@skrr-ai/cli 0.1.32 → 0.1.34

package/dist/commands/learning/status.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const api_fetch_1 = require("../../lib/api-fetch");
+const adaptive_learning_1 = require("../../lib/adaptive-learning");
+class LearningStatus extends base_command_1.BaseCommand {
+    static description = 'Show adaptive-learning consent, state, and serving fallback';
+    static flags = { json: core_1.Flags.boolean({ description: 'Output JSON' }) };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(LearningStatus);
+        let consent;
+        let state;
+        try {
+            [consent, state] = await Promise.all([
+                (0, api_fetch_1.apiFetch)('/api/user/adaptive-learning/preferences', {
+                    credential: this.resolvedCredential,
+                }),
+                (0, api_fetch_1.apiFetch)('/api/user/adaptive-learning/state', {
+                    credential: this.resolvedCredential,
+                }),
+            ]);
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+        if (flags.json) {
+            this.log(JSON.stringify({ consent, state }, null, 2));
+            return;
+        }
+        this.log((0, adaptive_learning_1.formatLearningStatus)(consent, state));
+    }
+}
+exports.default = LearningStatus;

package/dist/commands/logout.js

@@ -37,6 +37,7 @@ exports.shouldSkipLocalLogout = shouldSkipLocalLogout;
 const core_1 = require("@oclif/core");
 const base_command_1 = require("../base-command");
 const config_1 = require("../lib/config");
+const first_party_harness_managed_1 = require("../lib/first-party-harness-managed");
 const auth_storage_1 = require("../lib/auth-storage");
 const refresh_1 = require("../lib/refresh");
 const api_fetch_1 = require("../lib/api-fetch");
@@ -212,10 +213,13 @@ class Logout extends base_command_1.BaseCommand {
         //
         // This rebuilds the object rather than deleting keys, which is what strips
         // the tokens — so every field worth keeping has to be named here, and one
-        // that is not named is dropped SILENTLY. `skyCodeAgentId` was in exactly
-        // that position: `skrr code` told users to set it, and the next `skrr logout`
-        // erased it with no message. It is preserved for the same reason `baseURL`
-        // and `cliId` are — this machine's settings outlive one session.
+        // that is not named is dropped SILENTLY. The `skrr code` agent setting was in
+        // exactly that position: `skrr code` told users to set it, and the next
+        // `skrr logout` erased it with no message. It is preserved for the same reason
+        // `baseURL` and `cliId` are — this machine's settings outlive one session.
+        //
+        // Read under every key it has had and written back under the neutral one, so a
+        // logout on a machine an older CLI configured also finishes that key's move.
         //
         // It is re-resolved through the NEXT caller's own roster, so an id they
         // cannot reach is refused by name rather than silently attributed. That is
@@ -225,10 +229,11 @@ class Logout extends base_command_1.BaseCommand {
         // would bill it. `skrr code skrr-agent --show` reports the resolved agent
         // and where it came from, which is the intended way to notice.
         const cfg = (0, config_1.loadConfig)();
+        const agentSetting = (0, first_party_harness_managed_1.readAgentSetting)(cfg);
         (0, config_1.saveConfig)({
             baseURL: cfg.baseURL,
             ...(cfg.cliId ? { cliId: cfg.cliId } : {}),
-            ...(cfg.skyCodeAgentId ? { skyCodeAgentId: cfg.skyCodeAgentId } : {}),
+            ...(agentSetting.value ? { [first_party_harness_managed_1.AGENT_CONFIG_KEY]: agentSetting.value } : {}),
             ...(cfg.credentials ? { credentials: cfg.credentials } : {}),
             migrated: { ...(cfg.migrated ?? {}), authOutOfConfig: true },
         });

