@skrr-ai/cli 0.1.109 → 0.1.110

package/dist/base-command.d.ts

@@ -585,6 +585,21 @@ export declare function isTypedServerRefusal(body: Record<string, unknown> | nul
  */
 export declare function isApplicationCodedUnavailable(status: number | undefined, body: Record<string, unknown> | null): boolean;
 export declare function isRetryableFailure(status: number | undefined, body: Record<string, unknown> | null): boolean;
+/**
+ * The `details` of a CLI error envelope, in ONE shape. The server's refusal body becomes the
+ * envelope's details; when that body carries its own `details` object (a typed refusal's
+ * findings, e.g. `signalableNodeKeys`), those fields are lifted to the same level instead of
+ * arriving as `error.details.details`, a depth no other error used (OSK-16494). A body without
+ * a nested object is passed through unchanged.
+ */
+export declare function envelopeDetails(body: Record<string, unknown> | null | undefined): unknown;
+/**
+ * The hint for a `Nonexistent flags:` refusal, or null. Two cases:
+ *  - a flag retired from THIS command, which this command does not define again: where it went;
+ *  - a flag token holding a space (`"--outcome failed"` passed as one argument): what happened,
+ *    which oclif reports only as an unknown flag.
+ */
+export declare function retiredFlagHint(message: string, commandId?: string, definedFlags?: readonly string[]): string | null;
 /**
  * P6: a parse error used to say what was wrong and drop the remedy that text
  * mode (and every domain error) carries. Adds `fix` (one imperative line an

