@skrr-ai/cli 0.1.102 → 0.1.104

package/dist/base-command.js

@@ -261,6 +261,30 @@ class BaseCommand extends core_1.Command {
                 this.credentialProvenance = { kind: 'daemon-delegated' };
             }
             catch (err) {
+                // OSK-15990 — a refusal only a new daemon sign-in repairs (e.g.
+                // DEVICE_PROOF_PIN_MISMATCH) is NOT retryable: exit 75 told every
+                // caller to loop on it. Say so, and say what to run.
+                // Matched by name, not instanceof: specs mock `./lib/delegated-cli`
+                // down to one or two functions, and a missing class would throw here.
+                if (err?.name === 'DelegatedCliUnavailableError') {
+                    const e = err;
+                    const remedy = e.remedy && !e.message.includes(e.remedy) ? ` Fix: ${e.remedy}` : '';
+                    this.failWithCliError({
+                        message: `Daemon delegated skrr credential is unavailable: ${e.message}${remedy}`,
+                        code: 'DELEGATED_CLI_CREDENTIAL_UNAVAILABLE',
+                        // 75 (EX_TEMPFAIL) only when waiting can help; 77 (EX_NOPERM) when
+                        // the daemon must be signed in again first.
+                        exit: e.retryable ? 75 : 77,
+                        retryable: e.retryable,
+                        details: {
+                            ...(e.upstreamStatus !== undefined ? { upstreamStatus: e.upstreamStatus } : {}),
+                            ...(e.upstreamCode ? { upstreamCode: e.upstreamCode } : {}),
+                            ...(e.upstreamReason ? { upstreamReason: e.upstreamReason } : {}),
+                            ...(e.retryAt ? { retryAt: e.retryAt } : {}),
+                            ...(e.remedy ? { remedy: e.remedy } : {}),
+                        },
+                    });
+                }
                 this.failWithCliError({
                     message: `Daemon delegated skrr credential is unavailable: ${err.message}`,
                     code: 'DELEGATED_CLI_CREDENTIAL_UNAVAILABLE',

package/dist/commands/agent/message/send.js

@@ -535,9 +535,13 @@ function messageSegmentationAdvisory({ destination, text, followingParts, }) {
         return undefined;
     if (destination.kind !== 'app_owner_dm' && destination.kind !== 'slack_owner_dm')
         return undefined;
-    if (text.length <= exports.OWNER_DM_SEGMENTATION_SOFT_LIMIT)
+    // Measure what is READ. A widget block is not a thought to be split: its css, html and
+    // script are a program, and an advisory that counted them would invite an agent to cut
+    // one block across `--part`s, which the app could not read as a widget.
+    const prose = (0, data_provider_1.stripUiWidgetFencesForDisplay)(text, { final: true });
+    if (prose.length <= exports.OWNER_DM_SEGMENTATION_SOFT_LIMIT)
         return undefined;
-    return (`[skrr] Owner-DM message is ${text.length} characters. It may read better as 2–4 short thoughts: ` +
+    return (`[skrr] Owner-DM message is ${prose.length} characters. It may read better as 2–4 short thoughts: ` +
         'use --part with one explicit --idempotency-key. This is only an advisory; ' +
         'use --no-message-lint to suppress it.');
 }

