@skrr-ai/cli 0.1.12 → 0.1.14

package/dist/lib/commitments.js

@@ -3,12 +3,14 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.COMMITMENT_CLI_EVALUATORS = exports.COMMITMENT_CREATE_KEYS = exports.COMMITMENT_REMEDIATION_ACTIONS = exports.COMMITMENT_FEEDBACK_KINDS = exports.commitmentApi = exports.commitmentPackApi = exports.MAX_COMMITMENT_INTERVAL_MS = exports.MIN_COMMITMENT_INTERVAL_MS = exports.COMMITMENT_AUTONOMY_MODES = exports.COMMITMENT_STATUSES = exports.COMMITMENT_CADENCE_MAX_TIMES = exports.COMMITMENT_CADENCE_TIME_PATTERN = exports.COMMITMENT_CADENCE_MODES = exports.COMMITMENT_TEMPLATE_IDS = exports.COMMITMENT_WATCHED_SOURCES = void 0;
 exports.normalizeCreateBody = normalizeCreateBody;
 exports.parseIntervalToMs = parseIntervalToMs;
+exports.buildWatchedSources = buildWatchedSources;
 exports.describeEvidenceHealth = describeEvidenceHealth;
 exports.describeIntervalMs = describeIntervalMs;
 exports.buildSuccessCriteria = buildSuccessCriteria;
 exports.cadenceLabel = cadenceLabel;
 exports.renderCommitmentList = renderCommitmentList;
 exports.effectiveAutonomyMode = effectiveAutonomyMode;
+exports.extractStandstillFromCheck = extractStandstillFromCheck;
 exports.describeAutonomyLine = describeAutonomyLine;
 exports.renderCommitmentSummary = renderCommitmentSummary;
 exports.describeWakeDecision = describeWakeDecision;
@@ -316,6 +318,66 @@ function parseIntervalToMs(input) {
     }
     return ms;
 }
+function buildWatchedSources(inputs) {
+    const watched = (inputs.watch ?? []).filter(Boolean);
+    const metricKeys = (inputs.metricKey ?? []).filter(Boolean);
+    const spaceIds = (inputs.spaceIds ?? []).filter(Boolean);
+    const monitorIds = (inputs.monitorIds ?? []).filter(Boolean);
+    const effective = new Set(watched);
+    if (spaceIds.length)
+        effective.add('space');
+    if (monitorIds.length)
+        effective.add('monitor');
+    if (effective.has('space') && spaceIds.length === 0) {
+        throw new Error('--watch space needs at least one --watch-space <space-id-or-ref>. ' +
+            'The `space` source requires a scope id, which the enum on its own cannot carry.');
+    }
+    if (effective.has('monitor') && monitorIds.length === 0) {
+        throw new Error('--watch monitor needs at least one --watch-monitor <monitor-id>. ' +
+            'The `monitor` source requires a scope id, which the enum on its own cannot carry.');
+    }
+    if (metricKeys.length && !effective.has('metrics')) {
+        throw new Error('--metric-key requires --watch metrics.');
+    }
+    if (effective.size === 0)
+        return undefined;
+    // Preserve caller order: --watch entries first (deduped), then any source
+    // that was only implied by a companion flag.
+    const orderedSources = [];
+    const seen = new Set();
+    for (const s of watched) {
+        if (!seen.has(s)) {
+            orderedSources.push(s);
+            seen.add(s);
+        }
+    }
+    for (const implied of ['space', 'monitor']) {
+        if (effective.has(implied) && !seen.has(implied)) {
+            orderedSources.push(implied);
+            seen.add(implied);
+        }
+    }
+    const rows = [];
+    for (const source of orderedSources) {
+        if (source === 'space') {
+            for (const spaceId of spaceIds) {
+                rows.push({ source, enabled: true, config: { spaceId } });
+            }
+        }
+        else if (source === 'monitor') {
+            for (const monitorId of monitorIds) {
+                rows.push({ source, enabled: true, config: { monitorId } });
+            }
+        }
+        else if (source === 'metrics' && metricKeys.length) {