package/dist/base-command.js

@@ -17,6 +17,8 @@ exports.describeDaemonScopedCredential = describeDaemonScopedCredential;
 exports.isTypedServerRefusal = isTypedServerRefusal;
 exports.isApplicationCodedUnavailable = isApplicationCodedUnavailable;
 exports.isRetryableFailure = isRetryableFailure;
+exports.envelopeDetails = envelopeDetails;
+exports.retiredFlagHint = retiredFlagHint;
 exports.parseErrorRemedy = parseErrorRemedy;
 const node_fs_1 = require("node:fs");
 const core_1 = require("@oclif/core");
@@ -1191,7 +1193,7 @@ class BaseCommand extends core_1.Command {
         // so a caller following older instructions — including the managed block the
         // platform itself installed — got a bare `Nonexistent flags:` with no hint
         // that the capability moved rather than vanished. Name where each went.
-        const retiredHint = retiredFlagHint(err.message || '');
+        const retiredHint = retiredFlagHint(err.message || '', this.id, Object.keys(this.constructor.flags ?? {}));
         if (retiredHint) {
             err.message = `${err.message}\n\n${retiredHint}`;
         }
@@ -1336,7 +1338,7 @@ class BaseCommand extends core_1.Command {
                     status: e.status,
                     exit: 2,
                     retryable: false,
-                    details: body ?? undefined,
+                    details: envelopeDetails(body),
                 });
             }
             else if (bodyCode === 'AGENT_RUNTIME_UNAVAILABLE') {
@@ -1350,7 +1352,7 @@ class BaseCommand extends core_1.Command {
                     status: e.status,
                     exit: 1,
                     retryable: false,
-                    details: body ?? undefined,
+                    details: envelopeDetails(body),
                 });
             }
             else if (bodyCode === 'GITHUB_APP_NOT_CONFIGURED') {
@@ -1360,7 +1362,7 @@ class BaseCommand extends core_1.Command {
                     status: e.status,
                     exit: 2,
                     retryable: false,
-                    details: body ?? undefined,
+                    details: envelopeDetails(body),
                 });
             }
             else if (bodyCode === 'GITHUB_UNAVAILABLE') {
@@ -1376,7 +1378,7 @@ class BaseCommand extends core_1.Command {
                     status: e.status,
                     exit: 5,
                     retryable: true,
-                    details: body ?? undefined,
+                    details: envelopeDetails(body),
                 });
             }
             else if (bodyCode === 'LABEL_SUGGESTION_UNAVAILABLE') {
@@ -1390,7 +1392,7 @@ class BaseCommand extends core_1.Command {
                     status: e.status,
                     exit: 1,
                     retryable: false,
-                    details: body ?? undefined,
+                    details: envelopeDetails(body),
                 });
             }
             else if (bodyCode === 'ASSIGNEE_NOT_IN_SPACE') {
@@ -1403,7 +1405,7 @@ class BaseCommand extends core_1.Command {
                     status: e.status,
                     exit: 2,
                     retryable: false,
-                    details: body ?? undefined,
+                    details: envelopeDetails(body),
                 });
             }
             else if (e.status === 401) {
@@ -1552,6 +1554,10 @@ class BaseCommand extends core_1.Command {
                     status: e.status,
                     exit: 4,
                     retryable: false,
+                    // A typed 404 carries what the server found (a workflow signal names the nodes it CAN
+                    // resolve); dropping the body here made the 404 the one refusal with no machine-readable
+                    // details while every 409 kept them (OSK-16473).
+                    ...(body ? { details: envelopeDetails(body) } : {}),
                 });
             }
             else if (e.code === 'ECONNREFUSED' ||
@@ -1584,7 +1590,7 @@ class BaseCommand extends core_1.Command {
                     status: e.status,
                     exit: 1,
                     retryable: isRetryableFailure(e.status, body),
-                    details: body ?? undefined,
+                    details: envelopeDetails(body),
                     requestId: stringProp(body, 'requestId') || e.requestId,
                 });
             }
@@ -1623,7 +1629,7 @@ class BaseCommand extends core_1.Command {
                     status: e.status,
                     exit: retryable ? 5 : 1,
                     retryable,
-                    details: body ?? undefined,
+                    details: envelopeDetails(body),
                     ...(requestId ? { requestId } : {}),
                 });
             }
@@ -1661,7 +1667,7 @@ class BaseCommand extends core_1.Command {
                     status: e.status,
                     exit: 5,
                     retryable: true,
-                    details: body ?? undefined,
+                    details: envelopeDetails(body),
                 });
             }
             else if (typeof e.status === 'number' && e.status >= 500) {
@@ -1689,7 +1695,7 @@ class BaseCommand extends core_1.Command {
                     status: e.status,
                     exit: 1,
                     retryable: isRetryableFailure(e.status, body),
-                    details: body ?? undefined,
+                    details: envelopeDetails(body),
                 });
             }
             else {
@@ -1699,7 +1705,7 @@ class BaseCommand extends core_1.Command {
                     status: e.status,
                     exit: 1,
                     retryable: isRetryableFailure(e.status, body),
-                    details: body ?? undefined,
+                    details: envelopeDetails(body),
                 });
             }
         }
@@ -2454,13 +2460,54 @@ const RETIRED_FLAG_REPLACEMENTS = {
         '`tasks deliverable add`.',
     '--supersede': '--supersede is implicit: submitting again creates a new Result version.',
 };
-function retiredFlagHint(message) {
+/**
+ * The `details` of a CLI error envelope, in ONE shape. The server's refusal body becomes the
+ * envelope's details; when that body carries its own `details` object (a typed refusal's
+ * findings, e.g. `signalableNodeKeys`), those fields are lifted to the same level instead of
+ * arriving as `error.details.details`, a depth no other error used (OSK-16494). A body without
+ * a nested object is passed through unchanged.
+ */
+function envelopeDetails(body) {
+    if (!body)
+        return undefined;
+    const nested = body.details;
+    if (!nested || typeof nested !== 'object' || Array.isArray(nested))
+        return body;
+    const { details: _nested, ...rest } = body;
+    return { ...rest, ...nested };
+}
+/**
+ * The commands those flags were retired FROM. The table was applied to every command, so a
+ * mis-quoted `"--outcome failed"` on `triggers audit` (where --outcome is a live flag) was told
+ * "--outcome is now --summary" (OSK-16494). A rename is a fact about one command.
+ */
+const RETIRED_FLAG_COMMANDS = new Set(['tasks:complete', 'tasks:result:submit']);
+/**
+ * The hint for a `Nonexistent flags:` refusal, or null. Two cases:
+ *  - a flag retired from THIS command, which this command does not define again: where it went;
+ *  - a flag token holding a space (`"--outcome failed"` passed as one argument): what happened,
+ *    which oclif reports only as an unknown flag.
+ */
+function retiredFlagHint(message, commandId, definedFlags = []) {
     if (!/nonexistent flag/i.test(message))
         return null;
-    const hits = Object.keys(RETIRED_FLAG_REPLACEMENTS).filter((flag) => new RegExp(`${flag}(?![\\w-])`).test(message));
-    if (hits.length === 0)
-        return null;
-    return hits.map((flag) => `  ${RETIRED_FLAG_REPLACEMENTS[flag]}`).join('\n');
+    const lines = [];
+    const quoted = /(?:^|[\s,:])(--[a-z][\w-]*)[ =]([^\s,][^,\n]*)/i.exec(message.slice(message.search(/nonexistent flag/i)));
+    const quotedFlag = quoted?.[1];
+    if (quotedFlag && definedFlags.includes(quotedFlag.replace(/^--/, ''))) {
+        lines.push(`  "${quoted[0].trim()}" reached the command as ONE argument, so it was read as a flag named ` +
+            `"${quoted[0].trim()}". Pass the flag and its value separately: ${quotedFlag} ${quoted[2].trim()}`);
+    }
+    if (commandId && RETIRED_FLAG_COMMANDS.has(commandId)) {
+        for (const flag of Object.keys(RETIRED_FLAG_REPLACEMENTS)) {
+            if (definedFlags.includes(flag.replace(/^--/, '')))
+                continue;
+            if (new RegExp(`${flag}(?![\\w-])`).test(message)) {
+                lines.push(`  ${RETIRED_FLAG_REPLACEMENTS[flag]}`);
+            }
+        }
+    }
+    return lines.length ? lines.join('\n') : null;
 }
 /**
  * P6: a parse error used to say what was wrong and drop the remedy that text