package/dist/commands/agents/triggers/create.js

@@ -66,7 +66,9 @@ class AgentsTriggersCreate extends base_command_1.BaseCommand {
             multiple: true,
         }),
         timezone: core_1.Flags.string({ description: 'IANA timezone for schedule/once triggers' }),
-        'max-fires-per-day': core_1.Flags.integer({ description: 'Daily fire cap (schedule/stochastic)' }),
+        'max-fires-per-day': core_1.Flags.integer({
+            description: 'Daily fire cap (schedule, stochastic and self_scheduled triggers only)',
+        }),
         'max-runs': core_1.Flags.integer({
             description: 'Lifetime fire cap for a schedule — the trigger disables itself after N total runs',
         }),
@@ -172,6 +174,8 @@ class AgentsTriggersCreate extends base_command_1.BaseCommand {
         let payload;
         try {
             payload = await (0, prompt_1.readJsonBody)(flags['from-json']);
+            // A flag for another kind is refused, not dropped (OSK-15491).
+            (0, triggers_1.assertKindFlagsApply)(flags.kind ?? payload.kind, flags);
             // Agent scope is injected unconditionally — even when --from-json
             // supplies a scope, the agent identity from the positional arg wins so
             // the trigger can never be silently mis-scoped to a different agent.
@@ -213,22 +217,8 @@ class AgentsTriggersCreate extends base_command_1.BaseCommand {
                 filterField: flags['filter-field'],
                 filterValues,
             });
-            (0, triggers_1.setDefined)(event, {
-                entityType: flags.entity,
-                eventType: flags.event,
-                filterMode: flags['filter-mode'],
-                filterField: flags['filter-field'],
-                filterValue: filterValues && filterValues.length > 1 ? filterValues : filterValues?.[0],
-                debounceMs: flags['debounce-ms'],
-                maxPerHour: flags['max-per-hour'],
-            });
-            const stochastic = {};
-            (0, triggers_1.setDefined)(stochastic, {
-                probability: flags.probability === undefined ? undefined : Number(flags.probability),
-                jitterMs: flags['jitter-ms'],
-                maxFiresPerDay: flags['max-fires-per-day'],
-                evalIntervalMinutes: flags['eval-interval-minutes'],
-            });
+            Object.assign(event, (0, triggers_1.buildEventConfigFromFlags)(flags, filterValues));
+            const stochastic = (0, triggers_1.buildStochasticConfigFromFlags)(flags);
             const selfScheduled = (0, triggers_1.buildSelfScheduledConfigFromFlags)(flags);
             const form = (0, triggers_1.buildFormConfigFromFlags)(flags);
             const chatMessage = (0, triggers_1.buildChatMessageConfigFromFlags)(flags);

