@skrr-ai/cli 0.1.36 → 0.1.38

package/dist/commands/harnesses/install.js

@@ -0,0 +1,165 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../base-command");
+const cli_installers_1 = require("../../lib/cli-installers");
+const daemon_ref_1 = require("../../lib/daemon-ref");
+const daemon_target_1 = require("../../lib/daemon-target");
+/**
+ * Install one managed coding-agent CLI on a machine.
+ *
+ * ## Why this did not exist
+ *
+ * The daemon has installed any of seven providers since `d878b79581`, and
+ * `POST /api/daemons/:id/cli-installers/:provider/install` is the request the
+ * web app's Install button sends. From the CLI only ONE of them was reachable:
+ * `skrr code install`, whose provider is a constant. Everything else had to be
+ * installed by hand, or from the web app.
+ *
+ * `skrr harnesses install-token` made that worse rather than neutral. It is the
+ * only entry in `harnesses --help` with "install" in its name, so a user
+ * scanning for "how do I install a harness" lands on it — and it mints a daemon
+ * enrolment token for another machine, which is a different thing entirely.
+ *
+ * ## The provider name is validated here, against the shared vocabulary
+ *
+ * Unlike `harnesses list --provider`, where the set is open because a daemon
+ * registers a row per capability it detects, the INSTALLABLE set is closed and
+ * owned: `MANAGED_CLI_PROVIDER_IDS` in `@skrr-ai/data-provider`, which the
+ * daemon's own list is pinned against by `managedCliProviders.spec.ts`. So a
+ * typo can be rejected with the real options, rather than sent to the daemon to
+ * come back as an opaque refusal.
+ */
+class HarnessesInstall extends base_command_1.BaseCommand {
+    static description = 'Install a managed coding-agent CLI (claude, codex, devin, …) on one of your machines';
+    static examples = [
+        '<%= config.bin %> harnesses install devin',
+        '<%= config.bin %> harnesses install codex --daemon daemon_07c086e3c249_cli_default',
+    ];
+    static args = {
+        provider: core_1.Args.string({
+            ignoreStdin: true,
+            required: true,
+            description: `Which CLI to install (${data_provider_1.MANAGED_CLI_PROVIDER_IDS.join(', ')})`,
+        }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+        daemon: core_1.Flags.string({
+            description: 'Which machine to install on. Defaults to your only active daemon; required when several are active.',
+        }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(HarnessesInstall);
+        // Case-insensitive, and every accepted spelling of the first-party harness
+        // resolves to its canonical id — the same normalization the route applies.
+        const provider = (0, data_provider_1.normalizeManagedCliProvider)(args.provider);
+        if (!provider) {
+            this.error(`"${args.provider}" is not a managed CLI provider. Installable: ${data_provider_1.MANAGED_CLI_PROVIDER_IDS.join(', ')}.`, { exit: 2 });
+            return;
+        }
+        const target = await (0, daemon_target_1.resolveDaemonTarget)({
+            explicit: flags.daemon,
+            local: (0, daemon_target_1.localMachine)(),
+            listActiveDaemons: () => (0, daemon_target_1.listActiveDaemons)(this.resolvedCredential),
+        });
+        const daemonId = this.daemonIdFor(target);
+        let start;
+        try {
+            start = await (0, cli_installers_1.startManagedCliInstall)(daemonId, provider, this.resolvedCredential);
+        }
+        catch (err) {
+            this.handleApiError(err);
+            return;
+        }
+        const jobId = start.job?.id;
+        if (!start.started || !jobId) {
+            // The daemon declined and already knows why. Read its own reason off the
+            // provider state rather than inventing an explanation for the silence —
+            // "Already installed." and "Not available on this platform." want very
+            // different responses, and a generic "install failed" hides both.
