@skrr-ai/cli 0.1.37 → 0.1.39

package/dist/commands/followups/act.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const followups_1 = require("../../lib/followups");
 const agent_resolver_1 = require("../../lib/agent-resolver");
@@ -12,13 +13,13 @@ const triggers_1 = require("../../lib/triggers");
 class FollowupsAct extends base_command_1.BaseCommand {
     static description = 'Run an agreed action at a time — the act follow-up';
     static examples = [
-        '<%= config.bin %> followups act --subject task:OSK-42 --why "user approved the merge" --action \'{"builtinType":"task_merge","config":{"taskId":"OSK-42"}}\' --at 2026-09-20T09:00:00Z',
+        '<%= config.bin %> followups act --subject task:OSK-42 --why "user approved the merge" --action \'{"builtinType":"task_mark_done","config":{"taskId":"OSK-42"}}\' --at 2026-09-20T09:00:00Z',
     ];
     static flags = {
         subject: core_1.Flags.string({ description: 'Subject ref: type:externalKey', required: true }),
         why: core_1.Flags.string({ description: 'Why this wake exists, in one line', required: true }),
         action: core_1.Flags.string({
-            description: 'Action payload JSON: {"builtinType": "...", "config": {...}, "refId?": "..."}',
+            description: `Action payload JSON: {"builtinType": "...", "config": {...}, "refId?": "..."}. builtinType is one of: ${data_provider_1.BUILTIN_ACTION_TYPES.join(', ')}`,
             required: true,
         }),
         at: core_1.Flags.string({ description: 'ISO-8601 instant to act at', exclusive: ['in'] }),

package/dist/commands/followups/cancel.d.ts

@@ -1,11 +1,14 @@
 import { BaseCommand } from '../../base-command';
 /**
- * `skrr followups cancel <id>` — abandon a follow-up. If the wait already
- * paid off, say so instead (`resolve --outcome resolved`): the audit keeps
- * the difference.
+ * `skrr followups cancel <id>` — "never mind". It records exactly what
+ * `resolve --outcome abandoned` records (terminal `abandoned`, the reason as
+ * the note); it exists so calling one off does not require knowing the
+ * terminal vocabulary. Neither help text used to say so, and a user had to
+ * read the service to choose between them (OSK-9679).
  */
 export default class FollowupsCancel extends BaseCommand {
     static description: string;
+    static examples: string[];
     static args: {
         id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
     };

package/dist/commands/followups/cancel.js

@@ -4,17 +4,27 @@ const core_1 = require("@oclif/core");
 const base_command_1 = require("../../base-command");
 const followups_1 = require("../../lib/followups");
 /**
- * `skrr followups cancel <id>` — abandon a follow-up. If the wait already
- * paid off, say so instead (`resolve --outcome resolved`): the audit keeps
- * the difference.
+ * `skrr followups cancel <id>` — "never mind". It records exactly what
+ * `resolve --outcome abandoned` records (terminal `abandoned`, the reason as
+ * the note); it exists so calling one off does not require knowing the
+ * terminal vocabulary. Neither help text used to say so, and a user had to
+ * read the service to choose between them (OSK-9679).
  */
 class FollowupsCancel extends base_command_1.BaseCommand {
-    static description = 'Abandon a follow-up';
+    static description = 'Call off a follow-up you no longer want (same record as resolve --outcome abandoned)';
+    static examples = [
+        '<%= config.bin %> followups cancel fu_abc',
+        '<%= config.bin %> followups cancel fu_abc --reason "handled it by hand"',
+        '# If what you were waiting for happened, record that instead:',
+        '<%= config.bin %> followups resolve fu_abc --outcome resolved',
+    ];
     static args = {
-        id: core_1.Args.string({ description: 'Follow-up (trigger) id', required: true, ignoreStdin: true }),
+        id: followups_1.followUpIdArg,
     };
     static flags = {
-        reason: core_1.Flags.string({ description: 'Why it is being cancelled' }),
+        reason: core_1.Flags.string({
+            description: 'Why it is being called off — stored as the note (default: "cancelled")',
+        }),
         json: core_1.Flags.boolean({ description: 'Output as JSON' }),
     };
     async run() {

package/dist/commands/followups/observability.d.ts

@@ -0,0 +1,23 @@
+import { BaseCommand } from '../../base-command';
+/**
+ * `skrr followups observability` — how follow-ups are doing, per (agent, kind).
+ *
+ * `list` answers "what is still owed", one row per follow-up. This answers the
+ * question a page of rows cannot: how many were created, how they ended, how
+ * often they escalated, today's budget, and how often a check-in chose to stay
+ * quiet. The API served this rollup from the day the service shipped and no
+ * command reached it (OSK-9678).
+ *
+ * Scope follows `list`: one agent by default (the session's, or `--agent`),
+ * every agent only with `--all-agents`.
+ */
+export default class FollowupsObservability extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        agent: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'all-agents': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/followups/observability.js