package/dist/commands/agents/triggers/update.js

@@ -55,7 +55,9 @@ class AgentsTriggersUpdate extends base_command_1.BaseCommand {
             multiple: true,
         }),
         timezone: core_1.Flags.string({ description: 'IANA timezone for schedule triggers' }),
-        'max-fires-per-day': core_1.Flags.integer({ description: 'Daily fire cap' }),
+        'max-fires-per-day': core_1.Flags.integer({
+            description: 'Daily fire cap (schedule, stochastic and self_scheduled triggers only)',
+        }),
         'max-runs': core_1.Flags.integer({ description: 'Lifetime fire cap for a schedule' }),
         'end-at': core_1.Flags.string({
             description: 'ISO-8601 datetime after which a schedule stops firing',
@@ -156,6 +158,29 @@ class AgentsTriggersUpdate extends base_command_1.BaseCommand {
             // Scope is immutable from this surface — an agent trigger stays bound to
             // its agent. Strip any scope in the JSON so the patch can't re-home it.
             delete payload.scope;
+        }
+        catch (err) {
+            this.error(err.message, { exit: 1 });
+        }
+        // The trigger's kind says which config block is its own, and only that block is sent. Every
+        // block used to go, so `--max-fires-per-day` wrote `stochastic` and `selfScheduled` onto a
+        // schedule trigger and a cap onto an on_demand one that nothing reads (OSK-15491). The scope
+        // check that used to follow the build now comes first because it is what reads the trigger.
+        let scoped;
+        try {
+            scoped = await (0, triggers_1.fetchAgentScopedTrigger)(args.agentId, args.triggerId);
+        }
+        catch (err) {
+            if (err instanceof triggers_1.AgentTriggerScopeError)
+                this.error(err.message, { exit: 4 });
+            this.handleApiError(err);
+        }
+        const scopedKind = scoped.kind;
+        if (typeof scopedKind !== 'string') {
+            this.error(`Trigger ${args.triggerId} did not report its kind, so its settings cannot be checked.`, { exit: 1 });
+        }
+        try {
+            (0, triggers_1.assertKindFlagsApply)(scopedKind, flags, { kindIsFixed: true });
             const execution = {};
             const builtinAction = (0, triggers_1.buildBuiltinActionPayload)({
                 builtinAction: flags['builtin-action'],
@@ -175,7 +200,10 @@ class AgentsTriggersUpdate extends base_command_1.BaseCommand {
             });
             const schedule = (0, triggers_1.buildScheduleConfigFromFlags)(flags);
             (0, triggers_1.assertScheduleTimingShape)(schedule);
-            const once = (0, triggers_1.buildOnceConfigFromFlags)(flags);
+            const once = (0, triggers_1.buildOnceConfigFromFlags)(flags, {
+                kind: scopedKind,
+                allowNextRunAtAlias: true,
+            });
             const filterValues = (0, triggers_1.splitRepeated)(flags['filter-value']);
             // Advisory: a catalog this CLI has not caught up with must not make a
             // server-supported event unreachable. Warn and send; the server validates.
@@ -190,22 +218,8 @@ class AgentsTriggersUpdate extends base_command_1.BaseCommand {
                 filterValues,
             });
             const event = {};
-            (0, triggers_1.setDefined)(event, {
-                entityType: flags.entity,
-                eventType: flags.event,
-                filterMode: flags['filter-mode'],
-                filterField: flags['filter-field'],
-                filterValue: filterValues && filterValues.length > 1 ? filterValues : filterValues?.[0],
-                debounceMs: flags['debounce-ms'],
-                maxPerHour: flags['max-per-hour'],
-            });
-            const stochastic = {};
-            (0, triggers_1.setDefined)(stochastic, {
-                probability: flags.probability === undefined ? undefined : Number(flags.probability),
-                jitterMs: flags['jitter-ms'],
-                maxFiresPerDay: flags['max-fires-per-day'],
-                evalIntervalMinutes: flags['eval-interval-minutes'],
-            });
+            Object.assign(event, (0, triggers_1.buildEventConfigFromFlags)(flags, filterValues));
+            const stochastic = (0, triggers_1.buildStochasticConfigFromFlags)(flags);
             const selfScheduled = (0, triggers_1.buildSelfScheduledConfigFromFlags)(flags);
             const form = (0, triggers_1.buildFormConfigFromFlags)(flags);
             const chatMessage = (0, triggers_1.buildChatMessageConfigFromFlags)(flags);
@@ -217,15 +231,15 @@ class AgentsTriggersUpdate extends base_command_1.BaseCommand {
                 idempotencyWindow: flags['idempotency-window'],
             });
             (0, triggers_1.mergeObjectField)(payload, 'execution', execution);
-            (0, triggers_1.mergeObjectField)(payload, 'schedule', schedule);
-            (0, triggers_1.mergeObjectField)(payload, 'once', once);
-            (0, triggers_1.mergeObjectField)(payload, 'event', event);
-            // `kind` is immutable on update (rejected above), so there is no kind to
-            // gate on here; stochastic is only non-empty when stochastic flags were passed.
-            (0, triggers_1.mergeObjectField)(payload, 'stochastic', stochastic);
-            (0, triggers_1.mergeObjectField)(payload, 'selfScheduled', selfScheduled);
-            (0, triggers_1.mergeObjectField)(payload, 'form', form);
-            (0, triggers_1.mergeObjectField)(payload, 'chatMessage', chatMessage);
+            (0, triggers_1.mergeTriggerKindConfig)(payload, scopedKind, {
+                schedule,
+                once,
+                event,
+                stochastic,
+                selfScheduled,
+                form,
+                chatMessage,
+            });
         }
         catch (err) {
             this.error(err.message, { exit: 1 });
@@ -235,7 +249,6 @@ class AgentsTriggersUpdate extends base_command_1.BaseCommand {
         }
         let trigger;
         try {
-            await (0, triggers_1.fetchAgentScopedTrigger)(args.agentId, args.triggerId);
             trigger = await triggers_1.triggerApi.update(args.triggerId, payload);
         }
         catch (err) {