+            const reason = start.provider?.installDisabledReason?.trim() ||
+                (await this.installerNote(daemonId, provider));
+            this.log(reason ? `${provider}: ${reason}` : `${provider}: the daemon started no install job.`);
+            return;
+        }
+        if (!flags.json)
+            this.logToStderr(`Installing ${provider} on ${(0, daemon_ref_1.formatDaemonRef)(daemonId)}…`);
+        const outcome = await (0, cli_installers_1.followManagedCliInstallJob)({
+            daemonId,
+            jobId,
+            credential: this.resolvedCredential,
+            onLogLine: flags.json ? undefined : (line) => this.logToStderr(`  ${line}`),
+        });
+        if (outcome.kind === 'missing') {
+            this.error(`The daemon no longer has install job ${jobId}.`, { exit: 1 });
+            return;
+        }
+        if (outcome.kind === 'timeout') {
+            // Not a failure: the daemon is still working, and calling this failed
+            // would send someone to debug a download that is going fine.
+            this.error(`Still installing after ${Math.round(cli_installers_1.INSTALL_MAX_WAIT_MS / 60000)} minutes — the daemon is still working on job ${jobId}. Check \`${this.config.bin} harnesses installers\` in a while.`, { exit: 1 });
+            return;
+        }
+        const job = outcome.job;
+        if (flags.json) {
+            this.log(JSON.stringify({ daemonId, provider, job }, null, 2));
+            if (job.status !== 'succeeded')
+                process.exitCode = 1;
+            return;
+        }
+        if (job.status === 'failed') {
+            this.error(`Installing ${provider} failed: ${job.error || 'the daemon gave no reason.'}`, {
+                exit: 1,
+            });
+            return;
+        }
+        // Report the state the install actually produced, not "done". Installing a
+        // binary is not the same as being able to run it: Devin lands
+        // `interactive-required`, and a user told only "installed" would find that
+        // out on their first turn instead.
+        const state = await this.installerNote(daemonId, provider, true);
+        this.log(`${provider} installed.${state ? ` ${state}` : ''}`);
+    }
+    /** What the daemon says about this provider right now, best effort. */
+    async installerNote(daemonId, provider, readiness = false) {
+        try {
+            const res = await (0, cli_installers_1.listCliInstallers)(daemonId, this.resolvedCredential);
+            const row = (res.providers ?? []).find((p) => (0, data_provider_1.normalizeManagedCliProvider)(p.provider) === provider);
+            if (!row)
+                return null;
+            if (readiness) {
+                const verdict = (0, cli_installers_1.readinessOf)(row);
+                return `${verdict.label}: ${verdict.detail}`;
+            }
+            const reason = row.installDisabledReason?.trim();
+            if (!reason)
+                return null;
+            return row.version ? `${reason} (${row.version})` : reason;
+        }
+        catch {
+            return null;
+        }
+    }
+    daemonIdFor(target) {
+        if (target.kind === 'daemon')
+            return target.daemonId;
+        if (target.kind === 'this-machine') {
+            if (target.daemonId)
+                return target.daemonId;
+            this.error('This machine is a Dedicated Runtime whose daemon has not published an id this process can read. Name a machine with --daemon.', { exit: 1 });
+        }
+        if (target.kind === 'none') {
+            this.error(`No active daemon is registered for this account, so nothing can perform the install. Start the local runtime with \`${this.config.bin} daemon start\`.`, { exit: 1 });
+        }
+        const choices = target.daemons
+            .slice(0, 10)
+            .map((d) => `  ${(0, daemon_ref_1.formatDaemonRef)(d.id)}  ${d.name || '—'}`)
+            .join('\n');
+        this.error(`${target.daemons.length} active daemons — say which machine to install on:\n${choices}\n` +
+            `Pass one with --daemon, or see them all with \`${this.config.bin} list-daemons\`.`, { exit: 1 });
+    }
+}
+exports.default = HarnessesInstall;

package/dist/commands/harnesses/installers.d.ts

@@ -0,0 +1,45 @@
+import { BaseCommand } from '../../base-command';
+/**
+ * What each managed provider's state is on one machine.
+ *
+ * ## Why this command exists
+ *
+ * `d878b79581` replaced "is the binary there" with four states — installed,
+ * ready, interactive-required, headless-key-required — and routed them from
+ * `cli-installers` through health to the web harness create modal. It reached
+ * exactly one surface. From the CLI there was no way to ask.