+            rows.push({ source, enabled: true, config: { metricKeys } });
+        }
+        else {
+            rows.push({ source, enabled: true });
+        }
+    }
+    return rows;
+}
 /**
  * One line an author can act on, or nothing.
  *
@@ -480,6 +542,41 @@ function effectiveAutonomyMode(check) {
     }
     return undefined;
 }
+/**
+ * A `commitment_standstill` policyTrace entry, extracted from the latest
+ * check's decision. The arbiter appends it whenever a quiet posture is the
+ * ANSWER to "why nothing is happening" (`CommitmentControl/index.js` around
+ * the `record_only`/empty-action-plan branch). Every field except `reason` is
+ * optional, and old checks lack the entry entirely — so a missing entry means
+ * "the loop had nothing standstill-worthy to say", not "we don't know".
+ *
+ * Exported for tests.
+ */
+function extractStandstillFromCheck(check) {
+    const trace = check?.decision?.policyTrace;
+    if (!Array.isArray(trace))
+        return null;
+    for (const entry of trace) {
+        if (!entry || typeof entry !== 'object')
+            continue;
+        const e = entry;
+        if (e.rule !== 'commitment_standstill')
+            continue;
+        const reason = typeof e.reason === 'string' ? e.reason : '';
+        if (!reason)
+            continue;
+        return {
+            reason,
+            layer: typeof e.layer === 'string' ? e.layer : undefined,
+            owner: typeof e.owner === 'string' ? e.owner : undefined,
+            fix: typeof e.fix === 'string' ? e.fix : undefined,
+            alsoConstrained: Array.isArray(e.alsoConstrained)
+                ? e.alsoConstrained
+                : undefined,
+        };
+    }
+    return null;
+}
 /**
  * The `Autonomy:` line — the stated mode, annotated when the latest check
  * actually ran at a STRICTER one (OSK-4881). Without the caveat, a commitment
@@ -538,6 +635,32 @@ latestCheck) {
     if (typeof commitment.state?.consecutiveUnresolvedChecks === 'number') {
         log(`Unresolved checks in a row:${` ${commitment.state.consecutiveUnresolvedChecks}`}`);
     }
+    // The load-bearing signal on a commitment that "reports active but never
+    // acts": the arbiter names WHY every recent check decided to do nothing, but
+    // that entry sat only in `policyTrace` on each check and was never rendered.
+    // Read at check time, unrolled here so a person reading the header sees the
+    // same conclusion the check already reached — and the `fix` string that was
+    // already written for them.
+    const standstill = extractStandstillFromCheck(latestCheck);
+    if (standstill) {
+        const streak = commitment.state?.consecutiveUnresolvedChecks;
+        const streakClause = typeof streak === 'number' && streak >= 2 ? `${streak} checks in a row: ` : '';
+        log(`Standstill:${` ${streakClause}${standstill.reason}`}`);
+        if (standstill.fix)
+            log(`           Fix: ${standstill.fix}`);
+        if (standstill.alsoConstrained?.length) {
+            const also = standstill.alsoConstrained
+                .map((entry) => {
+                if (!entry || typeof entry !== 'object')
+                    return null;
+                const reason = entry.reason;
+                return typeof reason === 'string' ? reason : null;
+            })
+                .filter((r) => Boolean(r));
+            if (also.length)
+                log(`           Also constrained: ${also.join(', ')}`);
+        }
+    }
     const sources = (commitment.watchedSources || [])
         .filter((s) => s.enabled !== false)
         .map((s) => s.source);