package/dist/commands/commitments/create.js

@@ -164,6 +164,8 @@ class CommitmentsCreate extends base_command_1.BaseCommand {
         '<%= config.bin %> commitments create --agent <agent-id> --title "AWS cost watch" --outcome "Cost regressions are investigated" --agent-directive-file ./aws-cost-policy.md',
         '<%= config.bin %> commitments create --from-json commitment.json --json',
         `# Replace <agent-id> with your Agent ID; this creates a draft, not a running loop.
+# In "policy", 0 is a ZERO budget (nothing may run or be spent), not "no limit".
+# To remove a limit set it to null (e.g. "maxCostUsdPerDay": null) or leave the key out.
 cat > commitment.json <<'JSON'
 {
   "agentId": "<agent-id>",

package/dist/commands/commitments/preflight.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.preflightGateLines = preflightGateLines;
 const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const commitments_1 = require("../../lib/commitments");
 const prompt_1 = require("../../lib/prompt");
@@ -23,6 +24,22 @@ const prompt_1 = require("../../lib/prompt");
  * dash as a short code puts two different kinds of thing in one slot.
  */
 function preflightGateLines(gate, verbose = false) {
+    // "Could it contact you now?" is not a Run gate. It answers whether a message
+    // would reach the owner, and a limit the owner set themselves (zero nudges a day,
+    // quiet hours) is a chosen quiet, not a defect. It carried the same BLOCK tag, a
+    // bare code and no setting as the real blockers beside it ("paused", "Always-On
+    // off"), while the report's own `admission` field said it blocks nothing
+    // (OSK-15420). Say what it is in words, and which setting moves it.
+    if (gate.id === 'attention' && gate.verdict === 'block') {
+        const copy = (0, data_provider_1.describeSuppression)(gate.reason);
+        const lines = [
+            `  ${'info'.padEnd(5)} ${gate.label} — ${copy.title.toLowerCase()}${verbose && gate.reason ? ` (${gate.reason})` : ''}`,
+            `        ${copy.detail}`,
+        ];
+        if (copy.settingKey)
+            lines.push(`        Setting: ${copy.settingKey}`);
+        return lines;
+    }
     const mark = gate.verdict === 'pass' ? 'ok' : gate.verdict === 'block' ? 'BLOCK' : 'warn';
     // A BLOCKING gate always states its reason. `ok` gates got a helpful `note`
     // and `warn` gates got a reason token, and the BLOCK gates — the only ones
@@ -176,7 +193,7 @@ class CommitmentsPreflight extends base_command_1.BaseCommand {
                 (endpoint.reason ? ` (${endpoint.reason})` : '') +
                 (!endpoint.available && endpoint.detail ? ` — ${endpoint.detail}` : ''));
         }
-        this.log(`\nAttention: ${report.attention?.allowed ? 'delivery allowed now' : `suppressed by ${report.attention?.suppressedBy || 'policy'}`}`);
+        this.log(`\nAttention: ${report.attention?.allowed ? 'delivery allowed now' : `held back — ${(0, data_provider_1.describeSuppression)(report.attention?.suppressedBy).title.toLowerCase()}${report.attention?.suppressedBy ? ` (${report.attention.suppressedBy})` : ''}`}`);
         if (report.verdict === 'blocked')
             process.exitCode = 1;
     }