+ *
+ * That gap is not cosmetic, because `skrr harnesses list` answers a DIFFERENT
+ * question and looks like it answers this one. Its `status` is the daemon's
+ * socket, so on this account `skrr-code` read `online` with no binary installed
+ * at all, and `harnesses ping` answered it in 78ms — the daemon was there, the
+ * harness was not. A user could not discover that from inside the product; it
+ * took `command -v` in a shell.
+ *
+ * So this prints what the DAEMON says about each provider: whether the binary
+ * is present, which one and where, and whether it is signed in. The four states
+ * keep their server-side names here rather than being re-prosed, so that a
+ * message quoted from the CLI matches the one in the modal.
+ *
+ * `unknown` is a first-class answer and is not `ready`. A provider whose recipe
+ * declares no credential resolver genuinely cannot be assessed from here, and
+ * saying so is the point — the failure this whole vocabulary exists to prevent
+ * is a surface that reports ready for a harness that will refuse on first use.
+ */
+export default class HarnessesInstallers extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        daemon: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+    /**
+     * Refuse rather than guess which machine to report on.
+     *
+     * Reading is harmless, but naming the wrong machine is not: the whole value
+     * here is "is the thing on MY laptop usable", and an answer about a sandbox
+     * the user forgot about is worse than no answer, because it looks like one.
+     */
+    private daemonIdFor;
+}

package/dist/commands/harnesses/installers.js

@@ -0,0 +1,155 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const cli_installers_1 = require("../../lib/cli-installers");
+const daemon_ref_1 = require("../../lib/daemon-ref");
+const daemon_target_1 = require("../../lib/daemon-target");
+const format_1 = require("../../lib/format");
+/**
+ * What each managed provider's state is on one machine.
+ *
+ * ## Why this command exists
+ *
+ * `d878b79581` replaced "is the binary there" with four states — installed,
+ * ready, interactive-required, headless-key-required — and routed them from
+ * `cli-installers` through health to the web harness create modal. It reached
+ * exactly one surface. From the CLI there was no way to ask.
+ *
+ * That gap is not cosmetic, because `skrr harnesses list` answers a DIFFERENT
+ * question and looks like it answers this one. Its `status` is the daemon's
+ * socket, so on this account `skrr-code` read `online` with no binary installed
+ * at all, and `harnesses ping` answered it in 78ms — the daemon was there, the
+ * harness was not. A user could not discover that from inside the product; it
+ * took `command -v` in a shell.
+ *
+ * So this prints what the DAEMON says about each provider: whether the binary
+ * is present, which one and where, and whether it is signed in. The four states
+ * keep their server-side names here rather than being re-prosed, so that a
+ * message quoted from the CLI matches the one in the modal.
+ *
+ * `unknown` is a first-class answer and is not `ready`. A provider whose recipe
+ * declares no credential resolver genuinely cannot be assessed from here, and
+ * saying so is the point — the failure this whole vocabulary exists to prevent
+ * is a surface that reports ready for a harness that will refuse on first use.
+ */
+class HarnessesInstallers extends base_command_1.BaseCommand {
+    static description = 'What each managed coding-agent CLI looks like on one machine — installed, which version, where, and whether it is signed in';
+    static examples = [
+        '<%= config.bin %> harnesses installers',
+        '<%= config.bin %> harnesses installers --daemon daemon_07c086e3c249_cli_default',
+        '<%= config.bin %> harnesses installers --json',
+    ];
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+        daemon: core_1.Flags.string({
+            description: 'Which machine to ask. Defaults to your only active daemon; required when several are active.',
+        }),
+    };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(HarnessesInstallers);
+        const target = await (0, daemon_target_1.resolveDaemonTarget)({
+            explicit: flags.daemon,
+            local: (0, daemon_target_1.localMachine)(),
+            listActiveDaemons: () => (0, daemon_target_1.listActiveDaemons)(this.resolvedCredential),
+        });
+        const daemonId = this.daemonIdFor(target);
+        let res;
+        try {
+            res = await (0, cli_installers_1.listCliInstallers)(daemonId, this.resolvedCredential);
+        }
+        catch (err) {
+            this.handleApiError(err);
+            return;
+        }
+        const providers = res.providers ?? [];
+        if (flags.json) {
+            this.log(JSON.stringify({ daemonId, platform: res.platform, providers }, null, 2));
+            return;
+        }
+        if (providers.length === 0) {
+            // A daemon too old to carry the inventory answers with no providers. That
+            // is not "you have none" — say which it is, since the remedy differs.