package/dist/lib/daemon-binding.d.ts

@@ -21,9 +21,8 @@
 /** Whether `argv` already carries `--name` or `--name=value` (or `-alias`). */
 export declare function hasFlag(argv: readonly string[], name: string, alias?: string): boolean;
 /**
- * Append `--server` / `--profile` describing the CLI's own session, for any
- * the caller did not pass. An explicit flag always wins — this only fills a
- * silence, so `skrr daemon install --env prod` still installs against prod
- * while the CLI sits on dev.
+ * Fill `--server` / `--profile` from the CLI's own session when the caller did
+ * not pass them. The runtime's profile is global, so normalize it before the
+ * subcommand even when the caller supplied it after one.
  */
 export declare function bindToCliSession(argv: readonly string[]): string[];

package/dist/lib/daemon-binding.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.hasFlag = hasFlag;
 exports.bindToCliSession = bindToCliSession;
 const config_1 = require("./config");
+const exec_runtime_binary_1 = require("./exec-runtime-binary");
 const keychain_1 = require("./keychain");
 /**
  * Defaults for the flags that decide WHICH deployment and WHICH profile a
@@ -35,10 +36,9 @@ function hasFlag(argv, name, alias) {
     });
 }
 /**
- * Append `--server` / `--profile` describing the CLI's own session, for any
- * the caller did not pass. An explicit flag always wins — this only fills a
- * silence, so `skrr daemon install --env prod` still installs against prod
- * while the CLI sits on dev.
+ * Fill `--server` / `--profile` from the CLI's own session when the caller did
+ * not pass them. The runtime's profile is global, so normalize it before the
+ * subcommand even when the caller supplied it after one.
  */
 function bindToCliSession(argv) {
     const extra = [];
@@ -51,13 +51,14 @@ function bindToCliSession(argv) {
             extra.push('--server', baseURL);
     }
     if (!hasFlag(argv, '--profile')) {
-        // The CLI's own profile, resolved the same way `BaseCommand` resolves it.
-        // These commands extend `Command`, so `init()` never ran and the module
-        // state `getActiveProfile()` reads was never set — asking it here would
-        // report `default` no matter what the user typed.
-        const profile = (0, keychain_1.resolveProfileFromArgv)(argv) ?? process.env.OVERSKY_PROFILE ?? null;
+        // Direct daemon wrappers extend Command, so their caller-supplied argv is
+        // authoritative. Login's automatic setup has no forwarded argv because it
+        // is already inside a BaseCommand; fall back to that process's resolved
+        // active profile so it cannot silently install the default service after
+        // `skrr login --profile <name>`.
+        const profile = (0, keychain_1.resolveProfileFromArgv)(argv) ?? process.env.OVERSKY_PROFILE ?? (0, keychain_1.getActiveProfile)() ?? null;
         if (profile && profile !== keychain_1.DEFAULT_PROFILE)
             extra.push('--profile', profile);
     }
-    return [...argv, ...extra];
+    return (0, exec_runtime_binary_1.normalizeRuntimeGlobalArgs)([...argv, ...extra]);
 }

package/dist/lib/daemon-handoff-opt-out.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Resolve the explicit operator switch that disables CLI-to-runtime handoff.
+ *
+ * `SKRR_*` is the current spelling, while the older `OVERSKY_*` name remains
+ * compatible. Returning the actual matched spelling keeps status output honest
+ * and makes the canonical alias win when an environment happens to carry both.
+ */
+export declare function daemonHandoffOptOut(env: NodeJS.ProcessEnv): string | null;

package/dist/lib/daemon-handoff-opt-out.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.daemonHandoffOptOut = daemonHandoffOptOut;
+/**
+ * Resolve the explicit operator switch that disables CLI-to-runtime handoff.
+ *
+ * `SKRR_*` is the current spelling, while the older `OVERSKY_*` name remains
+ * compatible. Returning the actual matched spelling keeps status output honest
+ * and makes the canonical alias win when an environment happens to carry both.
+ */
+function daemonHandoffOptOut(env) {
+    if (env.SKRR_SKIP_DAEMON_HANDOFF === '1')
+        return 'SKRR_SKIP_DAEMON_HANDOFF';
+    if (env.OVERSKY_SKIP_DAEMON_HANDOFF === '1')
+        return 'OVERSKY_SKIP_DAEMON_HANDOFF';
+    return null;
+}