@@ -0,0 +1,114 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const format_1 = require("../../lib/format");
+const followups_1 = require("../../lib/followups");
+const agent_resolver_1 = require("../../lib/agent-resolver");
+const rate = (value) => value === null ? '—' : `${Math.round(value * 100)}%`;
+/** `resolved 3 · abandoned 1` — the outcomes that happened, not five zeros. */
+const outcomes = (terminal) => Object.entries(terminal)
+    .filter(([, count]) => count > 0)
+    .map(([outcome, count]) => `${outcome} ${count}`)
+    .join(' · ') || '—';
+/**
+ * `skrr followups observability` — how follow-ups are doing, per (agent, kind).
+ *
+ * `list` answers "what is still owed", one row per follow-up. This answers the
+ * question a page of rows cannot: how many were created, how they ended, how
+ * often they escalated, today's budget, and how often a check-in chose to stay
+ * quiet. The API served this rollup from the day the service shipped and no
+ * command reached it (OSK-9678).
+ *
+ * Scope follows `list`: one agent by default (the session's, or `--agent`),
+ * every agent only with `--all-agents`.
+ */
+class FollowupsObservability extends base_command_1.BaseCommand {
+    static description = 'Per-agent, per-kind rollup — created, outcomes, escalation, budget, check-in silence';
+    static examples = [
+        '<%= config.bin %> followups observability',
+        '<%= config.bin %> followups observability --agent agent_1',
+        '<%= config.bin %> followups observability --all-agents --json',
+    ];
+    static flags = {
+        agent: core_1.Flags.string({
+            description: 'Agent ID (default: bound session agent)',
+            exclusive: ['all-agents'],
+        }),
+        'all-agents': core_1.Flags.boolean({
+            description: 'Roll up every agent — the human view',
+            exclusive: ['agent'],
+            default: false,
+        }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(FollowupsObservability);
+        let agentId;
+        if (!flags['all-agents']) {
+            try {
+                agentId = (0, followups_1.resolveFollowUpAgent)(flags.agent).id;
+            }
+            catch (err) {
+                const failure = (0, agent_resolver_1.agentResolutionFailure)(err);
+                this.failWithCliError({
+                    message: failure.message,
+                    code: failure.code,
+                    exit: 2,
+                    retryable: false,
+                    details: { suggestion: failure.suggestion, context: failure.details },
+                });
+            }
+        }
+        let report;
+        try {
+            report = await followups_1.followupsApi.observability(agentId ? { agentId } : {});
+        }
+        catch (err) {
+            this.handleApiError(err);
+            return;
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(report, null, 2));
+            return;
+        }
+        const agents = (report.agents ?? []).filter((agent) => agent.kinds.length > 0);
+        if (agents.length === 0) {
+            this.log('No follow-ups.');
+            return;
+        }
+        // One heading per agent rather than an AGENT column: an agent id repeated
+        // on every row pushed the table past any normal terminal width.
+        agents.forEach((agent, index) => {
+            if (index > 0)
+                this.log('');
+            this.log(agent.agentId === 'user' ? 'user (reminders with no agent)' : agent.agentId);
+            (0, format_1.renderTable)(agent.kinds.map((kind) => ({
+                kind: kind.kind,
+                created: String(kind.created),
+                open: String(kind.armed),
+                proposed: String(kind.proposed),
+                settled: String(kind.settled),
+                outcomes: outcomes(kind.terminal),
+                escalated: rate(kind.escalationRate),
+                fires: String(kind.fires),
+                budget: kind.budget ? `${kind.budget.used}/${kind.budget.limit ?? '∞'}` : '—',
+                silence: rate(kind.silenceRate),
+            })), [
+                { key: 'kind', header: 'KIND' },
+                { key: 'created', header: 'CREATED' },
+                { key: 'open', header: 'OPEN' },
+                { key: 'proposed', header: 'PROPOSED' },
+                { key: 'settled', header: 'SETTLED' },
+                { key: 'outcomes', header: 'OUTCOMES' },
+                { key: 'escalated', header: 'ESCALATED' },
+                { key: 'fires', header: 'FIRES' },
+                { key: 'budget', header: 'TODAY/LIMIT' },
+                { key: 'silence', header: 'SILENT' },
+            ], (line) => this.log(line));
+        });
+        this.log(`\nAs of ${report.generatedAt ?? 'now'}. TODAY/LIMIT is the daily budget (reminders are not metered); SILENT is how often a check-in chose to stay quiet.`);
+    }
+}
+exports.default = FollowupsObservability;