+            this.log(`The daemon ${daemonId} returned no installer inventory. ` +
+                'It may predate managed CLI installers — update the skrr app or run `skrr daemon restart`.');
+            return;
+        }
+        // The RAW id, not `formatDaemonRef`. This header identifies which machine
+        // the answer is about, and the id is what the reader pastes back into
+        // `--daemon`; an 8-character prefix of a `daemon_<hash>_<source>_<profile>`
+        // id is `d_daemon_0...`, which distinguishes nothing and cannot be pasted.
+        this.log(`Managed coding-agent CLIs on ${daemonId} (${res.platform ?? '?'}, daemon ${res.daemonVersion ?? 'version not reported'})`);
+        this.log('');
+        (0, format_1.renderTable)(providers.map((p) => {
+            const readiness = (0, cli_installers_1.readinessOf)(p);
+            return {
+                provider: (0, format_1.formatCell)(p.provider),
+                readiness: readiness.label,
+                version: (0, format_1.formatCell)(p.version),
+                where: p.resolvedPath ?? '-',
+            };
+        }), [
+            { key: 'provider', header: 'PROVIDER' },
+            { key: 'readiness', header: 'READINESS' },
+            { key: 'version', header: 'VERSION' },
+            // Verbatim and UNCLIPPED. The resolved path answers "which copy is it
+            // using", and the cases where that matters are exactly the long ones:
+            // Devin's CLI lives at
+            // /Applications/Devin.app/Contents/Resources/app/extensions/windsurf/devin/bin/devin
+            // and is never on PATH, so `command -v devin` says it is not installed.
+            // Clipping from the right would hide the binary name and keep the
+            // surprise this column exists to reveal.
+            { key: 'where', header: 'RESOLVED PATH', verbatim: true },
+        ], (line) => this.log(`  ${line}`));
+        // The detail lines carry the daemon's own wording. Printing them under the
+        // table rather than in a column keeps a full sentence readable — these are
+        // instructions ("Run `devin auth login`"), not statuses.
+        const notes = providers
+            .map((p) => ({ provider: p.provider, ...(0, cli_installers_1.readinessOf)(p) }))
+            .filter((n) => !n.ok && n.detail);
+        if (notes.length > 0) {
+            this.log('');
+            for (const note of notes)
+                this.log(`  ${note.provider}: ${note.detail}`);
+        }
+        // A provider the platform knows and this daemon did not mention. Without
+        // this it simply is not on the list, which reads as dropped support rather
+        // than as an older daemon — `devin` arrived in daemon 0.8.43, so 0.8.35
+        // answers with six providers and says nothing about the seventh.
+        const missing = (0, cli_installers_1.providersNotOffered)(providers, data_provider_1.MANAGED_CLI_PROVIDER_IDS);
+        if (missing.length > 0) {
+            this.log('');
+            this.log(`  Not offered by this daemon: ${missing.join(', ')}. ` +
+                'That usually means the daemon is older than the provider — ' +
+                'check `skrr daemon status` for its version and how to update it.');
+        }
+    }
+    /**
+     * Refuse rather than guess which machine to report on.
+     *
+     * Reading is harmless, but naming the wrong machine is not: the whole value
+     * here is "is the thing on MY laptop usable", and an answer about a sandbox
+     * the user forgot about is worse than no answer, because it looks like one.