package/dist/lib/daemon-installer.d.ts

@@ -31,7 +31,7 @@ export interface DaemonInstallOptions {
 }
 export declare function daemonFeedBase(env?: NodeJS.ProcessEnv): string;
 /**
- * Where the fetched binary lands. `exec-oversky.ts` already looks here, so a
+ * Where the fetched binary lands. `exec-runtime-binary.ts` already looks here, so a
  * daemon installed by this path is found by every `skrr daemon *` command
  * without the user touching PATH.
  */

package/dist/lib/daemon-installer.js

@@ -15,7 +15,7 @@ exports.installDaemon = installDaemon;
  *
  * ## Why this exists
  *
- * `skrr daemon install` forwarded to `skrrd install`, and `findOverskyBinary()`
+ * `skrr daemon install` forwarded to `skrrd install`, and `findRuntimeBinary()`
  * refused with "install it with brew" when there was no `skrrd` to forward to.
  * So the one command whose job is to set the machine up required the machine to
  * already be set up, and onboarding's first step was a second install from a
@@ -77,7 +77,7 @@ function daemonFeedBase(env = process.env) {
     return (env[exports.DAEMON_FEED_BASE_ENV]?.trim() || exports.DEFAULT_DAEMON_FEED_BASE).replace(/\/+$/, '');
 }
 /**
- * Where the fetched binary lands. `exec-oversky.ts` already looks here, so a
+ * Where the fetched binary lands. `exec-runtime-binary.ts` already looks here, so a
  * daemon installed by this path is found by every `skrr daemon *` command
  * without the user touching PATH.
  */

package/dist/lib/daemon-setup.js

@@ -33,7 +33,8 @@ exports.offerDaemonSetup = offerDaemonSetup;
  */
 const prompt_1 = require("./prompt");
 const daemon_binding_1 = require("./daemon-binding");
-const exec_oversky_1 = require("./exec-oversky");
+const daemon_handoff_opt_out_1 = require("./daemon-handoff-opt-out");
+const exec_runtime_binary_1 = require("./exec-runtime-binary");
 const daemon_installer_1 = require("./daemon-installer");
 const ssh_detect_1 = require("./ssh-detect");
 /**
@@ -46,8 +47,9 @@ async function offerDaemonSetup(opts = {}) {
     // The same switch that turns the credential handoff off. An operator who has
     // said "do not touch my daemon" has not asked a narrower question, and a
     // second variable for the same intent is a second thing to remember.
-    if (env.OVERSKY_SKIP_DAEMON_HANDOFF === '1' || env.SKRR_SKIP_DAEMON_HANDOFF === '1') {
-        return { status: 'skipped', detail: 'skipped by OVERSKY_SKIP_DAEMON_HANDOFF' };
+    const optOut = (0, daemon_handoff_opt_out_1.daemonHandoffOptOut)(env);
+    if (optOut) {
+        return { status: 'skipped', detail: `skipped by ${optOut}` };
     }
     const interactive = opts.interactive ?? !(0, ssh_detect_1.isNonInteractive)();
     if (!interactive) {
@@ -62,7 +64,11 @@ async function offerDaemonSetup(opts = {}) {
     log('');
     log('  This machine has no skrr runtime. It is what lets your agents work here —');
     log('  running commands, editing files, and driving a browser on this machine.');
-    const yes = await confirmImpl('  Set it up now?', false);
+    // This creates a persistent service with broad local capabilities, so a
+    // bare Enter must visibly and behaviorally decline it. `confirm` names its
+    // second argument `defaultNo`; passing false showed `[Y/n]` and accepted an
+    // accidental Enter, the opposite of this onboarding promise.
+    const yes = await confirmImpl('  Set it up now?', true);
     if (!yes) {
         return {
             status: 'declined',
@@ -72,7 +78,7 @@ async function offerDaemonSetup(opts = {}) {
     // Fetch the signed binary only when there is none. When the binary is already
     // present and only the service is missing, this step is skipped entirely —
     // downloading over a working runtime is not what "set it up" asked for.
-    const binaryPresent = opts.binaryPresent ?? Boolean((0, exec_oversky_1.findOverskyBinary)());
+    const binaryPresent = opts.binaryPresent ?? (0, exec_runtime_binary_1.isCurrentRuntimeBinary)((0, exec_runtime_binary_1.findRuntimeBinary)());
     if (!binaryPresent) {
         log('  Fetching the signed release...');
         const fetched = await (0, daemon_installer_1.installDaemon)({ env });
@@ -85,13 +91,13 @@ async function offerDaemonSetup(opts = {}) {
     // that just authenticated — which is the whole reason this runs here and not
     // at install time.
     try {
-        const code = await (0, exec_oversky_1.execOversky)(['install', ...(0, daemon_binding_1.bindToCliSession)([])]);
+        const code = await (0, exec_runtime_binary_1.execRuntimeBinary)(['install', ...(0, daemon_binding_1.bindToCliSession)([])]);
         if (code !== 0) {
             return { status: 'failed', detail: `\`skrrd install\` exited ${code}` };
         }
     }
     catch (err) {
-        if (err.message === 'oversky-not-installed') {
+        if (err.message === 'runtime-binary-not-installed') {
             return {
                 status: 'failed',
                 detail: 'the runtime vanished between fetching and installing it',