package/dist/commands/commitments/roster.d.ts

@@ -0,0 +1,15 @@
+import { BaseCommand } from '../../base-command';
+/**
+ * Every Commitment one agent holds — system roles included — with whether its
+ * loop is actually installed and working: what it watches, when it next wakes,
+ * whether the last check was stopped, and what it ran today.
+ */
+export default class CommitmentsRoster extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        agent: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/commitments/roster.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const commitments_1 = require("../../lib/commitments");
+const commitment_loop_status_1 = require("../../lib/commitment-loop-status");
+/**
+ * Every Commitment one agent holds — system roles included — with whether its
+ * loop is actually installed and working: what it watches, when it next wakes,
+ * whether the last check was stopped, and what it ran today.
+ */
+class CommitmentsRoster extends base_command_1.BaseCommand {
+    static description = "List an agent's commitments with each one's loop state (healthy, blocked, paused, unarmed, degraded, inactive, unknown)";
+    static examples = [
+        '<%= config.bin %> commitments roster --agent agent_abc123',
+        '<%= config.bin %> commitments roster --agent agent_abc123 --json',
+    ];
+    static flags = {
+        agent: core_1.Flags.string({ description: 'Agent ID', required: true }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(CommitmentsRoster);
+        try {
+            const roster = await commitments_1.commitmentApi.roster(flags.agent);
+            if (flags.json) {
+                this.log(JSON.stringify(roster, null, 2));
+                return;
+            }
+            for (const line of (0, commitment_loop_status_1.formatCommitmentRoster)(roster))
+                this.log(line);
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+    }
+}
+exports.default = CommitmentsRoster;

package/dist/commands/commitments/show.js

@@ -49,7 +49,7 @@ class CommitmentsShow extends base_command_1.BaseCommand {
             this.log(`Commitment ${args.id} not found.`);
             return;
         }
-        (0, commitments_1.renderCommitmentSummary)(response.commitment, (line) => this.log(line), response.latestCheck);
+        (0, commitments_1.renderCommitmentSummary)((0, commitments_1.withLiveAssessment)(response.commitment, response.operatingState), (line) => this.log(line), response.latestCheck);
         // Whose permissions a run uses (OSK-11975) — read from the operating state,
         // which carries the same projection preflight reports (OSK-12065).
         const autonomy = response.operatingState?.execution;

package/dist/commands/commitments/status.d.ts

@@ -0,0 +1,17 @@
+import { BaseCommand } from '../../base-command';
+/**
+ * Is this commitment's loop installed and working? Names the loop state and
+ * why, the next wakes, each watched source's access, the last stop and its
+ * fix, and today's runs and spend.
+ */
+export default class CommitmentsStatus extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        commitmentId: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/commitments/status.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const commitments_1 = require("../../lib/commitments");
+const commitment_loop_status_1 = require("../../lib/commitment-loop-status");
+/**
+ * Is this commitment's loop installed and working? Names the loop state and
+ * why, the next wakes, each watched source's access, the last stop and its
+ * fix, and today's runs and spend.
+ */
+class CommitmentsStatus extends base_command_1.BaseCommand {
+    static description = "Show whether a commitment's loop is installed and working: state, next wakes, source access, last stop, cost";
+    static examples = [
+        '<%= config.bin %> commitments status obj_abc123',
+        '<%= config.bin %> commitments status obj_abc123 --json',
+    ];
+    static args = {
+        commitmentId: core_1.Args.string({ ignoreStdin: true, description: 'Commitment ID', required: true }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(CommitmentsStatus);
+        try {
+            const status = await commitments_1.commitmentApi.loopStatus(args.commitmentId);
+            if (flags.json) {
+                this.log(JSON.stringify(status, null, 2));
+                return;
+            }
+            for (const line of (0, commitment_loop_status_1.formatCommitmentLoopStatus)(status))
+                this.log(line);
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+    }
+}
+exports.default = CommitmentsStatus;

