@skrr-ai/cli 0.1.32 → 0.1.34

package/dist/lib/{sky-code-doctor.js → first-party-harness-doctor.js}

@@ -1,6 +1,6 @@
 "use strict";
 /**
- * WL-6.9 — skrr Code diagnostics.
+ * WL-6.9 — first-party harness diagnostics (`skrr code doctor`).
  *
  * The plan makes this a launch gate, phrased as: support must be able to
  * identify the product version, upstream base, config source, and runtime mode
@@ -21,6 +21,12 @@
  *    actions, and collapsing them into one red line is how a user spends an
  *    hour reinstalling something that was merely absent. Hence three statuses,
  *    not two.
+ *
+ * Every product-named value — display name, binary name, project directory, env
+ * var names — comes from the identity module in `@skrr-ai/auth-core`. A variable
+ * that was read under an OLDER name is reported by that name, with the neutral
+ * one to move to: the older names are still honoured, and a diagnostic that
+ * hid which one was in effect would send an operator to edit the wrong line.
  */
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
@@ -31,14 +37,28 @@ exports.runDoctor = runDoctor;
 exports.formatReport = formatReport;
 const node_fs_1 = require("node:fs");
 const node_path_1 = __importDefault(require("node:path"));
-const sky_code_1 = require("./sky-code");
+const first_party_harness_1 = require("./first-party-harness");
 const auth_core_1 = require("@skrr-ai/auth-core");
 const harness_tiers_1 = require("./harness-tiers");
-const config_1 = require("./config");
-const sky_code_managed_1 = require("./sky-code-managed");
-/** Project-level state dir. Basename deliberately differs from `~/.skrr`. */
+const first_party_harness_managed_1 = require("./first-party-harness-managed");
+/**
+ * The variable one purpose was read from, and — when that was an older name — the
+ * sentence that says so. `undefined` when the neutral name (or nothing) was used.
+ */
+function legacyEnvNote(key, name) {
+    const neutral = auth_core_1.FIRST_PARTY_HARNESS_ENV[key].name;
+    if (!name || name === neutral)
+        return undefined;
+    return (`${name} is an older name for this setting and is still read; ` +
+        `rename it to ${neutral}, which wins when both are set.`);
+}
+/**
+ * Project-level state dir — the ENGINE's own project marker
+ * (`FIRST_PARTY_HARNESS_ENGINE.projectDirectory`). Basename deliberately differs
+ * from `~/.skrr`.
+ */
 function projectStateDir(cwd) {
-    return node_path_1.default.join(node_path_1.default.resolve(cwd), '.sky-code');
+    return node_path_1.default.join(node_path_1.default.resolve(cwd), auth_core_1.FIRST_PARTY_HARNESS_ENGINE.projectDirectory);
 }
 /**
  * Which release channel this machine follows, and where its manifest lives.
@@ -46,7 +66,7 @@ function projectStateDir(cwd) {
  * `notInstalledMessage()` has always ended by promising that this command names
  * "which channel this machine follows and whether that channel has a published
  * release", and nothing here knew what a channel was — the whole vocabulary sat
- * in `daemon/src/sky-code/channels.ts`, whose only importer was the daemon's own
+ * in `daemon/src/first-party-harness/channels.ts`, whose only importer was the daemon's own
  * installer. So the user with no engine, who is exactly the audience for that
  * sentence, was sent to a command that could not answer (dogfood OSK-274).
  *
@@ -57,67 +77,98 @@ function projectStateDir(cwd) {
  * the answer one copy-paste away and keeps the property — and the promise is
  * reworded to match what is delivered rather than the other way round.
  *
- * `warn` on an unrecognised channel, because `resolveSkyCodeChannel` falls back
- * to the default rather than throwing: a typo must not brick updates, and a
- * silent fallback must not look like agreement.
+ * The URL is the CANONICAL feed candidate. A manifest may also be published under
+ * each older spelling (`firstPartyHarnessFeedCandidates`), and an installer that
+ * finds nothing at the canonical URL tries those next — so the remedy names them
+ * too. Without that, "the canonical URL 404s" would read as "there is no release"
+ * on a feed an older pipeline published under the other spelling. The doctor
+ * cannot say which candidate actually holds a release, because it does not probe;
+ * it says where to look, in the order an installer looks.