package/dist/commands/machines/dedicated/attach.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
+const auth_core_1 = require("@skrr-ai/auth-core");
 const dedicated_lease_command_1 = require("../../../lib/dedicated-lease-command");
 const dedicated_machines_1 = require("../../../lib/dedicated-machines");
 const harnesses_1 = require("../../../lib/harnesses");
@@ -40,7 +41,7 @@ class DedicatedMachinesAttach extends dedicated_lease_command_1.DedicatedLeaseCo
             description: 'Agent to attach. Inside an agent session it defaults to that agent (OVERSKY_SESSION_AGENT_ID).',
         }),
         engine: core_1.Flags.string({
-            description: 'Which engine row to attach when the machine registered several (claude, codex, sky-code). Required only when it is ambiguous.',
+            description: `Which engine row to attach when the machine registered several (claude, codex, ${auth_core_1.FIRST_PARTY_HARNESS.provider}, oversky). Required only when it is ambiguous.`,
         }),
         'rebind-tasks': core_1.Flags.boolean({
             description: 'Publish the updated agent release and move dormant assigned task pins to it. Running and finished tasks are never changed.',

package/dist/commands/tasks/runs.js

@@ -5,6 +5,7 @@ exports.runNeedsFailureReason = runNeedsFailureReason;
 exports.failureFromRun = failureFromRun;
 exports.renderRunFailures = renderRunFailures;
 const core_1 = require("@oclif/core");
+const auth_core_1 = require("@skrr-ai/auth-core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const format_1 = require("../../lib/format");
@@ -34,7 +35,8 @@ function formatRunExecutor(run) {
     }
     const env = run.executionEnvironment;
     if (typeof env === 'string' && env.trim() !== '') {
-        return env;
+        // Canonical: a run recorded before or after a harness rename prints one name.
+        return String((0, auth_core_1.canonicalExecutionEnvironment)(env));
     }
     return '-';
 }

package/dist/commands/workspaces/use.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
+const auth_core_1 = require("@skrr-ai/auth-core");
 const base_command_1 = require("../../base-command");
 const config_1 = require("../../lib/config");
 const workspaces_1 = require("../../lib/workspaces");
@@ -87,7 +88,7 @@ class WorkspacesUse extends base_command_1.BaseCommand {
             return;
         }
         this.log(`Now working in ${selected.name ?? selected.id} (${selected.id}).`);
-        this.log('New agents and `skrr code` sessions resolve here. --workspace still wins per command.');
+        this.log(`New agents and \`${auth_core_1.FIRST_PARTY_HARNESS.command}\` sessions resolve here. --workspace still wins per command.`);
     }
 }
 exports.default = WorkspacesUse;

package/dist/lib/adaptive-learning.d.ts

@@ -0,0 +1,37 @@
+export interface AdaptiveLearningConsent {
+    personalizationAllowed: boolean;
+    sharedTrainingAllowed: boolean;
+    policyVersion: string;
+    source: 'explicit' | 'default_off' | 'workspace_policy' | string;
+    stateGeneration: number;
+    decidedAt: string | null;
+}
+export interface LearnedPreference {
+    key: string;
+    value: unknown;
+    confidence: number;
+    source: 'explicit' | 'inferred' | 'aggregate' | string;
+    evidenceCategory: string;
+    evidenceCount: number;
+}
+export interface AdaptiveLearningState {
+    id: string;
+    policyNamespace: string;
+    scopeKey: string;
+    stateVersion: number;
+    modelVersion: string;
+    featureViewVersion: string;
+    posteriorVersion: string;
+    sampleCount: number;
+    preferences?: LearnedPreference[];
+}
+export interface AdaptiveLearningStateResponse {
+    items: AdaptiveLearningState[];
+    count: number;
+}
+export declare function consentPatch(input: {
+    personalization?: 'on' | 'off';
+    sharedTraining?: 'on' | 'off';
+}): Record<string, boolean>;
+export declare function servingSummary(consent: AdaptiveLearningConsent, state: AdaptiveLearningStateResponse): string;
+export declare function formatLearningStatus(consent: AdaptiveLearningConsent, state: AdaptiveLearningStateResponse): string;

