@skrr-ai/cli 0.1.109 → 0.1.111

package/dist/lib/compasses.d.ts

@@ -8,6 +8,10 @@ export interface CompassInvariantTarget {
     maintainedState?: string[];
     successMetrics?: string[];
     boundaries?: string[];
+    learnedTactics?: Array<{
+        id?: string;
+        description?: string;
+    }>;
     freshness?: Record<string, unknown>;
     cadence?: Record<string, unknown>;
     escalation?: Record<string, unknown>;

package/dist/lib/compasses.js

@@ -44,6 +44,12 @@ exports.compassApi = {
     appendTactic: (id, body) => data_provider_2.request.post(`${base(id)}/tactics`, body),
     commitments: (id, query) => data_provider_2.request.get((0, triggers_1.withQuery)(`${base(id)}/commitments`, query)),
 };
+const OVERFLOW_FIELD_LABEL = {
+    maintainedState: 'keeps-true entries',
+    successMetrics: 'success metrics',
+    boundaries: 'boundaries',
+    learnedTactics: 'learned tactics',
+};
 function shortDate(value) {
     if (!value)
         return '—';
@@ -120,6 +126,11 @@ function renderCompass(compass, log) {
             if (target.successMetrics?.length) {
                 log(`    measured by: ${target.successMetrics.join('; ')}`);
             }
+            // The agent's prompt carries a bounded number of each list. Say which
+            // were cut, so the list above is not read as what the agent sees.
+            for (const overflow of (0, data_provider_1.describeCompassOverflow)(target)) {
+                log(`    ! shown to the agent: ${overflow.rendered} of ${overflow.authored} ${OVERFLOW_FIELD_LABEL[overflow.field]} (${overflow.omitted} not shown)`);
+            }
         }
     }
     const tactics = compass.learnedTactics ?? [];

package/dist/lib/daemon-machine-identity-copy.d.ts

@@ -0,0 +1,14 @@
+import type { DaemonMachineIdentitySkew } from './daemon-machine-identity';
+/**
+ * What to tell someone whose installed background service would register their
+ * profile on the default profile's machine row (OSK-S-440).
+ *
+ * The consequence is stated before the remedy because the remedy costs something
+ * (updating a service) and the consequence is what justifies it: a second
+ * profile on the default's row replaces its Daemon and its device-key pin, and
+ * the default profile's next refresh is refused until it signs in again.
+ *
+ * Lives here, apart from the comparison, because this is copy and reads
+ * `BRAND.displayName`; the comparison is pure and imports nothing from it.
+ */
+export declare function describeDaemonMachineIdentitySkew(skew: DaemonMachineIdentitySkew): string[];

package/dist/lib/daemon-machine-identity-copy.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.describeDaemonMachineIdentitySkew = describeDaemonMachineIdentitySkew;
+const data_provider_1 = require("@skrr-ai/data-provider");
+/**
+ * What to tell someone whose installed background service would register their
+ * profile on the default profile's machine row (OSK-S-440).
+ *
+ * The consequence is stated before the remedy because the remedy costs something
+ * (updating a service) and the consequence is what justifies it: a second
+ * profile on the default's row replaces its Daemon and its device-key pin, and
+ * the default profile's next refresh is refused until it signs in again.
+ *
+ * Lives here, apart from the comparison, because this is copy and reads
+ * `BRAND.displayName`; the comparison is pure and imports nothing from it.
+ */
+function describeDaemonMachineIdentitySkew(skew) {
+    const product = data_provider_1.BRAND.displayName;
+    const said = skew.reported
+        ? `it reports machine identity ${skew.reported}, where profile '${skew.profile}' has ${skew.expected}`
+        : `it does not report a machine identity at all, so ${product} cannot tell which one it would use`;
+    return [
+        `The ${product} background service at ${skew.binary} does not support a separate machine identity per profile: ${said}.`,
+        `Using it for '${skew.profile}' would register that profile on the default profile's machine and could replace the default profile's device-key pin. Nothing was changed.`,
+        `Update the background service (skrr daemon update), or put a current skrrd first on your PATH, then run: skrr login --profile ${skew.profile}`,
+    ];
+}