package/dist/commands/agents/triggers/create.js

@@ -76,7 +76,7 @@ class AgentsTriggersCreate extends base_command_1.BaseCommand {
             description: 'ISO-8601 datetime after which a schedule stops firing (--kind schedule)',
         }),
         'stale-catchup-ms': core_1.Flags.integer({
-            description: 'How late a missed occurrence may still run, in ms (a positive number). After downtime, an occurrence more than this overdue is skipped rather than run late, and the schedule moves to its next future slot. Unset: 3600000 (1 hour).',
+            description: 'How late a missed occurrence may still run, in ms, from 1000 (1 second) to 31622400000 (366 days). After downtime, an occurrence more than this overdue is skipped rather than run late, and the schedule moves to its next future slot. Unset: 3600000 (1 hour).',
         }),
         // once
         at: core_1.Flags.string({

package/dist/commands/agents/triggers/update.js

@@ -63,7 +63,7 @@ class AgentsTriggersUpdate extends base_command_1.BaseCommand {
             description: 'ISO-8601 datetime after which a schedule stops firing',
         }),
         'stale-catchup-ms': core_1.Flags.integer({
-            description: 'How late a missed occurrence may still run, in ms (a positive number). After downtime, an occurrence more than this overdue is skipped rather than run late, and the schedule moves to its next future slot. Unset: 3600000 (1 hour).',
+            description: 'How late a missed occurrence may still run, in ms, from 1000 (1 second) to 31622400000 (366 days). After downtime, an occurrence more than this overdue is skipped rather than run late, and the schedule moves to its next future slot. Unset: 3600000 (1 hour).',
         }),
         at: core_1.Flags.string({ description: 'ISO-8601 datetime for once triggers' }),
         entity: core_1.Flags.string({