package/dist/lib/adaptive-learning.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.consentPatch = consentPatch;
+exports.servingSummary = servingSummary;
+exports.formatLearningStatus = formatLearningStatus;
+function consentPatch(input) {
+    const patch = {};
+    if (input.personalization !== undefined) {
+        patch.personalizationAllowed = input.personalization === 'on';
+    }
+    if (input.sharedTraining !== undefined) {
+        patch.sharedTrainingAllowed = input.sharedTraining === 'on';
+    }
+    return patch;
+}
+function servingSummary(consent, state) {
+    if (!consent.personalizationAllowed)
+        return 'deterministic baseline (personalization off)';
+    if (!state.items.length)
+        return 'deterministic baseline (cold start)';
+    return 'One Voice authoritative; learned policy is shadow-only';
+}
+function formatLearningStatus(consent, state) {
+    const lines = [
+        `Personalization: ${consent.personalizationAllowed ? 'on' : 'off'}`,
+        `Shared model training: ${consent.sharedTrainingAllowed ? 'on' : 'off'}`,
+        `Serving: ${servingSummary(consent, state)}`,
+        `Consent: ${consent.source} · ${consent.policyVersion} · generation ${consent.stateGeneration}`,
+        `Learned states: ${state.count}`,
+    ];
+    for (const row of state.items) {
+        const recommendation = row.preferences?.find((item) => item.key === 'recommended_action');
+        lines.push(`- ${row.policyNamespace} / ${row.scopeKey}: v${row.stateVersion}, samples=${row.sampleCount}` +
+            (recommendation
+                ? `, recommended=${String(recommendation.value)} (${recommendation.source})`
+                : ''));
+    }
+    return lines.join('\n');
+}

package/dist/lib/auth-core-init.d.ts

@@ -1,4 +1,26 @@
 import { type AuthBundle } from './auth-storage';
+type DedicatedGenerationPreparationOptions = {
+    machineUuid?: string;
+    configDir?: string;
+    clearStoredAuth?: () => void;
+    clearCredentialEnvelope?: () => Promise<void>;
+    clearDeviceIdentity?: () => Promise<void>;
+};
+/**
+ * A Dedicated Runtime's workspace survives replacement but `/etc/machine-id`
+ * intentionally does not. Linux's fallback KEK is derived from that id, so a
+ * CLI credential persisted by the prior instance is unreadable on the next
+ * one. The guest never needs that stale authority: its root-owned loopback
+ * handoff descriptor mints a fresh CLI credential from the current daemon.
+ *
+ * Clear only the workload CLI's machine-bound auth artifacts once per runtime
+ * generation, before auth-core tries to decrypt them. A cross-process lock is
+ * required because terminals and agent tools can launch several `skrr`
+ * processes as soon as the guest becomes ready; without it they can clear a
+ * sibling's just-enrolled credential. The marker contains identity, not a
+ * secret, and stays in the persistent workspace beside the auth files.
+ */
+export declare function prepareDedicatedRuntimeAuthGeneration(options?: DedicatedGenerationPreparationOptions): Promise<boolean>;
 export declare function ensureAuthCoreConfigured(): void;
 export declare class CliCredentialInitializationError extends Error {
     readonly code = "CREDENTIAL_INITIALIZATION_UNAVAILABLE";
@@ -42,3 +64,4 @@ export declare function waitForCliCredentialEnvelope(): Promise<void>;
 /** @internal Test seam — reset the module-level one-shot initialization. */
 export declare function __resetPrefetchCliAuthForTest(): void;
 export declare function shouldUseAccessTokenForEnrollment(bundle: Pick<AuthBundle, 'token' | 'expiresAt'> | null | undefined, nowMs?: number, minTtlMs?: number): boolean;
+export {};