package/dist/commands/commitments/update.js

@@ -320,6 +320,18 @@ JSON
                     cadence.mode = flags['cadence-mode'];
                 if (flags.timezone)
                     cadence.timezone = flags.timezone;
+                // A daily cadence runs at set times and has no interval, so `--cadence 6h`
+                // on one was stored as an `intervalMs` nothing reads: the command succeeded,
+                // the version moved, and the cadence still read "daily 08:00". Refuse it and
+                // say what would do what was meant (OSK-15418).
+                if (flags.cadence && cadence.mode === 'daily') {
+                    const at = Array.isArray(cadence.times) && cadence.times.length
+                        ? ` at ${cadence.times.join(', ')}`
+                        : '';
+                    this.error(`This commitment's cadence is daily${at}, which has no interval, so --cadence ${flags.cadence} would change nothing. ` +
+                        `To check every ${flags.cadence} instead, add --cadence-mode interval. ` +
+                        'To change the daily times, use --from-json with cadence.times.', { exit: 1 });
+                }
                 // A mode change must not carry the previous mode's fields into the
                 // replacement. Keep explicitly authored fields so invalid combinations
                 // are refused rather than silently discarding what the user requested.

package/dist/commands/daemon/logs.d.ts

@@ -1,4 +1,5 @@
 import { Command } from '@oclif/core';
+import { execRuntimeBinaryCapture } from '../../lib/exec-runtime-binary';
 /**
  * `skrr daemon logs` — forwards to `oversky logs`, which resolves the
  * per-profile log directory (the daemon owns that mapping, and it varies by
@@ -55,6 +56,110 @@ export declare function resolveLegacyDaemonLogPath(flags: Pick<DaemonLogsFlags,
     home?: string;
     env?: NodeJS.ProcessEnv;
 }): string;
+/** The profile `logs` addresses: --profile, then the profile environment variable, then the pin. */
+export declare function resolveDaemonLogsProfile(flags: Pick<DaemonLogsFlags, 'profile'>, options?: {
+    home?: string;
+    env?: NodeJS.ProcessEnv;
+}): string;
+/** Output destinations the installed launchd definition for a profile declares. */
+export interface InstalledServiceLogDestinations {
+    /** The `--log-file` in ProgramArguments, when present. */
+    logFile: string | null;
+    stdoutPath: string | null;
+    stderrPath: string | null;
+}
+/**
+ * Read the installed launchd definition's log destinations (OSK-15993). The
+ * desktop supervisor starts the daemon with
+ * `--log-file ~/Library/Logs/Skrr/daemon.app.log` and redirects stderr to
+ * `daemon.stderr.log`, so the profile's `logs/` directory can hold a file
+ * nobody has written for a week. Read-only: the plist is parsed, never loaded.
+ */
+export declare function installedServiceLogDestinations(profile: string, options?: {
+    home?: string;
+    platform?: NodeJS.Platform;
+}): InstalledServiceLogDestinations | null;
+/** The installed service's log files for the main log, or for `--stderr`. */
+export declare function installedServiceLogCandidates(profile: string, stderr: boolean, options?: {
+    home?: string;
+    platform?: NodeJS.Platform;
+}): string[];
+/**
+ * Pick the file the legacy fallback reads. An old daemon cannot say which file
+ * it writes, so the most recently written of the profile log and the installed
+ * service's logs is the best evidence of the live one — and whenever that is
+ * not the profile log, the choice is said out loud rather than made silently.
+ */
+export declare function chooseLegacyFallbackLog(args: {
+    profilePath: string;
+    serviceCandidates: readonly string[];
+    mtimeOf: (filePath: string) => number | null;
+    /** Why the runtime's own answer is not used; ends the note. */
+    reason?: string;
+}): {
+    path: string;
+    note: string | null;
+};
+/**
+ * Ask the installed runtime which file `logs` will read — the same live-aware