+     */
+    daemonIdFor(target) {
+        if (target.kind === 'daemon')
+            return target.daemonId;
+        if (target.kind === 'this-machine') {
+            if (target.daemonId)
+                return target.daemonId;
+            this.error('This machine is a Dedicated Runtime whose daemon has not published an id this process can read. Name a machine with --daemon.', { exit: 1 });
+        }
+        if (target.kind === 'none') {
+            this.error(`No active daemon is registered for this account, so nothing can report on it. Start the local runtime with \`${this.config.bin} daemon start\`.`, { exit: 1 });
+        }
+        const choices = target.daemons
+            .slice(0, 10)
+            .map((d) => `  ${(0, daemon_ref_1.formatDaemonRef)(d.id)}  ${d.name || '—'}`)
+            .join('\n');
+        this.error(`${target.daemons.length} active daemons — say which machine to report on:\n${choices}\n` +
+            `Pass one with --daemon, or see them all with \`${this.config.bin} list-daemons\`.`, { exit: 1 });
+    }
+}
+exports.default = HarnessesInstallers;

package/dist/commands/harnesses/list.d.ts

@@ -18,7 +18,68 @@ export type HarnessRow = {
         machineProduct?: string;
         source?: string;
     };
+    /**
+     * The name everyone else sees, when YOUR alias is covering it.
+     *
+     * `name` is the effective one. Two commands write a harness's name and mean
+     * different things — `harnesses alias` sets yours, `harnesses update --name`
+     * sets the shared one — and the server used to overwrite `name` with the
+     * alias, so the shared value was unobservable to the person who wrote it.
+     * Present only when an alias is actually shadowing something.
+     */
+    sharedName?: string;
+    aliased?: boolean;
+    /**
+     * A later registration of the same provider on the same machine replaced this
+     * row, so it will never come back online. The server derives it (one rule, in
+     * `MachineService`); this type must carry it or the column silently reports
+     * `offline` for a row `machines show` calls `superseded` — and those two ask
+     * the reader for opposite actions.
+     */
+    superseded?: boolean;
 };
+/**
+ * Products skrr provisions and owns. A row that says it is one of these is
+ * cloud, whatever `harnessLocation` reads.
+ */
+/**
+ * An 8-character machine label that is still a machine.
+ *
+ * `machineUuid` is only a bare uuid when the row's identity kind is
+ * `machine-uuid`. The other kinds carry a PREFIXED value —
+ * `dedicated-runtime:rtl_…`, `hosted-machine:…` — so a blind `.slice(0, 8)`
+ * printed the literal word `dedicate` for every dedicated runtime, identically,
+ * across machines that had nothing to do with each other. Keeping the tail is
+ * what makes the column distinguish anything: the prefix is the part every row
+ * of that kind shares.
+ */
+export declare function shortMachineLabel(machineUuid?: string): string;
+/**
+ * What to say when the table would be empty.
+ *
+ * A `--provider` filter that matched nothing is not evidence about the daemon.
+ * The old copy asked "Is your daemon connected?" regardless, which sent a user
+ * to debug a connection they had just listed six online rows from — and read
+ * identically for `--provider devin` (a real provider with no row here) and
+ * `--provider bogus-xyz` (a typo).
+ *
+ * The provider set is OPEN — a daemon registers a row per capability it
+ * detects — so a typo cannot honestly be rejected up front. But it can be told
+ * apart from an empty account, by naming the filter that did the excluding and
+ * pointing at the one command that shows which providers actually exist.
+ */
+export declare function emptyListMessage(input: {
+    provider: string | null;
+    local: boolean;
+}): string;
+/**
+ * What the DEFAULT column says for one row.
+ *
+ * Names the SCOPE rather than printing a bare marker, because a workspace
+ * default suppresses a user one — so "mine is set and nothing changed" is a
+ * real state, and a column that only said "yes" could not explain it.
+ */
+export declare function defaultMarker(harnessId: string, defaults: HarnessDefaults): string;
 export type HarnessSelection = {
     /** Rows to print, after every filter and the `--limit` slice. */
     visible: HarnessRow[];
@@ -96,9 +157,29 @@ export type HarnessesFilters = {
     limit: number | null;
 };
 /** The exact object `skrr harnesses list --json` prints. */
+/**
+ * The default-harness block `GET /api/harnesses` already returns.