package/dist/lib/auth-core-init.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CliCredentialInitializationError = void 0;
+exports.prepareDedicatedRuntimeAuthGeneration = prepareDedicatedRuntimeAuthGeneration;
 exports.ensureAuthCoreConfigured = ensureAuthCoreConfigured;
 exports.prefetchCliAuth = prefetchCliAuth;
 exports.waitForCliCredentialEnvelope = waitForCliCredentialEnvelope;
@@ -33,8 +34,10 @@ exports.shouldUseAccessTokenForEnrollment = shouldUseAccessTokenForEnrollment;
  *   - Fire-and-forget enrollment when an access token is already
  *     present — short-circuits silently on a fresh install before login.
  */
+const node_fs_1 = __importDefault(require("node:fs"));
 const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
+const proper_lockfile_1 = __importDefault(require("proper-lockfile"));
 const auth_core_1 = require("@skrr-ai/auth-core");
 const cred_envelope_1 = require("./cred-envelope");
 const device_identity_1 = require("./device-identity");
@@ -64,6 +67,64 @@ const cliLogger = {
  * so cross-binary file paths align byte-for-byte.
  */
 const DEFAULT_PROFILE = 'default';
+const DEDICATED_AUTH_GENERATION_MARKER = 'dedicated-runtime-auth-generation';
+/**
+ * A Dedicated Runtime's workspace survives replacement but `/etc/machine-id`
+ * intentionally does not. Linux's fallback KEK is derived from that id, so a
+ * CLI credential persisted by the prior instance is unreadable on the next
+ * one. The guest never needs that stale authority: its root-owned loopback
+ * handoff descriptor mints a fresh CLI credential from the current daemon.
+ *
+ * Clear only the workload CLI's machine-bound auth artifacts once per runtime
+ * generation, before auth-core tries to decrypt them. A cross-process lock is
+ * required because terminals and agent tools can launch several `skrr`
+ * processes as soon as the guest becomes ready; without it they can clear a
+ * sibling's just-enrolled credential. The marker contains identity, not a
+ * secret, and stays in the persistent workspace beside the auth files.
+ */
+async function prepareDedicatedRuntimeAuthGeneration(options = {}) {
+    const machineUuid = String(options.machineUuid ?? process.env.SKRR_MACHINE_UUID ?? '').trim();
+    if (!machineUuid.startsWith('dedicated-runtime:'))
+        return false;
+    const configDir = options.configDir ?? node_path_1.default.join(node_os_1.default.homedir(), '.skrr');
+    node_fs_1.default.mkdirSync(configDir, { recursive: true, mode: 0o700 });
+    const markerPath = node_path_1.default.join(configDir, DEDICATED_AUTH_GENERATION_MARKER);
+    const release = await proper_lockfile_1.default.lock(configDir, {
+        lockfilePath: `${markerPath}.lock`,
+        realpath: false,
+        retries: { retries: 20, minTimeout: 25, maxTimeout: 250 },
+    });
+    try {
+        let recorded = '';
+        try {
+            recorded = node_fs_1.default.readFileSync(markerPath, 'utf8').trim();
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        if (recorded === machineUuid)
+            return false;
+        (options.clearStoredAuth ?? auth_storage_1.clearAllBackends)();
+        await (options.clearDeviceIdentity ??
+            (() => (0, device_identity_1.resetDeviceIdentity)({
+                profile: DEFAULT_PROFILE,
+                clearOnDisk: true,
+            })))();
+        await (options.clearCredentialEnvelope ??
+            (() => (0, cred_envelope_1.resetCredEnvelope)({
+                profile: DEFAULT_PROFILE,
+                clearOnDisk: true,
+            })))();
+        const temporary = `${markerPath}.tmp.${process.pid}.${Date.now()}`;
+        node_fs_1.default.writeFileSync(temporary, `${machineUuid}\n`, { mode: 0o600 });
+        node_fs_1.default.renameSync(temporary, markerPath);
+        return true;
+    }
+    finally {
+        await release();
+    }
+}
 /**
  * Soft cap so a stuck KEK probe (corrupt keychain, hung native binding)
  * does not wedge commands on a fresh/plaintext install. Persisted encrypted

package/dist/lib/code-handover.d.ts

@@ -3,7 +3,7 @@
  *
  * Exported and pure so the parts that decide whether a handover is SAFE are
  * unit-testable without an oclif runtime, a git checkout, or a live API — the
- * convention `buildEngineArgs` follows in `lib/sky-code.ts`. The command itself
+ * convention `buildEngineArgs` follows in `lib/first-party-harness.ts`. The command itself
  * only collects facts and prints.
  */
 /** `owner/name` from any GitHub remote URL shape. */