package/dist/lib/daemon-machine-identity.d.ts

@@ -0,0 +1,27 @@
+export interface DaemonMachineIdentitySkew {
+    /** The profile being signed in. */
+    profile: string;
+    /** The machine identity this profile has, as decided by the profile's own record. */
+    expected: string;
+    /** What the daemon binary says it will send; null when it said nothing. */
+    reported: string | null;
+    /** The `skrrd` that was asked. */
+    binary: string;
+}
+/**
+ * Null when the daemon will register this profile under the identity it has;
+ * otherwise what disagrees.
+ *
+ * Not applicable to the default profile (its identity is the hardware value in
+ * every version), to a hosted runtime (the control plane issues it), or when no
+ * profile is named.
+ *
+ * A daemon that reports NOTHING is a skew, not a pass: this check exists because
+ * an older binary cannot say, and "could not confirm" must not read as "fine" on
+ * the step that binds a credential to a machine row.
+ */
+export declare function daemonMachineIdentitySkew(opts: {
+    profile: string | null | undefined;
+    binary: string;
+    reported: string | null | undefined;
+}): DaemonMachineIdentitySkew | null;

package/dist/lib/daemon-machine-identity.js

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.daemonMachineIdentitySkew = daemonMachineIdentitySkew;
+/**
+ * daemon-machine-identity.ts — does the installed daemon give this profile the
+ * machine identity the CLI decided it has?
+ *
+ * Two programs compute one identity: the CLI (and the profile's persisted
+ * `machine-identity.json`) say a profile that started new has its own machine
+ * row, and the DAEMON is what registers. A daemon that predates per-profile
+ * identities (OSK-13845) does not read that file; it sends the hardware value
+ * whatever the profile is. Nothing noticed. The CLI minted the daemon's credential
+ * for what the daemon REPORTED (`accept-handoff --print-id`), so the credential
+ * was bound to the default machine's row, the service registered there, and the
+ * failure OSK-13845 exists to prevent happened anyway: two profiles on one Daemon
+ * row and one device-key pin, the second profile's interactive login re-pinning
+ * the first one's key (OSK-S-440, profile `aapexp`).
+ *
+ * Measured, not inferred: the same new profile, in an empty home, answered by
+ * two `skrrd` binaries. The current one reports `<hardware>:p-<hash>` and writes
+ * `machine-identity.json` and `daemon-identity.json`; the build that was first on
+ * the dogfooder's PATH (a checkout `dist` from before OSK-13845, whose version
+ * string still reads the checkout's package.json) reports the bare hardware value
+ * and writes neither. The profile it left behind had a `machine-identity.json`
+ * (the CLI's) and no `daemon-identity.json` after four daemon starts.
+ *
+ * The fix is to compare, not to guess a version: ask the binary what it will
+ * send, compare with what this profile's decided identity is, and refuse BEFORE
+ * anything is minted or installed when they differ. Comparing the value is the
+ * only test that cannot be wrong about a build that is older than its own
+ * version string says.
+ *
+ * Pure: the I/O (spawning the binary) is in `daemonHandoff.ts`, the copy in
+ * `daemon-machine-identity-copy.ts`.
+ */
+const machine_uuid_1 = require("@skrr-ai/auth-core/machine-uuid");
+const keychain_1 = require("./keychain");
+/**
+ * Null when the daemon will register this profile under the identity it has;
+ * otherwise what disagrees.
+ *
+ * Not applicable to the default profile (its identity is the hardware value in
+ * every version), to a hosted runtime (the control plane issues it), or when no
+ * profile is named.
+ *
+ * A daemon that reports NOTHING is a skew, not a pass: this check exists because
+ * an older binary cannot say, and "could not confirm" must not read as "fine" on
+ * the step that binds a credential to a machine row.
+ */
+function daemonMachineIdentitySkew(opts) {
+    const profile = opts.profile?.trim();
+    if (!profile || profile === keychain_1.DEFAULT_PROFILE)
+        return null;
+    if ((0, machine_uuid_1.hostedRuntimeIdOverride)('OVERSKY_MACHINE_UUID'))
+        return null;
+    const expected = (0, machine_uuid_1.getMachineUuidForProfile)(profile);
+    const reported = opts.reported?.trim() || null;
+    if (reported === expected)
+        return null;
+    return { profile, expected, reported, binary: opts.binary };
+}