package/dist/lib/daemonHandoff.d.ts

@@ -40,7 +40,7 @@ export interface DaemonHandoffOutcome {
      * The two absent cases are separated because they need different work — one
      * needs a binary fetched, the other only needs the service registered.
      */
-    reason?: 'opted-out' | 'brokered' | 'no-binary' | 'unsupported-daemon' | 'no-service';
+    reason?: 'opted-out' | 'brokered' | 'no-binary' | 'legacy-binary' | 'unsupported-daemon' | 'no-service';
 }
 export declare function handOffToLocalDaemon(env?: NodeJS.ProcessEnv, opts?: {
     loginFlow?: string;

package/dist/lib/daemonHandoff.js

@@ -4,7 +4,8 @@ exports.handOffToLocalDaemon = handOffToLocalDaemon;
 const node_child_process_1 = require("node:child_process");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const config_1 = require("./config");
-const exec_oversky_1 = require("./exec-oversky");
+const daemon_handoff_opt_out_1 = require("./daemon-handoff-opt-out");
+const exec_runtime_binary_1 = require("./exec-runtime-binary");
 const keychain_1 = require("./keychain");
 /**
  * Ceilings, not expectations. Both calls finish in milliseconds when anything is
@@ -29,13 +30,13 @@ function runOversky(binary, args, opts) {
     const { input, timeoutMs } = opts;
     return new Promise((resolve) => {
         // A Windows npm-global install ships a `.cmd` shim, which `spawn` cannot
-        // execute without a shell — Node fires ENOENT instead. `execOversky` has
+        // execute without a shell — Node fires ENOENT instead. `execRuntimeBinary` has
         // handled this since it was written; this function did not, so the handoff
         // failed on EVERY Windows login and reported it as the daemon refusing the
         // bundle. Restricted to the shim case so real binaries keep the argv-array
         // exec path, which needs no quoting rules to be right.
         const isWinShim = process.platform === 'win32' && /\.(cmd|bat)$/i.test(binary);
-        const child = (0, node_child_process_1.spawn)(binary, args, {
+        const child = (0, node_child_process_1.spawn)(binary, (0, exec_runtime_binary_1.normalizeRuntimeGlobalArgs)(args), {
             // stderr is CAPTURED, not discarded. Discarding it cost a debugging cycle
             // on the first real run: the daemon exited non-zero with
             // `OVERSKY_KEK_REQUIRED`, and all the user saw was "the daemon refused the
@@ -172,11 +173,12 @@ async function handOffToLocalDaemon(env = process.env, opts = {}) {
     // Mirrors `OVERSKY_SKIP_DAEMON_BROKER` on the other direction. An operator
     // deliberately running a daemon against a different deployment than their CLI is
     // doing a legitimate thing, and this must not overrule it.
-    if (env.OVERSKY_SKIP_DAEMON_HANDOFF === '1' || env.SKRR_SKIP_DAEMON_HANDOFF === '1') {
+    const optOut = (0, daemon_handoff_opt_out_1.daemonHandoffOptOut)(env);
+    if (optOut) {
         return {
             status: 'skipped',
             reason: 'opted-out',
-            detail: 'skipped by OVERSKY_SKIP_DAEMON_HANDOFF',
+            detail: `skipped by ${optOut}`,
         };
     }
     // The daemon brokered this login, which means it just used its OWN credential
@@ -194,15 +196,26 @@ async function handOffToLocalDaemon(env = process.env, opts = {}) {
             detail: 'the local daemon brokered this login, so it already has a working credential',
         };
     }
-    const binary = (0, exec_oversky_1.findOverskyBinary)();
+    const binary = (0, exec_runtime_binary_1.findRuntimeBinary)();
     if (!binary) {
         return { status: 'skipped', reason: 'no-binary', detail: 'no local daemon installed' };
     }
+    // A legacy binary may remain on PATH after the product rename, but it cannot
+    // receive a skrr CLI handoff or reliably install the new profile-scoped
+    // service. Tell login to bootstrap a current signed runtime instead of
+    // probing the old binary and treating it as a usable local daemon.
+    if (!(0, exec_runtime_binary_1.isCurrentRuntimeBinary)(binary)) {
+        return {
+            status: 'skipped',
+            reason: 'legacy-binary',
+            detail: 'a legacy oversky runtime is installed; bootstrap a current skrr runtime',
+        };
+    }
     // An older daemon has no `accept-handoff`, and spawning it would fail with
     // commander's "unknown command" rather than anything a reader could act on. A
     // CLI that outruns the daemon on the machine is the normal case during a
     // staged rollout, not an error.
-    const supported = await (0, exec_oversky_1.overskySupportsSubcommand)('accept-handoff');
+    const supported = await (0, exec_runtime_binary_1.runtimeBinarySupportsSubcommand)('accept-handoff');
     if (supported === false) {
         return {
             status: 'skipped',

package/dist/lib/delegated-cli.d.ts

@@ -1,12 +1,3 @@
-/**
- * Daemon-owned delegated CLI credentials for autonomous Agent sessions.
- *
- * A spawned Agent never reads the human Keychain or a refresh token. Instead
- * it holds a random loopback capability and asks its parent daemon for a
- * short-lived normal `scope=cli` access token. The daemon rotates the refresh
- * family, so each Sky invocation retains the full command surface for the
- * duration of a long-running Agent session.
- */
 import { type ResolvedCredential } from '@skrr-ai/auth-core';
 export declare function isDelegatedCliSession(env?: Record<string, string | undefined>): boolean;
 /** Drop the memoized credential. Exported for tests. */