package/dist/lib/code-handover.js

@@ -4,7 +4,7 @@
  *
  * Exported and pure so the parts that decide whether a handover is SAFE are
  * unit-testable without an oclif runtime, a git checkout, or a live API — the
- * convention `buildEngineArgs` follows in `lib/sky-code.ts`. The command itself
+ * convention `buildEngineArgs` follows in `lib/first-party-harness.ts`. The command itself
  * only collects facts and prints.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
@@ -13,6 +13,7 @@ exports.evaluateHandoverSafety = evaluateHandoverSafety;
 exports.formatUnsafeHandover = formatUnsafeHandover;
 exports.composeHandoverPrompt = composeHandoverPrompt;
 exports.matchAgent = matchAgent;
+const auth_core_1 = require("@skrr-ai/auth-core");
 /** `owner/name` from any GitHub remote URL shape. */
 function parseGitHubRepo(remoteUrl) {
     if (!remoteUrl || !remoteUrl.trim()) {
@@ -69,7 +70,7 @@ function composeHandoverPrompt(input) {
         input.brief.trim(),
         '',
         '---',
-        `Handed over from a local skrr Code session in ${input.repoFullName} on ${input.branch}${at}.`,
+        `Handed over from a local ${auth_core_1.FIRST_PARTY_HARNESS.displayName} session in ${input.repoFullName} on ${input.branch}${at}.`,
         input.recentCommits ? `Recent commits:\n${input.recentCommits}` : null,
         input.localWorkNotCarried
             ? 'NOTE: local uncommitted or unpushed work was NOT carried over — you are working from the pushed state of this branch.'

package/dist/lib/config.d.ts

@@ -33,16 +33,22 @@ export interface CliConfig {
      * OSK-3892 — the agent a locally-hosted `skrr code` session is attributed to.
      *
      * `skrr code` is the local arm of an AGENT's harness: the cloud dispatches to
-     * sky-code as an agent, and a human running it here runs the same harness. So a
-     * managed session needs an agent, and this is where a user records the one they
-     * normally work as instead of typing `--oversky-agent` every time.
+     * the first-party harness as an agent, and a human running it here runs the same
+     * harness. So a managed session needs an agent, and this is where a user records
+     * the one they normally work as instead of typing `--skrr-agent` every time.
      *
      * Deliberately NOT a fallback for anything else. It is read only by the managed
      * acquisition in `skrr code`; every other command keeps its own agent resolution
      * (`agent-resolver.ts`), whose precedence is different and whose callers are
      * often inside a daemon session that already binds one.
+     *
+     * The key is brand-neutral. Earlier CLIs wrote the same setting under a key
+     * named after the product; those are still read, through
+     * `readAgentSetting` in `first-party-harness-managed.ts`, which is the only
+     * reader — never read this field directly, or an older machine's setting is
+     * silently ignored.
      */
-    skyCodeAgentId?: string;
+    firstPartyHarnessAgentId?: string;
     /**
      * The workspace this machine works in, chosen once with `skrr workspaces use`.
      *
@@ -167,6 +173,26 @@ export declare function isEnvAuthOverride(): boolean;
  * resolver and every existing install read it.
  */
 export declare function configRoot(env?: NodeJS.ProcessEnv): string;
+/**
+ * The PRE-RENAME config root — the generation between `.sky` and `.skrr`.
+ *
+ * This was missing from the fallback chain, which went straight from `.skrr` to
+ * `.sky` and skipped the directory that every current install actually has.
+ * The effect is not a missing preference: with no config found, `loadConfig`
+ * returns DEFAULT_CONFIG, whose baseURL is the DEV deployment — so a CLI that
+ * had been pointed at production silently starts addressing dev, and its
+ * `workspaceId` is gone. Nothing errors; commands just answer about a different
+ * backend.
+ *
+ * This read "the production apex", and said the drift ran the other way. It did
+ * not: DEFAULT_CONFIG has been dev since it was written, forty lines further up.
+ * The direction matters here more than most stale comments, because it is the
+ * difference between a lost session and one that silently addresses production.
+ *
+ * Note the filename differs by generation: `.sky` used `config.json`, `.oversky`
+ * and `.skrr` use `cli-config.json`.
+ */
+export declare function priorConfigDir(): string;
 /**
  * Read the config file. Returns defaults if missing. Throws on corrupt JSON.
  * Performs a one-shot legacy → new copy when only the legacy file exists, so