package/dist/commands/agents/update.d.ts

@@ -80,6 +80,17 @@ export default class AgentsUpdate extends BaseCommand {
  * Exported for tests.
  */
 export declare function agentUpdateWarnings(payload: Record<string, unknown>, updated: unknown): string[];
+/**
+ * The Agent row inside an update reply: the reply itself for an ordinary
+ * PATCH, `agent` inside the Always-On control envelope, or null when the
+ * control reply carries none (a PATCH of `isAlwaysOn` alone). Exported for tests.
+ */
+export declare function agentRowFromUpdate(updated: unknown): Record<string, unknown> | null;
+/**
+ * One line for an `isAlwaysOn` write, from the receipt: applied, or already in
+ * that state so nothing changed (OSK-16477). Exported for tests.
+ */
+export declare function alwaysOnReceiptLine(payload: Record<string, unknown>, updated: unknown): string | null;
 /**
  * Warnings from the server's `writeReceipt` (OSK-15070). The receipt names
  * every key the write saw as applied (and through which control: the legacy

package/dist/commands/agents/update.js

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AGENT_FENCE_RETRY_CODES = void 0;
 exports.agentUpdateWarnings = agentUpdateWarnings;
+exports.agentRowFromUpdate = agentRowFromUpdate;
+exports.alwaysOnReceiptLine = alwaysOnReceiptLine;
 exports.writeReceiptWarnings = writeReceiptWarnings;
 exports.retryOnceOnAgentFence = retryOnceOnAgentFence;
 exports.defaultPermissionModePatch = defaultPermissionModePatch;
@@ -212,8 +214,26 @@ class AgentsUpdate extends base_command_1.BaseCommand {
             this.log(JSON.stringify((0, web_url_1.withAgentUrl)(this.cliConfig.baseURL, updated), null, 2));
             return;
         }
-        const a = updated;
-        this.log(`Updated agent ${a.id ?? a._id ?? args.id} — ${a.name ?? '(no name)'}`);
+        // The Always-On control replies with its own envelope, which names no agent.
+        // Name it from the Agent's own row, not "(no name)" (OSK-16477).
+        const a = agentRowFromUpdate(updated) ?? { id: args.id };
+        if (typeof a.name !== 'string') {
+            try {
+                const row = (await data_provider_1.dataService.getAgentById({ agent_id: args.id }));
+                if (row &&
+                    typeof row === 'object' &&
+                    typeof row.name === 'string') {
+                    a.name = row.name;
+                }
+            }
+            catch {
+                // The update already happened; a failed name read only costs the label.
+            }
+        }
+        this.log(`Updated agent ${a.id ?? a._id ?? args.id} — ${typeof a.name === 'string' ? a.name || '(no name)' : '(name unavailable)'}`);
+        const alwaysOnLine = alwaysOnReceiptLine(payload, updated);
+        if (alwaysOnLine)
+            this.log(alwaysOnLine);
         this.log(`URL: ${(0, web_url_1.withAgentUrl)(this.cliConfig.baseURL, { ...a, id: a.id ?? a._id ?? args.id }).url ?? '-'}`);
         const modeNote = defaultPermissionModeNote(flags['default-permission-mode'], a);
         if (modeNote)
@@ -285,6 +305,42 @@ function agentUpdateWarnings(payload, updated) {
         ...(unapplied.length > 0 ? [(0, create_1.unappliedPayloadKeysWarning)(unapplied)] : []),
     ];
 }
+/**
+ * The Agent row inside an update reply: the reply itself for an ordinary
+ * PATCH, `agent` inside the Always-On control envelope, or null when the
+ * control reply carries none (a PATCH of `isAlwaysOn` alone). Exported for tests.
+ */
+function agentRowFromUpdate(updated) {
+    if (!updated || typeof updated !== 'object' || Array.isArray(updated))
+        return null;
+    const reply = updated;
+    const isControlReply = typeof reply.agentId === 'string' && reply.state !== null && typeof reply.state === 'object';
+    if (!isControlReply)
+        return { ...reply };
+    const agent = reply.agent;
+    return agent && typeof agent === 'object' && !Array.isArray(agent)
+        ? { ...agent, id: agent.id ?? reply.agentId }
+        : { id: reply.agentId };
+}
+/**
+ * One line for an `isAlwaysOn` write, from the receipt: applied, or already in
+ * that state so nothing changed (OSK-16477). Exported for tests.
+ */
+function alwaysOnReceiptLine(payload, updated) {
+    if (typeof payload.isAlwaysOn !== 'boolean')
+        return null;
+    const receipt = (0, data_provider_1.readAgentWriteReceipt)(updated);
+    if (!receipt)
+        return null;
+    const state = payload.isAlwaysOn ? 'on' : 'off';
+    if (receipt.unchanged.some((entry) => entry.field === 'isAlwaysOn')) {
+        return `Always-On: already ${state}; nothing changed.`;
+    }
+    if (receipt.applied.some((entry) => entry.field === 'isAlwaysOn')) {
+        return `Always-On: turned ${state}.`;
+    }
+    return null;
+}
 /**
  * Warnings from the server's `writeReceipt` (OSK-15070). The receipt names
  * every key the write saw as applied (and through which control: the legacy