package/dist/commands/followups/reschedule.js

@@ -11,7 +11,7 @@ class FollowupsReschedule extends base_command_1.BaseCommand {
         '<%= config.bin %> followups reschedule fu_abc --at 2026-09-20T09:00:00Z',
     ];
     static args = {
-        id: core_1.Args.string({ description: 'Follow-up (trigger) id', required: true, ignoreStdin: true }),
+        id: followups_1.followUpIdArg,
     };
     static flags = {
         at: core_1.Flags.string({ description: 'New instant (ISO-8601)', exclusive: ['in'] }),

package/dist/commands/followups/resolve.js

@@ -13,13 +13,13 @@ const followups_1 = require("../../lib/followups");
  * are not accepted here.
  */
 class FollowupsResolve extends base_command_1.BaseCommand {
-    static description = 'Settle a follow-up with its honest outcome';
+    static description = 'Settle a follow-up with its honest outcome — resolved (it paid off) or abandoned (never mind; `cancel` is the shortcut)';
     static examples = [
         '<%= config.bin %> followups resolve fu_abc --outcome resolved --note "the deploy landed"',
-        '<%= config.bin %> followups resolve fu_abc --outcome abandoned',
+        '<%= config.bin %> followups resolve fu_abc --outcome abandoned --note "no longer needed"',
     ];
     static args = {
-        id: core_1.Args.string({ description: 'Follow-up (trigger) id', required: true, ignoreStdin: true }),
+        id: followups_1.followUpIdArg,
     };
     static flags = {
         outcome: core_1.Flags.string({

package/dist/commands/followups/show.js

@@ -7,7 +7,7 @@ const followups_1 = require("../../lib/followups");
 class FollowupsShow extends base_command_1.BaseCommand {
     static description = 'Show one follow-up';
     static args = {
-        id: core_1.Args.string({ description: 'Follow-up (trigger) id', required: true, ignoreStdin: true }),
+        id: followups_1.followUpIdArg,
     };
     static flags = {
         json: core_1.Flags.boolean({ description: 'Output as JSON' }),
@@ -30,6 +30,7 @@ class FollowupsShow extends base_command_1.BaseCommand {
         const row = response.followup;
         this.log((0, followups_1.followupSummaryLine)(row));
         for (const [label, value] of [
+            ['says', row.content],
             ['why', row.why],
             ['intent', row.intentKey],
             ['producer', row.producer],