package/dist/lib/daemon-setup.js

@@ -98,13 +98,13 @@ async function offerDaemonSetup(opts = {}) {
     log('');
     log(`  This computer has no ${data_provider_1.BRAND.displayName} background service. It is what lets your agents work here —`);
     log('  running commands, editing files, and driving a browser on this machine.');
-    // What it does UNASKED is part of the decision, and it used to be found
-    // afterwards in a status table (OSK-16439). The defaults are the daemon's
-    // (`DEFAULT_CONFIG.permissions`, pinned against this sentence by
-    // `unattended-posture.spec.ts` in the daemon): reads, writes, shell commands
-    // and Claude sessions run without a prompt until someone changes them.
-    log('  Until you change it, agents can read files, edit files and run shell commands here');
-    log(`  without asking you first. To be asked before each call instead: \`${(0, daemon_command_hint_1.daemonCommandHint)('config', { extraArgs: '--require-approvals' })}\``);
+    // Disclose both the safe new-profile default and upgrade compatibility at
+    // the point where the person consents to a persistent local service.
+    log('  New local profiles require approval for file reads, edits and shell commands.');
+    log('  Cloud-started Claude Code sessions are refused until explicitly enabled.');
+    log('  Existing profiles keep their permission settings, which may allow tools without asking.');
+    log(`  Require approvals for this profile: \`${(0, daemon_command_hint_1.daemonCommandHint)('config', { extraArgs: '--require-approvals' })}\``);
+    log(`  Allow only a chosen category without asking: \`${(0, daemon_command_hint_1.daemonCommandHint)('config', { extraArgs: '--mode read=auto' })}\``);
     // This creates a persistent service with broad local capabilities, so a
     // bare Enter must visibly and behaviorally decline it. `confirm` names its
     // second argument `defaultNo`; passing false showed `[Y/n]` and accepted an

package/dist/lib/daemonHandoff.d.ts

@@ -1,3 +1,4 @@
+import { type DaemonMachineIdentitySkew } from './daemon-machine-identity';
 /**
  * Hand the local daemon a credential of its own, right after `skrr login`.
  *
@@ -40,8 +41,25 @@ export interface DaemonHandoffOutcome {
      * The two absent cases are separated because they need different work — one
      * needs a binary fetched, the other only needs the service registered.
      */
-    reason?: 'opted-out' | 'brokered' | 'no-binary' | 'legacy-binary' | 'unsupported-daemon' | 'no-service' | 'foreign-root' | 'mint-refused' | 'platform-managed';
+    reason?: 'opted-out' | 'brokered' | 'no-binary' | 'legacy-binary' | 'unsupported-daemon' | 'no-service' | 'foreign-root' | 'mint-refused' | 'platform-managed' | 'machine-identity-skew';
+    /** Set with `reason: 'machine-identity-skew'`; the caller words it. */
+    skew?: DaemonMachineIdentitySkew;
 }
 export declare function handOffToLocalDaemon(env?: NodeJS.ProcessEnv, opts?: {
     loginFlow?: string;
 }): Promise<DaemonHandoffOutcome>;
+/**
+ * Ask the installed daemon which machine identity it will register `profile`
+ * under, and say what disagrees with the profile's own (OSK-S-440).
+ *
+ * For the commands that install or sign in a daemon WITHOUT going through the
+ * credential hand-off (`skrr daemon install`, `skrr daemon login`): the same
+ * question, asked of the binary they are about to run. Null when the daemon
+ * agrees, when the profile is the default one, or when there is no binary to ask
+ * (the caller has its own answer for that).
+ *
+ * A binary that cannot be asked at all - too old to have `accept-handoff`, or
+ * one that fails the probe - is reported as a skew with no identity, because the
+ * point of asking is not to bind a profile to a machine row on a guess.
+ */
+export declare function checkLocalDaemonMachineIdentity(profile: string | null | undefined, binary?: string | null): Promise<DaemonMachineIdentitySkew | null>;