package/dist/lib/delegated-cli.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isDelegatedCliSession = isDelegatedCliSession;
 exports.resetDelegatedCliCredentialCache = resetDelegatedCliCredentialCache;
@@ -12,6 +45,9 @@ exports.fetchDelegatedCliCredential = fetchDelegatedCliCredential;
  * family, so each Sky invocation retains the full command surface for the
  * duration of a long-running Agent session.
  */
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
 const auth_core_1 = require("@skrr-ai/auth-core");
 function isDelegatedCliSession(env = process.env) {
     return Boolean(env.OVERSKY_AUTONOMOUS_SESSION === '1' &&
@@ -40,6 +76,94 @@ let _cached = null;
 function resetDelegatedCliCredentialCache() {
     _cached = null;
 }
+/**
+ * Walk `err.cause` / `err.errors[]` looking for a `code: 'ECONNREFUSED'`.
+ * Node's `fetch` throws a `TypeError('fetch failed')` whose `cause` is either
+ * a plain `Error` with `code` set, or an `AggregateError` whose `errors[]`
+ * carry it (dual-stack retries). Neither shape is visible at the top level.
+ */
+function isConnectionRefusedError(err) {
+    const seen = new Set();
+    const stack = [err];
+    while (stack.length) {
+        const cur = stack.pop();
+        if (!cur || typeof cur !== 'object' || seen.has(cur))
+            continue;
+        seen.add(cur);
+        const anyCur = cur;
+        if (anyCur.code === 'ECONNREFUSED')
+            return true;
+        if (anyCur.cause !== undefined)
+            stack.push(anyCur.cause);
+        if (Array.isArray(anyCur.errors))
+            for (const e of anyCur.errors)
+                stack.push(e);
+    }
+    return false;
+}
+/**
+ * Best-effort probe of the daemon's bootstrap file — the CLI's
+ * `daemonBroker.ts` writes it and can auto-broker off the fresh port.
+ * Returned only for the actionable-error diagnostic; failures are silent
+ * because this is a display hint, not a decision.
+ *
+ * Kept inline rather than importing from `daemonBroker.ts` so this module
+ * stays small and free of the auth-storage / keychain dependency chain
+ * that a lazily-executed broker call would drag in on every `skrr` startup.
+ */
+function readLiveDaemonPort() {
+    const candidates = [];
+    if (process.platform === 'darwin') {
+        candidates.push(path.join(os.homedir(), 'Library', 'Application Support', 'skrr', 'daemon-island.default.json'));
+    }
+    else {
+        candidates.push(path.join(os.homedir(), '.skrr', 'profiles', 'default', 'daemon-island.json'), path.join(os.homedir(), '.skrr', 'daemon-island.json'));
+    }
+    for (const p of candidates) {
+        try {
+            if (!fs.existsSync(p))
+                continue;
+            const parsed = JSON.parse(fs.readFileSync(p, 'utf8'));
+            if (typeof parsed.port !== 'number' || !Number.isInteger(parsed.port))
+                continue;
+            if (typeof parsed.pid === 'number' && parsed.pid > 0) {
+                try {
+                    process.kill(parsed.pid, 0);
+                }
+                catch (killErr) {
+                    if (killErr.code === 'ESRCH')
+                        continue;
+                }
+            }
+            return parsed.port;
+        }
+        catch {