package/dist/lib/config.js

@@ -39,6 +39,7 @@ exports.describeDeployment = describeDeployment;
 exports.canonicalizeKnownBaseURL = canonicalizeKnownBaseURL;
 exports.isEnvAuthOverride = isEnvAuthOverride;
 exports.configRoot = configRoot;
+exports.priorConfigDir = priorConfigDir;
 exports.loadConfig = loadConfig;
 exports.saveConfig = saveConfig;
 exports.getConfigPath = getConfigPath;
@@ -280,7 +281,7 @@ function newConfigDir() {
  *
  * Everything else follows the profile, because everything else IS the
  * deployment: `baseURL`, who you are there (`userId`, `email`), and what you
- * chose there (`workspaceId`, `skyCodeAgentId`).
+ * chose there (`workspaceId`, `firstPartyHarnessAgentId`).
  */
 const MACHINE_SCOPED_KEYS = ['cliId', 'credentials', 'migrated'];
 /**

package/dist/lib/daemon-installer.d.ts

@@ -22,7 +22,7 @@ export interface DaemonInstallOptions {
     fetchImpl?: typeof fetch;
     /**
      * Trust anchors. Defaults to the pinned production set; tests substitute a
-     * generated keypair, exactly as the sky-code installer does. Passing an EMPTY
+     * generated keypair, exactly as the first-party harness installer does. Passing an EMPTY
      * set does not disable verification here — every non-`ok` verdict is a
      * refusal, so an unconfigured trust root turns installs off rather than
      * turning checking off.

package/dist/lib/daemon-target.js

@@ -49,11 +49,11 @@ exports.listActiveDaemons = listActiveDaemons;
 const api_fetch_1 = require("./api-fetch");
 const daemonBroker_1 = require("./daemonBroker");
 const daemon_ref_1 = require("./daemon-ref");
-const sky_code_1 = require("./sky-code");
+const first_party_harness_1 = require("./first-party-harness");
 function localMachine(options = {}) {
     const env = options.env ?? process.env;
     const getuid = 'getuid' in options ? options.getuid : process.getuid?.bind(process);
-    if (!(0, sky_code_1.isDedicatedRuntimeWorkload)(env, getuid))
+    if (!(0, first_party_harness_1.isDedicatedRuntimeWorkload)(env, getuid))
         return { dedicatedRuntime: false, daemonId: null };
     return { dedicatedRuntime: true, daemonId: publishedDaemonId(options) };
 }

package/dist/lib/dedicated-machines.d.ts

@@ -418,8 +418,8 @@ export declare function dedicatedDeletionLines(lease: DedicatedLease, now?: Date
  * A lease payload names no daemon (provider and daemon ids are deliberately
  * absent), so the join goes the other way: each row a guest daemon registers
  * carries `metadata.machineLeaseId` and `metadata.machineProduct`. One daemon
- * writes one row PER ENGINE it announces (claude, codex, sky-code, or `oversky`
- * when it announces none), all sharing the daemon id.
+ * writes one row PER ENGINE it announces (claude, codex, the first-party harness,
+ * or `oversky` when it announces none), all sharing the daemon id.
  */
 export declare function dedicatedLeaseHarnesses(lease: Pick<DedicatedLease, 'id'>, harnesses: readonly Harness[]): Harness[];
 /**