+ *
+ * `warn` on an unrecognised channel, because `resolveFirstPartyHarnessChannel`
+ * falls back to the default rather than throwing: a typo must not brick updates,
+ * and a silent fallback must not look like agreement.
  */
 function releaseChannelCheck(env) {
-    const { channel, invalid } = (0, auth_core_1.resolveSkyCodeChannel)(env);
-    const url = (0, auth_core_1.resolveChannelManifestUrl)({
-        base: (0, auth_core_1.skyCodeFeedBase)(env),
-        manifestFilename: auth_core_1.SKY_CODE_MANIFEST_FILE,
+    const { channel, invalid, source } = (0, auth_core_1.resolveFirstPartyHarnessChannel)(env);
+    const [canonical, ...alternates] = (0, auth_core_1.firstPartyHarnessFeedCandidates)(env).map((candidate) => (0, auth_core_1.resolveChannelManifestUrl)({
+        base: candidate.base,
+        manifestFilename: candidate.manifestFilename,
         channel,
-    });
+    }));
+    const legacyNote = legacyEnvNote('channel', source);
     if (invalid) {
         return {
             name: 'release-channel',
             status: 'warn',
-            detail: `${auth_core_1.SKY_CODE_CHANNEL_ENV}='${invalid}' is not a channel; following '${channel}' instead — ${url}`,
-            remedy: `Set ${auth_core_1.SKY_CODE_CHANNEL_ENV} to one of internal, canary, beta, stable, or unset it to follow the default.`,
+            detail: `${source}='${invalid}' is not a channel; following '${channel}' instead — ${canonical}`,
+            remedy: `Set ${auth_core_1.FIRST_PARTY_HARNESS_ENV.channel.name} to one of ${auth_core_1.FIRST_PARTY_HARNESS_CHANNELS.join(', ')}, ` +
+                'or unset it to follow the default.' +
+                (legacyNote ? ` ${legacyNote}` : ''),
         };
     }
+    const alsoTried = alternates.filter((url) => url !== canonical);
     return {
         name: 'release-channel',
         status: 'ok',
-        detail: `${channel} — ${url}`,
-        remedy: `Fetch that URL to see whether the channel has a published release, and which version.`,
+        detail: `${channel} — ${canonical}`,
+        remedy: 'Fetch that URL to see whether the channel has a published release, and which version.' +
+            (alsoTried.length
+                ? ` If it has none, an installer also tries ${alsoTried.join(', ')}.`
+                : '') +
+            (legacyNote ? ` ${legacyNote}` : ''),
     };
 }
 /**
  * What the pre-rename engine directory still holds, for a machine that has moved on.
  *
- * Round 1 gave both readers a fallback to `~/.oversky/sky-code/bin` so nothing
- * BREAKS on a machine that installed before the rename. Nothing was given the job
- * of finishing the move: no installer sweep, and — once the current root wins —
- * no mention anywhere. This machine converged on two engine directories and
- * reported one, the older holding 713 MB across six binaries (dogfood OSK-278).
+ * Round 1 gave both readers a fallback to the managed `bin` directory under the
+ * pre-rename `~/.oversky` root so nothing BREAKS on a machine that installed before
+ * the rename. Nothing was given the job of finishing the move: no installer sweep,
+ * and — once the current root wins — no mention anywhere. This machine converged
+ * on two engine directories and reported one, the older holding 713 MB across six
+ * binaries (dogfood OSK-278).
  *
  * Flat, never recursive, and failures are swallowed: this is a footnote on a
  * diagnostic, and a doctor that throws while counting bytes it was only going to
  * mention has made things worse than the clutter it was reporting.