+            // Ignore parse / IO errors — the caller has a fallback message.
+        }
+    }
+    return null;
+}
+/**
+ * When the broker port refuses the connection, the daemon that issued the
+ * capability is gone (typical trigger: a self-upgrade restart). The successor
+ * daemon has no memory of this capability — it lived in the dead process's
+ * heap — so nothing on this side can revive it. Produce an error text that
+ * names the stale env vars and gives the exact recovery an operator can run
+ * without reading source. See OSK-6861.
+ */
+function composeStaleBrokerMessage(brokerUrl) {
+    const livePort = readLiveDaemonPort();
+    const liveHint = typeof livePort === 'number'
+        ? ` The live daemon is bound to port ${livePort} (from daemon-island.json), which does not match the stale URL above.`
+        : '';
+    return (`delegated CLI broker at ${brokerUrl} refused connection. ` +
+        `The parent daemon that issued this capability is gone (typical cause: a self-upgrade restart), ` +
+        `and the capability lived in that process's memory — the successor daemon cannot honour it.` +
+        liveHint +
+        ` To recover in this shell, run:\n` +
+        `  unset OVERSKY_DELEGATED_CLI_BROKER_URL OVERSKY_DELEGATED_CLI_CAPABILITY OVERSKY_AUTONOMOUS_SESSION\n` +
+        `Subsequent \`skrr\` calls will then auto-broker a fresh credential via the live daemon.`);
+}
 /** Fetch a full-permission CLI access token from the local daemon. */
 async function fetchDelegatedCliCredential(env = process.env, options = {}) {
     if (!isDelegatedCliSession(env))
@@ -55,12 +179,31 @@ async function fetchDelegatedCliCredential(env = process.env, options = {}) {
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), 5_000);
     try {
-        const res = await fetch(brokerUrl, {
-            method: 'POST',
-            headers: { Accept: 'application/json', 'Content-Type': 'application/json' },
-            body: JSON.stringify({ capability, sessionId, forceRefresh: options.forceRefresh === true }),
-            signal: controller.signal,
-        });
+        let res;
+        try {
+            res = await fetch(brokerUrl, {
+                method: 'POST',
+                headers: { Accept: 'application/json', 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                    capability,
+                    sessionId,
+                    forceRefresh: options.forceRefresh === true,
+                }),
+                signal: controller.signal,
+            });
+        }
+        catch (err) {
+            // A connection-refused throw here is not the same failure mode as a 5xx
+            // from a live daemon: it means the whole loopback listener is gone, so
+            // the capability is unrecoverable rather than transiently unavailable.
+            // Rewrite the message so `base-command` surfaces recovery text instead
+            // of a bare `fetch failed`. Any other network error (DNS, TLS,
+            // AbortError, etc.) propagates unchanged.
+            if (isConnectionRefusedError(err)) {
+                throw new Error(composeStaleBrokerMessage(brokerUrl));
+            }
+            throw err;
+        }
         if (!res.ok) {
             // A DELIBERATE decline is not a broker failure — WL-5 Step 1.
             //