+ *
+ * `harnesses set-default` writes it and, until now, nothing in the CLI read it
+ * back: no column, no JSON field, and no `get-default` command. At
+ * `--scope workspace` — which the setter's own help says "affects every
+ * member" — that meant a user could change the default for everyone and then
+ * have no command that reports what it currently is.
+ *
+ * The scope matters as much as the id, because a workspace default SUPPRESSES a
+ * user one. Reporting only "which harness" would leave the more confusing case
+ * ("I set mine and it did not take effect") unexplained.
+ */
+export type HarnessDefaults = {
+    effectiveDefaultHarnessId?: string | null;
+    defaultHarnessScope?: 'user' | 'workspace' | null;
+    userDefaultHarnessId?: string | null;
+    workspaceDefaultHarnessId?: string | null;
+};
 export type HarnessesJson = {
     harnesses: HarnessRow[];
     filters: HarnessesFilters;
+    defaults: HarnessDefaults;
     counts: {
         /** `harnesses.length`. */
         returned: number;
@@ -132,7 +213,7 @@ export type HarnessesJson = {
  * (`compareHarnessRows`), not in server order. Round 1 introduced that sort;
  * it is deliberate, so `.harnesses[0]` is the row you almost always want.
  */
-export declare function buildHarnessesJson(selection: HarnessSelection, filters: HarnessesFilters): HarnessesJson;
+export declare function buildHarnessesJson(selection: HarnessSelection, filters: HarnessesFilters, defaults?: HarnessDefaults): HarnessesJson;
 /**
  * Rows with the provider in its CANONICAL spelling.
  *

package/dist/commands/harnesses/list.js

@@ -1,5 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.shortMachineLabel = shortMachineLabel;
+exports.emptyListMessage = emptyListMessage;
+exports.defaultMarker = defaultMarker;
 exports.isLocalHarnessRow = isLocalHarnessRow;
 exports.selectHarnessRows = selectHarnessRows;
 exports.buildHarnessesJson = buildHarnessesJson;
@@ -14,6 +17,67 @@ const harness_provider_input_1 = require("../../lib/harness-provider-input");
  * Products skrr provisions and owns. A row that says it is one of these is
  * cloud, whatever `harnessLocation` reads.
  */
+/**
+ * An 8-character machine label that is still a machine.
+ *
+ * `machineUuid` is only a bare uuid when the row's identity kind is
+ * `machine-uuid`. The other kinds carry a PREFIXED value —
+ * `dedicated-runtime:rtl_…`, `hosted-machine:…` — so a blind `.slice(0, 8)`
+ * printed the literal word `dedicate` for every dedicated runtime, identically,
+ * across machines that had nothing to do with each other. Keeping the tail is
+ * what makes the column distinguish anything: the prefix is the part every row
+ * of that kind shares.
+ */
+function shortMachineLabel(machineUuid) {
+    if (!machineUuid)
+        return '-';
+    const separator = machineUuid.indexOf(':');
+    const identifier = separator === -1 ? machineUuid : machineUuid.slice(separator + 1);
+    return identifier.slice(0, 8) || '-';
+}
+/**
+ * What to say when the table would be empty.
+ *
+ * A `--provider` filter that matched nothing is not evidence about the daemon.
+ * The old copy asked "Is your daemon connected?" regardless, which sent a user
+ * to debug a connection they had just listed six online rows from — and read
+ * identically for `--provider devin` (a real provider with no row here) and
+ * `--provider bogus-xyz` (a typo).
+ *
+ * The provider set is OPEN — a daemon registers a row per capability it
+ * detects — so a typo cannot honestly be rejected up front. But it can be told
+ * apart from an empty account, by naming the filter that did the excluding and
+ * pointing at the one command that shows which providers actually exist.
+ */
+function emptyListMessage(input) {
+    const hiddenByDefault = input.local
+        ? ' Offline rows are hidden by default (--all shows them) and hosted rows are excluded (--no-local includes them).'