  */
 function strandedLegacyEngine(env) {
-    const exeName = process.platform === 'win32' ? 'sky-code.exe' : 'sky-code';
-    const legacy = (0, sky_code_1.legacyManagedEnginePath)(exeName, env);
-    if (!legacy)
-        return null;
-    const dir = node_path_1.default.dirname(legacy);
-    try {
-        const entries = (0, node_fs_1.readdirSync)(dir);
-        let bytes = 0;
-        let files = 0;
-        for (const entry of entries) {
-            const stats = (0, node_fs_1.statSync)(node_path_1.default.join(dir, entry));
-            if (!stats.isFile())
-                continue;
-            files += 1;
-            bytes += stats.size;
+    for (const dir of (0, first_party_harness_1.legacyManagedEngineBinDirs)(env)) {
+        try {
+            const entries = (0, node_fs_1.readdirSync)(dir);
+            let bytes = 0;
+            let files = 0;
+            for (const entry of entries) {
+                const stats = (0, node_fs_1.statSync)(node_path_1.default.join(dir, entry));
+                if (!stats.isFile())
+                    continue;
+                files += 1;
+                bytes += stats.size;
+            }
+            if (files > 0)
+                return { dir, files, bytes };
+        }
+        catch {
+            // Absent or unreadable — nothing to mention for this directory.
         }
-        return files > 0 ? { dir, files, bytes } : null;
     }
-    catch {
+    return null;
+}
+/**
+ * Whether a managed engine resolved under an OLDER spelling of its file name.
+ *
+ * Not a fault: resolution tries every spelling on purpose, and the next
+ * `skrr code` run renames the file onto the canonical name (leaving a link at the
+ * old one). Said anyway, because a path that does not match the name everything
+ * else prints is exactly the surprise this module exists to explain.
+ */
+function olderBinaryName(bin) {
+    const name = node_path_1.default.basename(bin);
+    const canonical = (0, auth_core_1.firstPartyHarnessBinaryName)(undefined, process.platform);
+    if (name === canonical)
         return null;
-    }
+    return (0, auth_core_1.firstPartyHarnessBinaryNames)(process.platform).includes(name) ? name : null;
 }
 /** Bytes as the size a human would say out loud. */
 function humanBytes(bytes) {
@@ -125,7 +176,9 @@ function humanBytes(bytes) {
     return mb >= 1024 ? `${(mb / 1024).toFixed(1)} GB` : `${Math.round(mb)} MB`;
 }
 function engineCheck(env) {
-    const { path: bin, source } = (0, sky_code_1.resolveEngine)(env);
+    const resolution = (0, first_party_harness_1.resolveEngine)(env);
+    const { path: bin, source } = resolution;
+    const pathVar = auth_core_1.FIRST_PARTY_HARNESS_ENV.path.name;
     if (bin && source === 'legacy-managed') {
         // `ok`, because it runs and this is the resolution the daemon has always
         // made. The remedy is here because the resolution is SURPRISING: the path
@@ -137,58 +190,79 @@ function engineCheck(env) {
             status: 'ok',
             detail: `${bin} (resolved via ${source} — the pre-rename location)`,
             remedy: 'It works, and nothing has to change today. Installing the engine again ' +
-                `through the daemon writes it to ${(0, sky_code_1.managedEnginePath)('sky-code', env)}; ` +
+                `through the daemon writes it to ${(0, first_party_harness_1.managedEnginePath)(env)}; ` +
                 'the copy above can be deleted once it does.',
         };
     }
+    if (bin && source === 'env') {
+        // Name the variable, not just "env": two names are read for this override,
+        // and the one to edit is the one that is set.
+        const legacyNote = resolution.legacyEnv ? legacyEnvNote('path', resolution.envName) : undefined;
+        return {
+            name: 'engine',
+            status: 'ok',
+            detail: `${bin} (resolved via env ${resolution.envName})`,
+            ...(legacyNote ? { remedy: legacyNote } : {}),
+        };
+    }
     if (bin) {
         // The engine resolved from the current root — and the pre-rename directory
         // may still be sitting there. Said here rather than in its own check because
         // it is a footnote on a healthy answer, not a finding of its own.
         const stranded = strandedLegacyEngine(env);
+        const older = source === 'managed' ? olderBinaryName(bin) : null;
+        const notes = [
+            older
+                ? `Installed under the older file name ${older}; the next \`${auth_core_1.FIRST_PARTY_HARNESS.command}\` ` +
+                    `run renames it to ${(0, auth_core_1.firstPartyHarnessBinaryName)(undefined, process.platform)} and leaves a link ` +
+                    'at the old name, so anything still reading that path keeps working.'