package/dist/lib/{exec-oversky.d.ts → exec-runtime-binary.d.ts}

@@ -29,9 +29,20 @@ export declare const RUNTIME_BINARY_NAMES: readonly ["skrrd", "oversky"];
  */
 export declare function forwardedFlagsNote(verb: string, opts?: {
     binds?: boolean;
+    bootstrapsRuntime?: boolean;
 }): string;
-/** Resolve the absolute path of `oversky` if it exists, else return null. */
-export declare function findOverskyBinary(): string | null;
+/** Resolve the local runtime binary — `skrrd`, or the legacy `oversky` still on older PATHs. */
+export declare function findRuntimeBinary(): string | null;
+/** Whether a resolved path names the current runtime rather than legacy oversky. */
+export declare function isCurrentRuntimeBinary(binary: string | null): boolean;
+/**
+ * Commander reads runtime global options before the subcommand. The CLI
+ * wrappers naturally receive pass-through flags after a verb (`install
+ * --profile work`), which otherwise silently resolves the runtime profile as
+ * default. Move a well-formed profile flag ahead of the verb without changing
+ * the order of any command-specific flags or `--` payload.
+ */
+export declare function normalizeRuntimeGlobalArgs(args: readonly string[]): string[];
 /**
  * Pretty hint shown when the runtime isn't installed. Kept short — points
  * users at the canonical install paths rather than enumerating them.
@@ -60,7 +71,7 @@ export declare function notInstalledMessage(): string;
  * preserving "exit code = the daemon's exit code" semantics that scripts
  * may depend on.
  */
-export declare function execOversky(args: string[]): Promise<number>;
+export declare function execRuntimeBinary(args: string[]): Promise<number>;
 /**
  * Check an installed daemon's top-level help before forwarding a command that
  * was added after older daemon releases shipped. A false result is useful to
@@ -70,4 +81,4 @@ export declare function execOversky(args: string[]): Promise<number>;
  * This invokes only `oversky --help`: it never starts, stops, configures, or
  * otherwise mutates the local daemon.
  */
-export declare function overskySupportsSubcommand(subcommand: string): Promise<boolean | null>;
+export declare function runtimeBinarySupportsSubcommand(subcommand: string): Promise<boolean | null>;