package/dist/lib/daemonHandoff.js

@@ -1,10 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.handOffToLocalDaemon = handOffToLocalDaemon;
+exports.checkLocalDaemonMachineIdentity = checkLocalDaemonMachineIdentity;
 const node_child_process_1 = require("node:child_process");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const config_1 = require("./config");
 const daemon_handoff_opt_out_1 = require("./daemon-handoff-opt-out");
+const daemon_machine_identity_1 = require("./daemon-machine-identity");
 const dedicated_service_1 = require("./dedicated-service");
 const exec_runtime_binary_1 = require("./exec-runtime-binary");
 const keychain_1 = require("./keychain");
@@ -146,8 +148,9 @@ function describeDelivery(opts) {
 /**
  * Compare deployments, not spellings.
  *
- * `https://oversky.ai` and `https://skrr.ai` are one deployment under two names,
- * and the first is still what every daemon installed before the cutover carries.
+ * The pre-cutover production host and `https://skrr.ai` are one deployment under
+ * two names, and the first is still what every daemon installed before the cutover
+ * carries.
  * Trimming and lowercasing alone would report a move on every login from every
  * one of those machines — a warning that is wrong for the largest group of users
  * who would see it, which is how a signal becomes noise. `canonicalizeKnownBaseURL`
@@ -275,6 +278,26 @@ async function handOffToLocalDaemon(env = process.env, opts = {}) {
         };
     }
     const { idSource, machineUuid, daemonServer } = parseIdProvenance(printed.stderr);
+    // Before anything is minted or installed: does THIS binary register the profile
+    // under the machine identity the profile has? The mint below binds the
+    // credential to the machine uuid the daemon just REPORTED, so a binary that
+    // reports the hardware value for a profile that has its own would put it on the
+    // default profile's row - and the install that follows would run that same
+    // binary as a service. Nothing about the id or the provenance would look wrong.
+    const skew = (0, daemon_machine_identity_1.daemonMachineIdentitySkew)({
+        profile: (0, keychain_1.getActiveProfile)(),
+        binary,
+        reported: machineUuid,
+    });
+    if (skew) {
+        return {
+            status: 'failed',
+            reason: 'machine-identity-skew',
+            skew,
+            detail: `the installed daemon reports machine identity ${skew.reported ?? '(none)'} ` +
+                `where profile '${skew.profile}' has ${skew.expected}`,
+        };
+    }
     // A well-formed id is not the same as a real daemon. With no service installed
     // the daemon derives one from whatever directory this process is in, so the id
     // above names a daemon that does not exist and will not exist under that id if
@@ -354,3 +377,40 @@ async function handOffToLocalDaemon(env = process.env, opts = {}) {
         }),
     };
 }
+/**
+ * Ask the installed daemon which machine identity it will register `profile`
+ * under, and say what disagrees with the profile's own (OSK-S-440).
+ *
+ * For the commands that install or sign in a daemon WITHOUT going through the
+ * credential hand-off (`skrr daemon install`, `skrr daemon login`): the same
+ * question, asked of the binary they are about to run. Null when the daemon
+ * agrees, when the profile is the default one, or when there is no binary to ask
+ * (the caller has its own answer for that).
+ *
+ * A binary that cannot be asked at all - too old to have `accept-handoff`, or
+ * one that fails the probe - is reported as a skew with no identity, because the
+ * point of asking is not to bind a profile to a machine row on a guess.
+ */
+async function checkLocalDaemonMachineIdentity(profile, binary = (0, exec_runtime_binary_1.findRuntimeBinary)()) {
+    if (!profile || profile === keychain_1.DEFAULT_PROFILE || !binary)
+        return null;
+    const printed = await runOversky(binary, ['accept-handoff', '--print-id', '--profile', profile], {
+        timeoutMs: PROBE_TIMEOUT_MS,
+    });
+    if (!printed.ok) {
+        // A daemon too old to have `accept-handoff` answers "unknown command": it is
+        // older than per-profile identities too, which is the skew itself.
+        if (/unknown command/i.test(printed.stderr)) {
+            return (0, daemon_machine_identity_1.daemonMachineIdentitySkew)({ profile, binary, reported: null });
+        }
+        // Any other failed probe says nothing about the daemon's identity, and
+        // refusing a sign-in on a flaky probe would be a worse failure than the one
+        // this guards: let the command run and meet whatever the daemon itself says.
+        return null;
+    }
+    return (0, daemon_machine_identity_1.daemonMachineIdentitySkew)({
+        profile,
+        binary,
+        reported: parseIdProvenance(printed.stderr).machineUuid,
+    });
+}

package/dist/lib/dedicated-ssh.d.ts

@@ -132,6 +132,8 @@ export interface SshProxyOptions {
     ttlSeconds?: number;
     getToken?: () => Promise<string>;
     recoveryMs?: number;
+    /** Process lifecycle; injectable so tests never signal the test runner. */
+    signalSource?: Pick<NodeJS.Process, 'on' | 'off'>;
     /** Injected for tests. */
     connect?: (url: string, opts: Parameters<typeof io>[1]) => Socket;
     /** Injected for tests. */