+                : null,
+            stranded
+                ? `${stranded.dir} still holds ${stranded.files} file(s), ${humanBytes(stranded.bytes)}, ` +
+                    'from before the config root moved. Nothing reads it now that the engine above ' +
+                    'resolves, and nothing removes it either — delete it when you want the space back.'
+                : null,
+        ].filter((note) => Boolean(note));
         return {
             name: 'engine',
             status: 'ok',
             detail: `${bin} (resolved via ${source})`,
-            ...(stranded
-                ? {
-                    remedy: `${stranded.dir} still holds ${stranded.files} file(s), ${humanBytes(stranded.bytes)}, ` +
-                        'from before the config root moved. Nothing reads it now that the engine above ' +
-                        'resolves, and nothing removes it either — delete it when you want the space back.',
-                }
-                : {}),
+            ...(notes.length ? { remedy: notes.join(' ') } : {}),
         };
     }
-    const override = env[sky_code_1.ENGINE_PATH_ENV];
-    if (override && !node_path_1.default.isAbsolute(override)) {
+    const override = (0, auth_core_1.readFirstPartyHarnessEnv)(env, 'path');
+    const legacyNote = legacyEnvNote('path', override.name);
+    if (override.value && !node_path_1.default.isAbsolute(override.value)) {
         return {
             name: 'engine',
             status: 'fail',
             // A relative override is rejected rather than resolved: for an
             // agent-invoked command the cwd is attacker-influenced, so a repo
-            // containing ./sky-code could otherwise hijack the engine.
-            detail: `${sky_code_1.ENGINE_PATH_ENV} is set to a relative path ('${override}') and was ignored`,
-            remedy: `Set ${sky_code_1.ENGINE_PATH_ENV} to an absolute path.`,
+            // containing a file named like the engine could otherwise hijack it.
+            detail: `${override.name} is set to a relative path ('${override.value}') and was ignored`,
+            remedy: `Set ${pathVar} to an absolute path.${legacyNote ? ` ${legacyNote}` : ''}`,
         };
     }
-    if (override) {
+    if (override.value) {
         return {
             name: 'engine',
             status: 'fail',
-            detail: `${sky_code_1.ENGINE_PATH_ENV}='${override}' is not an executable file`,
-            remedy: 'Point it at a real sky-code build, or unset it to fall back to PATH.',
+            detail: `${override.name}='${override.value}' is not an executable file`,
+            remedy: `Point it at a real ${auth_core_1.FIRST_PARTY_HARNESS.displayName} engine build, or unset it to fall back to PATH.` +
+                (legacyNote ? ` ${legacyNote}` : ''),
         };
     }
     return {
         name: 'engine',
         status: 'fail',
-        detail: 'no sky-code binary on PATH or in the managed location',
-        remedy: `Install the engine, or set ${sky_code_1.ENGINE_PATH_ENV} to an existing build.`,
+        detail: `no ${auth_core_1.FIRST_PARTY_HARNESS.displayName} engine binary ` +
+            `(${(0, auth_core_1.firstPartyHarnessBinaryNames)(process.platform).join(' or ')}) on PATH or in the managed location`,
+        remedy: `Install the engine (\`${auth_core_1.FIRST_PARTY_HARNESS.command} install\`), or set ${pathVar} to an existing build.`,
     };
 }
 function stateDirCheck(cwd, env) {
     const project = projectStateDir(cwd);
-    const user = (0, sky_code_1.engineHome)(env);
+    const user = (0, first_party_harness_1.engineHome)(env);
     // The collision the plan calls out: if the project dir resolved onto the
     // daemon's auth/profile root, running with $HOME as cwd would reinterpret
     // user credentials as project configuration.
@@ -196,13 +270,13 @@ function stateDirCheck(cwd, env) {
     // holds for a user who relocated their root with OVERSKY_CONFIG_DIR. A
     // collision check that looks at the wrong directory reports "ok" and is worse
     // than no check.