+        : '';
+    if (input.provider) {
+        return (`No harnesses with provider "${input.provider}".${hiddenByDefault}` +
+            ' Run `skrr harnesses list --all` without --provider to see which providers this account has registered.');
+    }
+    return input.local
+        ? `No harnesses found. Is your daemon connected?${hiddenByDefault}`
+        : 'No harnesses found.';
+}
+/**
+ * What the DEFAULT column says for one row.
+ *
+ * Names the SCOPE rather than printing a bare marker, because a workspace
+ * default suppresses a user one — so "mine is set and nothing changed" is a
+ * real state, and a column that only said "yes" could not explain it.
+ */
+function defaultMarker(harnessId, defaults) {
+    if (defaults.effectiveDefaultHarnessId === harnessId) {
+        return defaults.defaultHarnessScope === 'workspace' ? 'workspace' : 'you';
+    }
+    // Set by this user, but a workspace default is winning. Saying so here is the
+    // only place a user finds out why their own choice is not in effect.
+    if (defaults.userDefaultHarnessId === harnessId)
+        return 'you (overridden)';
+    return '-';
+}
 const MANAGED_MACHINE_PRODUCTS = new Set(['hosted-machine', 'hosted-job-machine']);
 const MANAGED_REGISTRATION_SOURCES = new Set([
     'hosted-machine',
@@ -114,10 +178,16 @@ function selectHarnessRows(rows, options) {
  * (`compareHarnessRows`), not in server order. Round 1 introduced that sort;
  * it is deliberate, so `.harnesses[0]` is the row you almost always want.
  */
-function buildHarnessesJson(selection, filters) {
+function buildHarnessesJson(selection, filters, defaults = {}) {
     return {
         harnesses: selection.visible,
         filters,
+        defaults: {
+            effectiveDefaultHarnessId: defaults.effectiveDefaultHarnessId ?? null,
+            defaultHarnessScope: defaults.defaultHarnessScope ?? null,
+            userDefaultHarnessId: defaults.userDefaultHarnessId ?? null,
+            workspaceDefaultHarnessId: defaults.workspaceDefaultHarnessId ?? null,
+        },
         counts: {
             returned: selection.visible.length,
             matched: selection.matched,
@@ -167,7 +237,13 @@ function lastSeenMs(row) {
  * previously undiscoverable.
  */
 class HarnessesList extends base_command_1.BaseCommand {
-    static description = `List your harnesses — your local Claude Code, Codex, ${auth_core_1.FIRST_PARTY_HARNESS.displayName}, one row per (machine, provider). The id here is what \`agents attach-harness\` pins. Online only unless --all.`;
+    // Deliberately NOT an enumeration. The provider set is open — a daemon
+    // registers a row per capability it detects, so this account carries `hermes`
+    // and `gemini` rows that appear in no hand-written list in this package, while
+    // every list that was written omitted `devin` and `goose`. A subset printed as
+    // if it were the set is the drift root `CLAUDE.md` names: "a second
+    // declaration is how a surface silently drifts".
+    static description = 'List your harnesses — your local coding agents, one row per (machine, provider). The id here is what `agents attach-harness` pins. Online only unless --all.';
     static examples = [
         '<%= config.bin %> harnesses list',
         '<%= config.bin %> harnesses list --provider claude',
@@ -190,7 +266,12 @@ class HarnessesList extends base_command_1.BaseCommand {
             exclusive: ['status', 'online'],
         }),
         provider: core_1.Flags.string({
-            description: `Filter by provider (e.g. claude, codex, opencode, openclaw, ${auth_core_1.FIRST_PARTY_HARNESS.provider}).`,
+            // Two examples, not a set. One of them is the first-party harness under
+            // its CANONICAL spelling, which `harness-provider-input.spec.ts` pins so
+            // help can never teach a retired one — but the old text read as an
+            // enumeration and omitted `devin`, `goose`, `hermes` and `gemini`, all of
+            // which are real values of this flag.
