY log content, on stderr so it never pollutes a pipe. `--path`
+            // is exempt: its whole contract is one path on stdout.
+            if (flags.path || !filePath)
+                return;
             try {
-                const candidate = resolveLegacyDaemonLogPath(flags);
-                if ((0, node_fs_1.existsSync)(candidate)) {
-                    const { line } = describeLogAge((0, node_fs_1.statSync)(candidate).mtimeMs);
-                    this.logToStderr(line);
+                if ((0, node_fs_1.existsSync)(filePath)) {
+                    this.logToStderr(`${filePath}: ${describeLogAge((0, node_fs_1.statSync)(filePath).mtimeMs).line}`);
                 }
             }
             catch {
                 // Never let the banner stop the logs from being shown.
             }
-        }
+        };
         try {
             // `oversky 0.2.x` has profiles and writes the same files, but has no
             // `logs` subcommand. Probe top-level help first so forwarding does not
             // print an unrelated "unknown option" error before the useful output.
             if ((await (0, exec_runtime_binary_1.runtimeBinarySupportsSubcommand)('logs')) === false) {
-                const logPath = resolveLegacyDaemonLogPath(flags);
+                const chosen = chooseLegacyFallbackLog({
+                    profilePath: resolveLegacyDaemonLogPath(flags),
+                    serviceCandidates: installedServiceLogCandidates(resolveDaemonLogsProfile(flags), flags.stderr === true),
+                    mtimeOf: (filePath) => {
+                        try {
+                            return (0, node_fs_1.statSync)(filePath).mtimeMs;
+                        }
+                        catch {
+                            return null;
+                        }
+                    },
+                });
+                const logPath = chosen.path;
+                if (chosen.note)
+                    this.logToStderr(chosen.note);
                 if (flags.path) {
                     this.log(logPath);
                     return;
                 }
+                showAge(logPath);
                 if (!(0, node_fs_1.existsSync)(logPath)) {
                     this.error(`No daemon log at ${logPath}. The installed daemon predates \`oversky logs\`; start it or upgrade it, then retry.`, { exit: 1 });
                 }
@@ -234,6 +357,10 @@ class DaemonLogs extends core_1.Command {
                 }
                 return;
             }
+            // The banner must describe the file the runtime will actually print —
+            // the live daemon's log (OSK-15993) — not the profile default.
+            if (!flags.path)
+                showAge(await resolveForwardedLogPath(flags));
             const code = await (0, exec_runtime_binary_1.execRuntimeBinary)(args);
             this.exit(code);
         }