-    const daemonRoot = node_path_1.default.dirname((0, sky_code_1.engineHome)(env));
+    const daemonRoot = node_path_1.default.dirname((0, first_party_harness_1.engineHome)(env));
     if (project === daemonRoot || project.startsWith(daemonRoot + node_path_1.default.sep)) {
         return {
             name: 'state-paths',
             status: 'fail',
             detail: `project state dir ${project} sits inside the skrr user root ${daemonRoot}`,
-            remedy: 'This is a build bug — report it. Do not run skrr Code from this directory.',
+            remedy: `This is a build bug — report it. Do not run ${auth_core_1.FIRST_PARTY_HARNESS.displayName} from this directory.`,
         };
     }
     const parts = [
@@ -212,14 +286,14 @@ function stateDirCheck(cwd, env) {
     return { name: 'state-paths', status: 'ok', detail: parts.join('; ') };
 }
 function compatCheck(cwd, env) {
-    // Report both skrr Code's writable instruction surfaces and read-only
+    // Report both the engine's own writable instruction surfaces and read-only
     // compatibility sources so "where did this instruction come from?" has an
     // answer — a WL-2 acceptance criterion.
     const root = node_path_1.default.resolve(cwd);
     const own = [];
     for (const file of [
-        node_path_1.default.join(root, '.sky-code', 'AGENTS.md'),
-        node_path_1.default.join((0, sky_code_1.skyCodeInstructionHome)(env), 'AGENTS.md'),
+        node_path_1.default.join(projectStateDir(root), 'AGENTS.md'),
+        node_path_1.default.join((0, first_party_harness_1.engineInstructionHome)(env), 'AGENTS.md'),
     ]) {
         if ((0, node_fs_1.existsSync)(file))
             own.push(file);
@@ -233,12 +307,12 @@ function compatCheck(cwd, env) {
         return {
             name: 'compat-sources',
             status: 'ok',
-            detail: 'no skrr Code-owned or compatibility instruction files in this project',
+            detail: `no ${auth_core_1.FIRST_PARTY_HARNESS.displayName}-owned or compatibility instruction files in this project`,
         };
     }
     const details = [];
     if (own.length > 0)
-        details.push(`skrr Code-owned: ${own.join(', ')}`);
+        details.push(`${auth_core_1.FIRST_PARTY_HARNESS.displayName}-owned: ${own.join(', ')}`);
     if (compatibility.length > 0)
         details.push(`compatibility (read-only): ${compatibility.join(', ')}`);
     return {
@@ -256,11 +330,11 @@ function opencodeCheck(cwd) {
     return {
         name: 'migration',
         status: 'warn',
-        // Warn, not fail: the directory being present is not an error, and Sky
-        // Code will not read or touch it. The user simply has config they may
+        // Warn, not fail: the directory being present is not an error, and the
+        // engine will not read or touch it. The user simply has config they may
         // want carried over.
-        detail: `${legacy} exists and is NOT read by skrr Code`,
-        remedy: 'Run `skrr code migrate opencode --dry-run` to see what would carry over.',
+        detail: `${legacy} exists and is NOT read by ${auth_core_1.FIRST_PARTY_HARNESS.displayName}`,
+        remedy: `Run \`${auth_core_1.FIRST_PARTY_HARNESS.command} migrate opencode --dry-run\` to see what would carry over.`,
     };
 }
 /**
@@ -270,26 +344,30 @@ function opencodeCheck(cwd) {
  * it is this one, so the check stays. What changed is that the answer is
  * computed from {@link MIRRORED_HARNESS_TIERS} instead of being restated as
  * prose: this line described Tier 2 behaviour for a day after the owner
- * decision of 2026-08-11 moved `sky-code` to Tier 1, which is the worst
+ * decision of 2026-08-11 moved the first-party harness to Tier 1, which is the worst
  * possible audience to mislead — the people running `doctor` are running it
  * because permissions already confused them.
  *
- * `sky-code-trust-parity.spec.ts` fails if the mirror drifts from
+ * `first-party-harness-trust-parity.spec.ts` fails if the mirror drifts from
  * `daemon/src/harness-trust.ts` again.
  */
 function trustCheck() {
-    const tier = (0, harness_tiers_1.mirroredTier)(sky_code_managed_1.SKY_CODE_HARNESS);
+    // The canonical slug. The shared table carries every spelling at the same tier,
+    // so which one is asked does not change the answer — but the report prints the
+    // name the platform stores.