+ * answer it uses itself — so the age banner describes the file actually shown.
+ * Null when the runtime cannot answer in time; the banner is then skipped
+ * rather than printed about a file that may not be the one shown.
+ */
+export declare function resolveForwardedLogPath(flags: Pick<DaemonLogsFlags, 'stderr' | 'profile'>, capture?: typeof execRuntimeBinaryCapture): Promise<string | null>;
+/**
+ * The first runtime whose own `logs` reads the LIVE daemon's `--log-file`
+ * (OSK-15993, `daemon/src/daemon-log-target.ts`). 0.8.112 through 0.8.118 have
+ * a `logs` subcommand, so the subcommand probe says "supported", but it reads
+ * the profile's `logs/daemon.log` unconditionally — with a desktop-managed
+ * daemon, a file nobody has written for a week. Forwarding to one of those is
+ * forwarding to the bug, so the CLI forwards only at or above this version.
+ */
+export declare const LIVE_LOG_RESOLUTION_RUNTIME_VERSION = "0.8.119";
+/** `x.y.z` from a version string, or null. A prerelease suffix is ignored. */
+export declare function parseRuntimeVersion(text: string): [number, number, number] | null;
+/** Whether `version` is at least `floor`; null when either is not a version. */
+export declare function runtimeVersionAtLeast(version: string, floor: string): boolean | null;
+/** The installed runtime's `--version`, or null when it cannot say in time. */
+export declare function probeRuntimeVersion(capture?: typeof execRuntimeBinaryCapture): Promise<string | null>;
+/**
+ * The live daemon's log as the runtime's `status --json` reports it
+ * (`service.logs`). Status has named the live `--log-file` since before `logs`
+ * did, so on 0.8.117 status is right while logs is wrong. Null when status
+ * cannot answer, or answers with anything but an absolute path.
+ */
+export declare function probeStatusLogPath(flags: Pick<DaemonLogsFlags, 'profile'>, capture?: typeof execRuntimeBinaryCapture): Promise<string | null>;
+/** What `skrr daemon logs` does: forward to the runtime, or read a file itself. */
+export type DaemonLogsPlan = {
+    kind: 'forward';
+}
+/** `note` goes to stderr before any log content; never printed for `--path`. */
+ | {
+    kind: 'read';
+    path: string;
+    note: string | null;
+    missingHint: string;
+};
+export interface DaemonLogsPlanDeps {
+    supportsLogs(): Promise<boolean | null>;
+    runtimeVersion(): Promise<string | null>;
+    statusLogPath(): Promise<string | null>;
+    /** The profile log for this invocation (`daemon.err.log` under `--stderr`). */
+    profilePath: string;
+    service: InstalledServiceLogDestinations | null;
+    mtimeOf(filePath: string): number | null;
+}
+/**
+ * Decide which runtime, if any, `skrr daemon logs` may trust (OSK-15993).
+ *
+ * - No `logs` subcommand: the legacy fallback, as before.
+ * - A runtime at or above {@link LIVE_LOG_RESOLUTION_RUNTIME_VERSION}: forward.
+ * - An older runtime, or one whose version cannot be read: ask its `status`
+ *   which file the live daemon writes and read that file here. When status
+ *   cannot answer, an older runtime gets the legacy fallback (the newest of the
+ *   profile log and the installed service's logs); an unknown one is forwarded.
+ */
+export declare function planDaemonLogs(flags: Pick<DaemonLogsFlags, 'stderr'>, deps: DaemonLogsPlanDeps): Promise<DaemonLogsPlan>;
 /** Read a bounded trailing window, so an unrotated legacy err log is safe. */
 export declare function readDaemonLogTail(filePath: string, maxLines: number): string[];
 /**
@@ -65,7 +170,7 @@ export declare function readDaemonLogTail(filePath: string, maxLines: number): s
  * `completeTaskDurably`. Every flag declared on the command must appear here,
  * or it parses successfully and is then silently dropped.
  */
-export declare function buildOverskyLogsArgs(flags: DaemonLogsFlags): string[];
+export declare function buildDaemonLogsArgs(flags: DaemonLogsFlags): string[];
 export default class DaemonLogs extends Command {
     static aliases: string[];
     static description: string;