+            description: `Filter by provider, e.g. claude or ${auth_core_1.FIRST_PARTY_HARNESS.provider}. The PROVIDER column lists what this machine actually registered; it is wider than these examples.`,
         }),
         daemon: core_1.Flags.string({
             description: 'Filter by daemon id, matching any substring — e.g. the machine hash in daemon_<hash>_<source>_<profile>.',
@@ -222,9 +303,7 @@ class HarnessesList extends base_command_1.BaseCommand {
         const query = params.toString() ? `?${params.toString()}` : '';
         let res;
         try {
-            res = await (0, api_fetch_1.apiFetch)(`/api/harnesses${query}`, {
-                credential: this.resolvedCredential,
-            });
+            res = await (0, api_fetch_1.apiFetch)(`/api/harnesses${query}`, { credential: this.resolvedCredential });
         }
         catch (err) {
             this.handleApiError(err);
@@ -242,7 +321,7 @@ class HarnessesList extends base_command_1.BaseCommand {
                 provider: provider ?? null,
                 daemon: flags.daemon ?? null,
                 limit: flags.limit ?? null,
-            });
+            }, res);
             this.log(JSON.stringify(payload, null, 2));
             return;
         }
@@ -263,21 +342,27 @@ class HarnessesList extends base_command_1.BaseCommand {
                 this.log(`No harnesses match the default filters. Hidden: ${hidden.join(', ')}.`);
                 return;
             }
-            this.log(flags.local
-                ? 'No harnesses found. Is your daemon connected? Offline rows are hidden by default (--all shows them) and hosted rows are excluded (--no-local includes them).'
-                : 'No harnesses found.');
+            this.log(emptyListMessage({ provider: provider ?? null, local: flags.local }));
             return;
         }
         const tableRows = selection.visible.map((r) => ({
             id: (0, format_1.formatCell)(r._id),
             name: (0, format_1.formatCell)(r.name),
             provider: (0, format_1.formatCell)(r.provider),
-            status: (0, format_1.formatCell)(r.status),
+            status: r.superseded ? 'superseded' : (0, format_1.formatCell)(r.status),
+            default: defaultMarker(r._id, res),
             daemon: (0, format_1.formatCell)(r.daemonId),
             model: (0, format_1.formatCell)(r.model),
-            machine: r.machineUuid ? r.machineUuid.slice(0, 8) : '-',
+            machine: shortMachineLabel(r.machineUuid),
             seen: (0, format_1.localStamp)(r.lastSeenAt),
         }));
+        // `machines list` reports a fraction like `6/7` whose denominator counts
+        // LIVE rows — every row minus the ones a later registration replaced. From
+        // this table that number was underivable: ~60 rows printed for one machine
+        // and nothing on screen added up to 7, with the reconciling sentence living
+        // only inside a third command (`machines show`). Now that the server labels
+        // supersession here too, say it where the rows are.
+        const supersededShown = selection.visible.filter((r) => r.superseded).length;
         (0, format_1.renderTable)(tableRows, [
             { key: 'id', header: 'HARNESS ID' },
             // `harnesses alias` exists to make a row recognisable in a LIST. Without
@@ -286,11 +371,18 @@ class HarnessesList extends base_command_1.BaseCommand {
             { key: 'name', header: 'NAME', maxWidth: 22 },
             { key: 'provider', header: 'PROVIDER' },
             { key: 'status', header: 'STATUS' },
+            // `set-default` had no reader anywhere in the CLI. This is it.
+            { key: 'default', header: 'DEFAULT' },
             { key: 'daemon', header: 'DAEMON ID', verbatim: true },
             { key: 'model', header: 'MODEL', maxWidth: 28 },
             { key: 'machine', header: 'MACHINE' },
             { key: 'seen', header: `LAST SEEN (${(0, format_1.localZone)()})` },
         ], (line) => this.log(line));
+        if (supersededShown > 0) {
+            // This is the sentence that makes `machines list`'s fraction derivable
+            // from here: live = printed − superseded.
+            this.log(`(${supersededShown} of ${selection.visible.length} shown are superseded — a later registration on the same machine replaced them, so they will not come back. ${selection.visible.length - supersededShown} live.)`);
+        }
         if (selection.hiddenByLocal > 0) {
             // Same reason as the JSON `counts` block: the `--local` default is the
             // single biggest source of "the list is shorter than I expected".