+    const harness = auth_core_1.FIRST_PARTY_HARNESS.provider;
+    const tier = (0, harness_tiers_1.mirroredTier)(harness);
     if (tier == null) {
         // Unreachable while the constant carries an entry, and deliberately not an
         // invented tier: guessing here would put a false claim in a diagnostic.
         return {
             name: 'trust-tier',
             status: 'warn',
-            detail: `no mirrored trust tier for ${sky_code_managed_1.SKY_CODE_HARNESS} in this CLI build`,
+            detail: `no mirrored trust tier for ${harness} in this CLI build`,
             remedy: `The daemon decides; read ${harness_tiers_1.HARNESS_TIER_AUTHORITY} or run \`oversky doctor\`.`,
         };
     }
-    const described = (0, harness_tiers_1.describeTier)(sky_code_managed_1.SKY_CODE_HARNESS, tier);
+    const described = (0, harness_tiers_1.describeTier)(harness, tier);
     return {
         name: 'trust-tier',
         status: described.notable ? 'warn' : 'ok',
@@ -317,7 +395,7 @@ function permissionAuthorityCheck(env) {
 /**
  * Hosts the engine's WL-2.7 egress policy denies, and the one it still permits.
  *
- * Duplicated from `packages/core/src/egress.ts` in the sky-code fork rather than
+ * Duplicated from `packages/core/src/egress.ts` in the engine's fork rather than
  * imported: the CLI does not depend on the engine's source tree, and `doctor`
  * must be able to answer "what will this binary refuse to talk to?" without one.
  * The cost of the duplication is bounded because the fork's own test asserts the
@@ -334,14 +412,15 @@ const EGRESS_DENIED_HOSTS = [
     'social-cards.sst.dev',
     'opencode.internal',
 ];
-const EGRESS_OVERRIDE_ENV = 'SKY_CODE_ALLOW_UPSTREAM_EGRESS';
+/** The ENGINE reads this one under its own name; the platform only reports it. */
+const EGRESS_OVERRIDE_ENV = auth_core_1.FIRST_PARTY_HARNESS_ENGINE.env.allowUpstreamEgress;
 function egressCheck(env) {
     const override = env[EGRESS_OVERRIDE_ENV];
     if (override === '1' || override === 'true') {
         return {
             name: 'upstream-egress',
             status: 'warn',
-            detail: `${EGRESS_OVERRIDE_ENV} is set — sky-code may reach upstream hosted services`,
+            detail: `${EGRESS_OVERRIDE_ENV} is set — ${auth_core_1.FIRST_PARTY_HARNESS.displayName} may reach upstream hosted services`,
             remedy: 'Unset it unless you are deliberately debugging upstream behaviour. Session content, ' +
                 'repository names, and account tokens can leave for a third party while it is set.',
         };
@@ -368,7 +447,7 @@ function egressCheck(env) {
  * inventing a resolved credential would not be.
  */
 function credentialCheck(env) {
-    // The variable `daemon/src/backends/sky-code.ts` declares. Named here rather
+    // The variable `daemon/src/backends/first-party-harness.ts` declares. Named here rather
     // than imported because the CLI does not depend on the daemon's source.
     const ENGINE_KEY_VAR = 'OPENROUTER_API_KEY';
     const present = typeof env[ENGINE_KEY_VAR] === 'string' && env[ENGINE_KEY_VAR].length > 0;
@@ -388,7 +467,7 @@ function credentialCheck(env) {
     // matches the one `skrr code`'s fallback line gives when it says whether it is
     // falling back to BYOK or to nothing at all. Reporting only `OPENROUTER_API_KEY`
     // told a user with an `ANTHROPIC_API_KEY` they had no credential.
-    const others = Object.keys((0, sky_code_1.inheritedProviderCredentials)(env)).sort();
+    const others = Object.keys((0, first_party_harness_1.inheritedProviderCredentials)(env)).sort();
     if (others.length) {
         const shown = others.slice(0, 4);
         return {
@@ -505,7 +584,7 @@ function delegatedSurfaceCheck(env) {
  * by construction never enters a child environment anyway.