package/dist/lib/dedicated-ssh.js

@@ -301,8 +301,11 @@ function runSshProxy(options) {
         let closing = false;
         let lastKeepaliveAt = 0;
         let pendingInput = null;
-        const identityAuth = () => ({ ...(0, data_provider_1.getClientIdentityAuth)(), clientPlatform: 'cli',
-            clientOs: process.platform === 'darwin' ? 'macos' : process.platform });
+        const identityAuth = () => ({
+            ...(0, data_provider_1.getClientIdentityAuth)(),
+            clientPlatform: 'cli',
+            clientOs: process.platform === 'darwin' ? 'macos' : process.platform,
+        });
         const wsOrigin = (0, agentic_stream_1.toWebSocketOrigin)(options.baseURL);
         const handshakeAuth = (token, callback) => {
             // Resolve a fresh proof after token renewal on every reconnect. Never
@@ -315,20 +318,30 @@ function runSshProxy(options) {
         };
         const socket = connect(wsOrigin, {
             path: '/ws/agentic',
-            auth: options.getToken ? (callback) => {
-                void options.getToken().then((token) => handshakeAuth(token, callback), () => {
-                    finish(1, 'Could not renew SSH authentication. Restore skrr login and connect again.');
-                });
-            } : (0, dpop_auth_1.socketAuthWithDpop)({ token: options.token, ...identityAuth() }, wsOrigin),
-            transports: ['websocket'], reconnection: true,
-            reconnectionDelay: 1000, reconnectionDelayMax: 2000,
+            auth: options.getToken
+                ? (callback) => {
+                    void options.getToken().then((token) => handshakeAuth(token, callback), () => {
+                        finish(1, 'Could not renew SSH authentication. Restore skrr login and connect again.');
+                    });
+                }
+                : (0, dpop_auth_1.socketAuthWithDpop)({ token: options.token, ...identityAuth() }, wsOrigin),
+            transports: ['websocket'],
+            reconnection: true,
+            reconnectionDelay: 1000,
+            reconnectionDelayMax: 2000,
         });
         const startTimer = setTimeout(() => finish(1, 'The machine did not answer the SSH channel in time. Its daemon may be busy or offline.'), exports.SSH_START_TIMEOUT_MS);
         function sendPendingInput() {
             if (closing || !online || !attached || !pendingInput || finished)
                 return;
-            socket.emit('dedicated:ssh:data', { channelId, data: pendingInput.bytes.toString('base64'),
-                resumeV2: true, epoch, generation, offset: pendingInput.offset });
+            socket.emit('dedicated:ssh:data', {
+                channelId,
+                data: pendingInput.bytes.toString('base64'),
+                resumeV2: true,
+                epoch,
+                generation,
+                offset: pendingInput.offset,
+            });
         }
         function pumpInput() {
             if (closing || !started || !resumable || !online || !attached || pendingInput || finished)
@@ -351,11 +364,23 @@ function runSshProxy(options) {
         };
         function sendResume() {
             if (online && started && resumable && !attached && !finished) {
-                socket.emit('dedicated:ssh:resume', { leaseId: options.leaseId, channelId, resumeProof, epoch, generation, attachmentSeq });
+                socket.emit('dedicated:ssh:resume', {
+                    leaseId: options.leaseId,
+                    channelId,
+                    resumeProof,
+                    epoch,
+                    generation,
+                    attachmentSeq,
+                });
             }
         }
         function keepalive() {
-            if (started && resumable && attached && online && !finished && Date.now() - lastKeepaliveAt >= 10_000) {
+            if (started &&
+                resumable &&
+                attached &&
+                online &&
+                !finished &&
+                Date.now() - lastKeepaliveAt >= 10_000) {
                 lastKeepaliveAt = Date.now();
                 socket.emit('dedicated:ssh:keepalive', { channelId, epoch });
             }
@@ -376,6 +401,10 @@ function runSshProxy(options) {
             keepalive();
         }, 2000);
         ticker.unref?.();
+        const signals = options.signalSource ?? process;
+        const onTermination = () => finish(0);
+        signals.on('SIGHUP', onTermination);
+        signals.on('SIGTERM', onTermination);
         const onInputEnded = () => finish(0);
         const onOutputError = () => finish(1);
         input.once('end', onInputEnded);
@@ -397,10 +426,24 @@ function runSshProxy(options) {
             if (notice)
                 errorOutput.write(`${notice}\n`);
             // Never queue an offline stop that might arrive after another attachment.
-            if (started && online)
-                socket.emit('dedicated:ssh:stop', { channelId, ...(resumable ? { epoch } : {}) });
-            socket.disconnect();
-            resolve(code);
+            const disconnected = () => {
+                signals.off('SIGHUP', onTermination);
+                signals.off('SIGTERM', onTermination);
+                socket.disconnect();
+                resolve(code);
+            };
+            if (started && online) {
+                // OpenSSH may SIGHUP its ProxyCommand before stdio reaches EOF. Keep