package/dist/commands/daemon/install.js

@@ -5,6 +5,9 @@ const exec_runtime_binary_1 = require("../../lib/exec-runtime-binary");
 const daemon_binding_1 = require("../../lib/daemon-binding");
 const daemon_installer_1 = require("../../lib/daemon-installer");
 const daemon_setup_1 = require("../../lib/daemon-setup");
+const daemonHandoff_1 = require("../../lib/daemonHandoff");
+const daemon_machine_identity_copy_1 = require("../../lib/daemon-machine-identity-copy");
+const live_runtime_binary_1 = require("../../lib/live-runtime-binary");
 /**
  * `skrr daemon install` — install the local runtime's OS service.
  *
@@ -83,7 +86,20 @@ class DaemonInstall extends core_1.Command {
             // moment the binding is chosen, and leaving it to a separate command
             // is how a CLI and its daemon end up on different deployments
             // (OSK-279) without anyone doing anything wrong.
-            const code = await (0, exec_runtime_binary_1.execRuntimeBinary)(['install', ...(0, daemon_binding_1.bindToCliSession)(argv)]);
+            const installArgs = (0, daemon_binding_1.bindToCliSession)(argv);
+            // A service installed from a daemon that predates per-profile machine
+            // identities runs that daemon for good, and registers the profile on the
+            // default profile's machine row (OSK-S-440). Ask the binary about to run.
+            // `--help` and `--json` are not installs.
+            if (!installArgs.some((arg) => ['--help', '-h'].includes(arg))) {
+                const skew = await (0, daemonHandoff_1.checkLocalDaemonMachineIdentity)((0, live_runtime_binary_1.profileFromArgs)(installArgs));
+                if (skew) {
+                    for (const line of (0, daemon_machine_identity_copy_1.describeDaemonMachineIdentitySkew)(skew))
+                        this.logToStderr(line);
+                    this.exit(78);
+                }
+            }
+            const code = await (0, exec_runtime_binary_1.execRuntimeBinary)(['install', ...installArgs]);
             if (code === 0 &&
                 !argv.some((arg) => ['--json', '--help', '-h'].includes(arg))) {
                 this.log('Coding-agent instructions: sign in with `skrr login`, or review installation choices with `skrr instructions setup`.');

package/dist/commands/daemon/login.js

@@ -4,6 +4,8 @@ const core_1 = require("@oclif/core");
 const daemon_binding_1 = require("../../lib/daemon-binding");
 const exec_runtime_binary_1 = require("../../lib/exec-runtime-binary");
 const live_runtime_binary_1 = require("../../lib/live-runtime-binary");
+const daemonHandoff_1 = require("../../lib/daemonHandoff");
+const daemon_machine_identity_copy_1 = require("../../lib/daemon-machine-identity-copy");
 /**
  * `skrr daemon login` — authenticate the local runtime.
  *
@@ -53,6 +55,18 @@ class DaemonLogin extends core_1.Command {
             if (decision?.kind === 'forward-live') {
                 this.warn(`Signing in with the live daemon binary ${decision.binary}.`);
             }
+            // The binary about to sign this profile in must register it under the
+            // machine identity the profile has (OSK-S-440): a daemon that predates
+            // per-profile identities would bind this login to the default profile's
+            // machine row. `--help` is not a login.
+            if (!boundArgv.some((arg) => ['--help', '-h'].includes(arg))) {
+                const skew = await (0, daemonHandoff_1.checkLocalDaemonMachineIdentity)((0, live_runtime_binary_1.profileFromArgs)(boundArgv), decision?.binary ?? pathBinary);
+                if (skew) {
+                    for (const line of (0, daemon_machine_identity_copy_1.describeDaemonMachineIdentitySkew)(skew))
+                        this.logToStderr(line);
+                    this.exit(78);
+                }
+            }
             // `--cwd` is deliberately NOT defaulted here. `skrrd login` resolves it
             // from the installed service definition, which is the only authoritative
             // answer; guessing it from the CLI's cwd is exactly the mistake that made