  */
 function managedInferenceCheck(env) {
-    const posture = (0, sky_code_managed_1.managedInferencePosture)(env);
+    const posture = (0, first_party_harness_managed_1.managedInferencePosture)(env);
     return {
         name: 'managed-inference',
         status: posture.status,
@@ -550,7 +629,7 @@ function sessionAuthorityCheck(env) {
     // "a daemon adjudicates every tool call" at a session where nothing adjudicates
     // anything. The docstring above named that conflation and the code beneath it
     // committed it.
-    switch ((0, sky_code_managed_1.resolveTrustPlane)(env)) {
+    switch ((0, first_party_harness_managed_1.resolveTrustPlane)(env)) {
         case 'daemon-supervised':
             return {
                 name: 'session-authority',
@@ -585,7 +664,7 @@ function sessionAuthorityCheck(env) {
                 remedy: 'Intended for local use, and nothing to fix. Worth knowing because it is NOT the same ' +
                     'trust plane as a daemon-dispatched run — and neither plane is an OS-level sandbox ' +
                     '(no seccomp, container, or namespace). An untrusted autonomous workload needs a hosted ' +
-                    'or container profile; see sky-code/docs/sky-code/threat-model.md.',
+                    `or container profile; see docs/${auth_core_1.FIRST_PARTY_HARNESS_ENGINE.appName}/threat-model.md in the engine's repository.`,
             };
     }
 }
@@ -610,28 +689,36 @@ function agentAttributionCheck() {
     // whose job is to tell you your config is broken.
     let configured;
     try {
-        configured = (0, config_1.loadConfig)().skyCodeAgentId?.trim();
+        configured = (0, first_party_harness_managed_1.readConfiguredAgentSetting)();
     }
     catch (err) {
         return {
             name: 'agent',
             status: 'warn',
-            detail: `could not read ${sky_code_managed_1.AGENT_CONFIG_KEY}: ${err instanceof Error ? err.message : String(err)}`,
+            detail: `could not read ${first_party_harness_managed_1.AGENT_CONFIG_KEY}: ${err instanceof Error ? err.message : String(err)}`,
             remedy: 'Fix or delete ~/.skrr/cli-config.json, then sign in again.',
         };
     }
-    if (configured) {
+    const { command, displayName } = auth_core_1.FIRST_PARTY_HARNESS;
+    if (configured.value) {
         return {
             name: 'agent',
             status: 'ok',
-            detail: `sessions are attributed to "${configured}" (${sky_code_managed_1.AGENT_CONFIG_KEY})`,
+            // The key it was READ from, which is not always the key written today.
+            detail: `sessions are attributed to "${configured.value}" (${configured.key})`,
+            ...(configured.legacy
+                ? {
+                    remedy: `"${configured.key}" is the older name for this setting and is still read. ` +
+                        `\`${command} skrr-agent --set ${configured.value}\` rewrites it as "${first_party_harness_managed_1.AGENT_CONFIG_KEY}".`,
+                }
+                : {}),
         };
     }
     return {
         name: 'agent',
         status: 'ok',
-        detail: `no ${sky_code_managed_1.AGENT_CONFIG_KEY} set — sessions use your sole owned agent, else your default ${sky_code_managed_1.SKY_CODE_HARNESS} agent`,
-        remedy: 'Run `skrr code skrr-agent` to see which, or `skrr code skrr-agent --set <id>` to pin one.',
+        detail: `no ${first_party_harness_managed_1.AGENT_CONFIG_KEY} set — sessions use your sole owned agent, else your default ${displayName} agent`,
+        remedy: `Run \`${command} skrr-agent\` to see which, or \`${command} skrr-agent --set <id>\` to pin one.`,
     };
 }
 function runDoctor(cwd = process.cwd(), env = process.env) {
@@ -671,9 +758,9 @@ function formatReport(report) {
     }
     lines.push('');
     lines.push(report.status === 'fail'
-        ? 'One or more checks failed — skrr Code will not run correctly until they are resolved.'
+        ? `One or more checks failed — ${auth_core_1.FIRST_PARTY_HARNESS.displayName} will not run correctly until they are resolved.`
         : report.status === 'warn'
-            ? 'skrr Code is usable; the warnings above are worth reading.'
+            ? `${auth_core_1.FIRST_PARTY_HARNESS.displayName} is usable; the warnings above are worth reading.`
             : 'All checks passed.');
     return lines.join('\n');
 }