+                // the transport alive until the API has forwarded stop. A bounded
+                // fallback also supports older servers without this receipt.
+                const closeTimer = setTimeout(disconnected, 1000);
+                socket.emit('dedicated:ssh:stop', { channelId, ...(resumable ? { epoch } : {}) }, () => {
+                    clearTimeout(closeTimer);
+                    disconnected();
+                });
+            }
+            else
+                disconnected();
         }
         socket.on('connect_error', (error) => {
             if (finished || (started && resumable))
@@ -420,9 +463,16 @@ function runSshProxy(options) {
                 return;
             }
             startSent = true;
-            socket.emit('dedicated:ssh:start', { leaseId: options.leaseId, channelId,
-                keyType: identity.keyType, keyBlob: identity.keyBlob, receiverAckV1: true,
-                resumeV2: true, resumeProof, epoch });
+            socket.emit('dedicated:ssh:start', {
+                leaseId: options.leaseId,
+                channelId,
+                keyType: identity.keyType,
+                keyBlob: identity.keyBlob,
+                receiverAckV1: true,
+                resumeV2: true,
+                resumeProof,
+                epoch,
+            });
         });
         socket.on('dedicated:ssh:start:ack', (ack) => {
             if (!ack || ack.channelId !== channelId || started || finished)
@@ -432,7 +482,9 @@ function runSshProxy(options) {
                 return;
             }
             if (ack.resumeV2 === true) {
-                if (ack.epoch !== epoch || !Number.isSafeInteger(ack.generation) || Number(ack.generation) < 1 ||
+                if (ack.epoch !== epoch ||
+                    !Number.isSafeInteger(ack.generation) ||
+                    Number(ack.generation) < 1 ||
                     (generation !== null && generation !== ack.generation)) {
                     finish(1, 'Invalid SSH stream admission.');
                     return;
@@ -458,7 +510,13 @@ function runSshProxy(options) {
             }
         });
         socket.on('dedicated:ssh:resume:ack', (ack) => {
-            if (!ack || ack.channelId !== channelId || ack.epoch !== epoch || !started || !resumable || finished || attached)
+            if (!ack ||
+                ack.channelId !== channelId ||
+                ack.epoch !== epoch ||
+                !started ||
+                !resumable ||
+                finished ||
+                attached)
                 return;
             if (!ack.ok) {
                 if (ack.retryable === true)
@@ -483,8 +541,14 @@ function runSshProxy(options) {
             pumpInput();
         });
         socket.on('dedicated:ssh:input:ack', (ack) => {
-            if (finished || !resumable || !pendingInput || !attached || ack?.channelId !== channelId ||
-                ack.epoch !== epoch || ack.generation !== generation || ack.offset !== pendingInput.offset)
+            if (finished ||
+                !resumable ||
+                !pendingInput ||
+                !attached ||
+                ack?.channelId !== channelId ||
+                ack.epoch !== epoch ||
+                ack.generation !== generation ||
+                ack.offset !== pendingInput.offset)
                 return;
             if (!ack.ok) {
                 finish(1, ack.error || 'The SSH input stream was refused.');
@@ -499,19 +563,25 @@ function runSshProxy(options) {
             pumpInput();
         });
         socket.on('dedicated:ssh:data', async (frame, receipt) => {
-            if (!frame || frame.channelId !== channelId || finished || typeof frame.data !== 'string' || !frame.data.length)
+            if (!frame ||
+                frame.channelId !== channelId ||
+                finished ||
+                typeof frame.data !== 'string' ||
+                !frame.data.length)
                 return;
             try {
                 const bytes = Buffer.from(frame.data, 'base64');
                 if (frame.resumeV2 === true) {
                     if (frame.epoch !== epoch)
                         return;
-                    if (!Number.isSafeInteger(frame.generation) || Number(frame.generation) < 1 ||
-                        (generation !== null && frame.generation !== generation) || bytes.toString('base64') !== frame.data) {
+                    if (!Number.isSafeInteger(frame.generation) ||
+                        Number(frame.generation) < 1 ||
+                        (generation !== null && frame.generation !== generation) ||
+                        bytes.toString('base64') !== frame.data) {
                         throw new Error('invalid SSH output frame');
                     }
                     generation ??= frame.generation;
-                    const nextOffset = await receiver.receive(frame.offset, bytes, (value) => new Promise((done, reject) => output.write(value, (error) => error ? reject(error) : done())));
+                    const nextOffset = await receiver.receive(frame.offset, bytes, (value) => new Promise((done, reject) => output.write(value, (error) => (error ? reject(error) : done()))));
                     receipt?.({ channelId, ok: !finished, epoch: frame.epoch, nextOffset });
                 }
                 else {