package/dist/commands/harnesses/prune.d.ts

@@ -0,0 +1,26 @@
+import { BaseCommand } from '../../base-command';
+/**
+ * Remove harness rows that a later registration of the same machine replaced.
+ *
+ * `harnesses forget` removes ONE row, and an agent pinned to it loses its pin.
+ * One machine had accumulated 93 rows from 15 daemons, 85 of them replaced, and
+ * `machines list` could fold them but nothing could remove them. This does, and
+ * only the ones that can be proven safe: the server decides, once, and says why
+ * it kept everything it kept.
+ *
+ * DRY RUN BY DEFAULT. `--yes` is the only thing that removes anything.
+ */
+export default class HarnessesPrune extends BaseCommand {
+    static summary: string;
+    static description: string;
+    static examples: string[];
+    static flags: {
+        yes: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        limit: import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'older-than': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+    private render;
+    private removeTable;
+}

package/dist/commands/harnesses/prune.js

@@ -0,0 +1,172 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const format_1 = require("../../lib/format");
+const harnesses_1 = require("../../lib/harnesses");
+/**
+ * Remove harness rows that a later registration of the same machine replaced.
+ *
+ * `harnesses forget` removes ONE row, and an agent pinned to it loses its pin.
+ * One machine had accumulated 93 rows from 15 daemons, 85 of them replaced, and
+ * `machines list` could fold them but nothing could remove them. This does, and
+ * only the ones that can be proven safe: the server decides, once, and says why
+ * it kept everything it kept.
+ *
+ * DRY RUN BY DEFAULT. `--yes` is the only thing that removes anything.
+ */
+class HarnessesPrune extends base_command_1.BaseCommand {
+    static summary = 'Remove harness rows that a newer registration of the same machine replaced (dry run unless --yes)';
+    static description = 'A machine registers a fresh row per provider each time its daemon identity changes (a profile, a ' +
+        'working directory, a service versus a terminal), and the old rows stay. This removes the ones that ' +
+        'are provably stale and shows every one it keeps, with the reason.\n\n' +
+        'It is a DRY RUN until you pass --yes. A row is removed only if ALL of these hold: it is yours; it is ' +
+        'a daemon you run yourself (never a hosted, dedicated or cloud machine); it is not online and has not ' +
+        'been seen within --older-than; a later row of the same provider on the same machine replaced it AND ' +
+        "that replacement is online now; and nothing depends on it - no agent (yours or anyone's) is pinned " +
+        'to it, no workspace has it lent, it is not your default, and you did not give it a name.\n\n' +
+        'An agent pinned to a replaced row keeps running only because the platform adopts the live row ' +
+        'beside it, and that adoption starts from the old row; remove the row and the pin is gone. So a ' +
+        'pinned row is KEPT, with the agents named. Move the pin (`agents attach-harness`) and run this again.\n\n' +
+        'At most --limit rows are removed per run, oldest first; the rest are counted and the next run takes ' +
+        'them. Running it again when nothing qualifies removes nothing. A daemon that is still running ' +
+        're-registers on its next connection, so removing a row never stops a machine.';
+    static examples = [
+        '<%= config.bin %> harnesses prune',
+        '<%= config.bin %> harnesses prune --yes',
+        '<%= config.bin %> harnesses prune --yes --limit 20',
+        '<%= config.bin %> harnesses prune --older-than 7d --json',
+    ];
+    static flags = {
+        yes: core_1.Flags.boolean({
+            description: 'Remove the rows listed. Without it nothing is removed.',
+            default: false,
+        }),
+        limit: core_1.Flags.integer({
+            description: 'Remove at most this many rows in one run (1-200, default 50). The rest wait for the next run.',
+            min: 1,
+            max: 200,
+        }),
+        'older-than': core_1.Flags.string({
+            description: 'Only rows unseen for at least this long: 90m, 36h or 7d (default 24h). The server never goes below its offline window.',
+        }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(HarnessesPrune);
+        let minUnseenMs;
+        if (flags['older-than'] !== undefined) {
+            try {
+                minUnseenMs = (0, harnesses_1.parseHarnessPruneAge)(flags['older-than']);
+            }
+            catch (err) {
+                this.error(err.message, { exit: 2 });
+                return;
+            }
+        }
+        let result;
+        try {