package/dist/lib/dedicated-machines.js

@@ -36,6 +36,7 @@ exports.dedicatedCatalogFromProducts = dedicatedCatalogFromProducts;
 exports.dedicatedRuntimeApiErrorCode = dedicatedRuntimeApiErrorCode;
 exports.dedicatedRuntimeApiErrorDetails = dedicatedRuntimeApiErrorDetails;
 exports.formatDedicatedRuntimeApiError = formatDedicatedRuntimeApiError;
+const auth_core_1 = require("@skrr-ai/auth-core");
 const api_fetch_1 = require("./api-fetch");
 const edge_error_page_1 = require("./edge-error-page");
 const harnesses_1 = require("./harnesses");
@@ -622,8 +623,8 @@ function dedicatedDeletionLines(lease, now = new Date()) {
  * A lease payload names no daemon (provider and daemon ids are deliberately
  * absent), so the join goes the other way: each row a guest daemon registers
  * carries `metadata.machineLeaseId` and `metadata.machineProduct`. One daemon
- * writes one row PER ENGINE it announces (claude, codex, sky-code, or `oversky`
- * when it announces none), all sharing the daemon id.
+ * writes one row PER ENGINE it announces (claude, codex, the first-party harness,
+ * or `oversky` when it announces none), all sharing the daemon id.
  */
 function dedicatedLeaseHarnesses(lease, harnesses) {
     const seenAt = (harness) => Date.parse(harness.lastSeenAt || '') || 0;
@@ -689,7 +690,9 @@ function selectDedicatedAttachHarness(lease, harnesses, engine) {
     }
     const providers = [...new Set(rows.map((row) => row.provider))];
     if (engine) {
-        const match = rows.find((row) => row.provider === engine);
+        // Any accepted spelling of an engine names it: a user who typed the first-party
+        // harness's older name means the row stored under its canonical one.
+        const match = rows.find((row) => (0, auth_core_1.isSameHarnessProvider)(row.provider, engine));
         if (!match) {
             return {
                 error: `${lease.id} has no "${engine}" engine. Registered: ${providers.join(', ')}.`,
@@ -890,7 +893,11 @@ function formatDedicatedRuntimeApiError(err) {
     }
     try {
         const parsed = JSON.parse(err.body);
-        const sentence = parsed.message || parsed.error || parsed.code;
+        // This formatter is reached only by `machines dedicated *`. Older API
+        // replicas and product-neutral action errors may still carry the Hosted
+        // Machine noun even though the caller named a Dedicated Runtime. Do not
+        // repeat that contradictory product name while a mixed deployment rolls.
+        const sentence = (parsed.message || parsed.error || parsed.code)?.replace(/(?:skrr )?Hosted Machine/g, 'Dedicated Runtime');
         return sentence ? `${sentence}${describeRefusalReasons(err)}` : null;
     }
     catch {

package/dist/lib/exec-runtime-binary.d.ts

@@ -57,8 +57,8 @@ export declare function normalizeRuntimeGlobalArgs(args: readonly string[]): str
  *
  * An install instruction is only worth what it installs. Renaming these
  * before the tap and repository move produces a message that reads correct
- * and fails when followed — the same defect as the "install it with
- * `sky code install`" hint, which named a command that never existed.
+ * and fails when followed — the same defect as the old hint that told users to
+ * run `code install` under the previous CLI name, a command that never existed.
  *
  * They move when the Homebrew tap is published (that work is tracked
  * separately) and when the repository is renamed — not before, and not as

package/dist/lib/exec-runtime-binary.js

@@ -187,8 +187,8 @@ function isExecutable(p) {
  *
  * An install instruction is only worth what it installs. Renaming these
  * before the tap and repository move produces a message that reads correct
- * and fails when followed — the same defect as the "install it with
- * `sky code install`" hint, which named a command that never existed.
+ * and fails when followed — the same defect as the old hint that told users to
+ * run `code install` under the previous CLI name, a command that never existed.
  *
  * They move when the Homebrew tap is published (that work is tracked
  * separately) and when the repository is renamed — not before, and not as