package/dist/lib/harnesses.d.ts

@@ -238,6 +238,77 @@ export declare function updateHarness(id: string, patch: Record<string, unknown>
     harness?: Harness;
 }>;
 export declare function forgetHarness(id: string): Promise<unknown>;
+/**
+ * Why a superseded-looking row is KEPT by `harnesses prune`. Declared by the
+ * server (`pruneSupersededHarnesses.js`, `REASONS`) and worded once, in
+ * `harnessPruneReasonSentence`, so the table and `--json` never disagree.
+ */
+export type HarnessPruneReason = 'recent' | 'latest_registration' | 'no_live_sibling' | 'pinned' | 'granted' | 'default' | 'aliased' | 'changed_since_plan';
+export interface HarnessPruneRow {
+    id: string;
+    daemonId: string | null;
+    provider: string | null;
+    name: string | null;
+    lastSeenAt: string | null;
+    machineUuid: string | null;
+    /** The live sibling that replaced a row this call removes (or would). */
+    supersededBy?: {
+        id: string;
+        daemonId: string | null;
+        lastSeenAt: string | null;
+    };
+    /** Set on kept rows. */
+    reason?: HarnessPruneReason;
+    /** For `pinned`: who holds the pin. Other people's agents are a count, never named. */
+    detail?: {
+        agents?: Array<{
+            id: string;
+            name: string | null;
+        }>;
+        moreAgents?: number;
+        otherAuthors?: number;
+    };
+}
+export interface HarnessPruneResult {
+    dryRun: boolean;
+    limit: number;
+    minUnseenMs: number;
+    scan: {
+        rows: number;
+        complete: boolean;
+    };
+    /** Rows this call removes (dry run: would remove). */
+    remove: HarnessPruneRow[];
+    /** Rows this call actually removed; 0 on a dry run. */
+    removedCount: number;
+    /** Removable rows beyond `limit`; the next call takes them. */
+    remaining: number;
+    kept: HarnessPruneRow[];
+    keptTruncated: boolean;
+    counts: Record<string, number>;
+}
+/**
+ * Remove the caller's superseded harness rows - or, by default, say which would go.
+ *
+ * ONE route for both: the server makes the decision once and this only asks for it
+ * to be shown (`dryRun: true`, also its own default) or carried out. The caller
+ * never lists rows and picks, so there is no client-side rule to drift from the
+ * server's. A write, so `apiFetch` gives it an idempotency key and a retried
+ * request replays the recorded answer instead of running again.
+ */
+export declare function pruneHarnesses(options?: {
+    dryRun: boolean;
+    limit?: number;
+    minUnseenMs?: number;
+}): Promise<HarnessPruneResult>;
+/**
+ * `--older-than` takes a whole number with a unit: `90m`, `36h`, `7d`. A bare
+ * number is hours. Returns milliseconds. The server never goes below its offline
+ * window whatever this says.
+ */
+export declare function parseHarnessPruneAge(value: string): number;
+/** One sentence per reason a row was kept. The only place they are worded. */
+export declare function harnessPruneReasonSentence(row: HarnessPruneRow): string;
 /**
  * A per-USER display name. Distinct from `updateHarness({name})`, which renames
  * the harness for everyone it is shared with — this only changes what YOU see,