+            result = await (0, harnesses_1.pruneHarnesses)({
+                dryRun: !flags.yes,
+                ...(flags.limit !== undefined ? { limit: flags.limit } : {}),
+                ...(minUnseenMs !== undefined ? { minUnseenMs } : {}),
+            });
+        }
+        catch (err) {
+            this.handleApiError(err);
+            return;
+        }
+        if (flags.json) {
+            this.printJsonResult(result);
+            return;
+        }
+        this.render(result);
+    }
+    render(result) {
+        const { dryRun } = result;
+        const removing = dryRun ? result.remove.length : result.removedCount;
+        const noun = (n) => `${n} superseded harness row${n === 1 ? '' : 's'}`;
+        if (dryRun) {
+            this.log('Dry run - nothing was removed.');
+        }
+        if (removing === 0) {
+            this.log(dryRun
+                ? 'Nothing to remove.'
+                : 'Nothing was removed - no row qualified (or each one changed while this ran).');
+        }
+        else if (dryRun) {
+            this.log('');
+            this.log(`Would remove ${noun(removing)} (oldest first)${result.remaining > 0 ? `; ${result.remaining} more qualify beyond --limit ${result.limit}` : ''}:`);
+            this.removeTable(result.remove);
+            this.log('');
+            this.log('Run again with --yes to remove them.');
+        }
+        else {
+            this.log(`Removed ${noun(removing)}:`);
+            this.removeTable(result.remove);
+            if (result.remaining > 0) {
+                this.log('');
+                this.log(`${result.remaining} more qualify beyond --limit ${result.limit}. Run it again to continue.`);
+            }
+        }
+        if (result.kept.length > 0) {
+            this.log('');
+            this.log(`Kept ${result.kept.length}${result.keptTruncated ? '+' : ''} offline row${result.kept.length === 1 ? '' : 's'}:`);
+            const rows = result.kept.map((row) => ({
+                id: (0, format_1.formatCell)(row.id),
+                provider: (0, format_1.formatCell)(row.provider),
+                daemon: (0, format_1.formatCell)(row.daemonId),
+                seen: (0, format_1.localStamp)(row.lastSeenAt),
+                why: (0, harnesses_1.harnessPruneReasonSentence)(row),
+            }));
+            (0, format_1.renderTable)(rows, [
+                { key: 'id', header: 'HARNESS ID' },
+                { key: 'provider', header: 'PROVIDER' },
+                { key: 'daemon', header: 'DAEMON ID', verbatim: true },
+                { key: 'seen', header: `LAST SEEN (${(0, format_1.localZone)()})` },
+                { key: 'why', header: 'KEPT BECAUSE' },
+            ], (line) => this.log(line));
+            if (result.keptTruncated) {
+                this.log('(The list is cut short; the totals below cover every row.)');
+            }
+            if (result.kept.some((row) => row.reason === 'pinned')) {
+                this.log('(A pinned row stays until its agents point elsewhere: `skrr agents attach-harness <harness> --agent <agent>`.)');
+            }
+        }
+        const passedOver = [];
+        const count = (key) => result.counts?.[key] ?? 0;
+        if (count('online') > 0)
+            passedOver.push(`${count('online')} online`);
+        if (count('not_personal_machine') > 0) {
+            passedOver.push(`${count('not_personal_machine')} hosted, dedicated, cloud or of unknown origin`);
+        }
+        if (count('no_machine_identity') > 0) {
+            passedOver.push(`${count('no_machine_identity')} that name no machine`);
+        }
+        if (passedOver.length > 0) {
+            this.log('');
+            this.log(`Not considered: ${passedOver.join('; ')}.`);
+        }
+        if (!result.scan.complete) {
+            this.log('');
+            this.log(`(This account has more than ${result.scan.rows} harness rows, so the plan cannot be proven complete and --yes will refuse. Use \`harnesses forget\` for individual rows.)`);
+        }
+    }
+    removeTable(rows) {
+        (0, format_1.renderTable)(rows.map((row) => ({
+            id: (0, format_1.formatCell)(row.id),
+            provider: (0, format_1.formatCell)(row.provider),
+            daemon: (0, format_1.formatCell)(row.daemonId),
+            seen: (0, format_1.localStamp)(row.lastSeenAt),
+            replacedBy: (0, format_1.formatCell)(row.supersededBy?.daemonId),
+        })), [
+            { key: 'id', header: 'HARNESS ID' },
+            { key: 'provider', header: 'PROVIDER' },
+            { key: 'daemon', header: 'DAEMON ID', verbatim: true },
+            { key: 'seen', header: `LAST SEEN (${(0, format_1.localZone)()})` },
+            { key: 'replacedBy', header: 'REPLACED BY (ONLINE)', verbatim: true },
+        ], (line) => this.log(line));
+    }
+}
+exports.default = HarnessesPrune;

package/dist/commands/login.js

@@ -12,6 +12,7 @@ const cli_id_1 = require("../lib/cli-id");
 const keychain_1 = require("../lib/keychain");
 const profile_machine_identity_guard_1 = require("../lib/profile-machine-identity-guard");
 const daemon_command_hint_1 = require("../lib/daemon-command-hint");
+const daemon_machine_identity_copy_1 = require("../lib/daemon-machine-identity-copy");
 const local_daemon_readiness_1 = require("../lib/local-daemon-readiness");
 const login_1 = require("../lib/login");
 const device_code_1 = require("../lib/device-code");
@@ -293,6 +294,16 @@ class Login extends base_command_1.BaseCommand {
                     // nothing to install and nothing to hand over (OSK-12296).
                     this.log("This machine's daemon is managed by the platform; there is nothing to set up here.");
                 }
+                else if (handoff.reason === 'machine-identity-skew' && handoff.skew) {
+                    // The installed daemon would register this profile on the default
+                    // profile's machine row (OSK-S-440). Nothing was minted or installed;
+                    // the CLI's own sign-in above stands. The generic "run `daemon login`"
+                    // line below would send the person to the same binary.
+                    this.log('');
+                    for (const line of (0, daemon_machine_identity_copy_1.describeDaemonMachineIdentitySkew)(handoff.skew))
+                        this.log(line);
+                    localDaemonNotReady = true;
+                }
                 else if (handoff.reason === 'foreign-root') {
                     // Not a failure and not a hint to re-login anything: the daemon is
                     // the default root's, and this is a second root (OSK-12189).

package/dist/commands/spaces/workflows/start.js

@@ -80,8 +80,10 @@ class SpacesWorkflowsStart extends base_command_1.BaseCommand {
             return;
         }
         const decorated = (0, space_output_1.withWorkflowUrl)(this.cliConfig.baseURL, args.spaceId, result, { workflowId: args.workflowId, runId: result.run.id });
+        // The id this command created, at the top where a script looks for it, instead of only
+        // inside `run` (OSK-16494). The nested run is unchanged.
         if (flags.json)
-            return this.log(JSON.stringify(decorated, null, 2));
+            return this.log(JSON.stringify({ runId: result.run.id, status: result.run.status, ...decorated }, null, 2));
         this.log(formatStartedRunLine(result));
         // The run someone just started is the one they most want to watch, so the
         // link comes before the command that prints the same thing as text.