package/dist/commands/followups/watch.js

@@ -23,9 +23,9 @@ const triggers_1 = require("../../lib/triggers");
 class FollowupsWatch extends base_command_1.BaseCommand {
     static description = 'Watch an asynchronous tail until it settles — the watch follow-up';
     static examples = [
-        '<%= config.bin %> followups watch --subject task:OSK-42 --why "deploy still running" --url https://ci.example.com/api/build/9 --until \'{"field":"status","eq":"done"}\' --deadline 6h',
-        '<%= config.bin %> followups watch --subject task:OSK-42 --why "pr review" --check "gh pr view 42 --json state" --success "state == MERGED" --abort "state == CLOSED" --wait event --wait-entity github --wait-event pull_request --wait-fallback 2h',
-        '<%= config.bin %> followups watch --subject conv:abc --why "vendor reply" --check "check inbox" --success "reply arrived" --abort "3 days" --wait clock --wait-at 2026-09-20T09:00:00Z',
+        '<%= config.bin %> followups watch --subject task:OSK-42 --why "deploy still running" --url https://ci.example.com/api/build/9 --until \'{"path":"status","op":"equals","value":"done"}\' --deadline 6h',
+        '<%= config.bin %> followups watch --subject task:OSK-42 --why "pr review" --check "gh pr view 42 --json state" --success "state == MERGED" --abort "state == CLOSED" --wait event --wait-entity github --wait-event pull_request_merged --wait-fallback 2h',
+        '<%= config.bin %> followups watch --subject conversation:abc --why "vendor reply" --check "check inbox" --success "reply arrived" --abort "3 days" --wait clock --wait-at 2026-09-20T09:00:00Z',
     ];
     static flags = {
         subject: core_1.Flags.string({ description: 'Subject ref: type:externalKey', required: true }),
@@ -33,7 +33,9 @@ class FollowupsWatch extends base_command_1.BaseCommand {
         agent: core_1.Flags.string({ description: 'Agent ID (default: bound session agent)' }),
         // predicate form
         url: core_1.Flags.string({ description: 'HTTPS endpoint to observe (predicate form)' }),
-        until: core_1.Flags.string({ description: 'Predicate tree as JSON (predicate form)' }),
+        until: core_1.Flags.string({
+            description: 'Predicate tree as JSON (predicate form): a leaf {"path","op","value"} or {"all"|"any": [...]}. op is equals, not_equals, contains, starts_with, in, gt, lt, exists, … — an unknown op is refused with the full list',
+        }),
         grant: core_1.Flags.string({ description: 'Grant id supplying the watch credentials' }),
         deadline: core_1.Flags.string({ description: 'When the watch must stop (predicate form, required)' }),
         'check-every': core_1.Flags.string({ description: 'Observation interval (predicate form)' }),
@@ -59,7 +61,9 @@ class FollowupsWatch extends base_command_1.BaseCommand {
         'wait-filter-value': core_1.Flags.string({ description: 'Event filter value' }),
         'wait-interval-seconds': core_1.Flags.integer({ description: 'Poll interval for --wait poll_until' }),
         'wait-max-attempts': core_1.Flags.integer({ description: 'Attempt cap for --wait poll_until' }),
-        'wait-fallback': core_1.Flags.string({ description: 'SLA backstop for --wait event/poll_until' }),
+        'wait-fallback': core_1.Flags.string({
+            description: 'SLA backstop — required for --wait event (an event may never arrive), optional for poll_until',
+        }),
         // delivery
         endpoint: core_1.Flags.string({ description: 'Delivery endpoint id (EndpointRegistry)' }),
         'endpoint-target': core_1.Flags.string({ description: 'Channel target for channel endpoints' }),

package/dist/commands/harnesses/forget.js

@@ -3,6 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
 const base_command_1 = require("../../base-command");
 const harnesses_1 = require("../../lib/harnesses");
+const api_fetch_1 = require("../../lib/api-fetch");
+const show_1 = require("./show");
 /**
  * Forget an harness — `forget`, not `delete`.
  *
@@ -26,6 +28,24 @@ class HarnessesForget extends base_command_1.BaseCommand {
     async run() {
         this.requireAuth();
         const { args, flags } = await this.parse(HarnessesForget);
+        // Refuse a reference that cannot name a harness BEFORE asking anything.
+        //
+        // The confirmation used to run first, so `harnesses forget notanid` asked
+        // whether to delete something that could never exist, and a scripted caller
+        // who added `--yes` to get past it then hit a second, different failure:
+        // a bare `Invalid harness ID / HTTP_400` from the server. Two round trips
+        // for one typo, on the command where a typo matters most.
+        //
+        // The sibling `harnesses show` already explains this class of mistake
+        // (`describeWrongHarnessRef` names which KIND of id you passed and which
+        // command takes it). `forget` is the DESTRUCTIVE one and had the worse
+        // message; it now shares the explanation.
+        if (!/^[0-9a-f]{24}$/i.test(args.harness.trim())) {
+            this.error(`Not a harness id: ${args.harness}\n${(0, show_1.describeWrongHarnessRef)(args.harness)}`, {
+                exit: 1,
+            });
+            return;
+        }
         // Name it before removing it. An id alone does not tell the operator which
         // of their machines they are about to drop from the fleet.
         if (!flags.yes) {
@@ -52,6 +72,14 @@ class HarnessesForget extends base_command_1.BaseCommand {
             this.log(`Forgot ${args.harness}.`);
         }
         catch (err) {
+            // A well-formed id the server still rejects: say so in the same words
+            // `show` uses, rather than relaying `Invalid harness ID`.
+            if (err instanceof api_fetch_1.ApiFetchError && err.status === 400) {
+                this.error(`Not a harness id: ${args.harness}\n${(0, show_1.describeWrongHarnessRef)(args.harness)}`, {
+                    exit: 1,
+                });
+                return;
+            }
             this.handleApiError(err);
         }
     }

package/dist/commands/harnesses/install.d.ts

@@ -0,0 +1,41 @@
+import { BaseCommand } from '../../base-command';
+/**
+ * Install one managed coding-agent CLI on a machine.
+ *
+ * ## Why this did not exist
+ *
+ * The daemon has installed any of seven providers since `d878b79581`, and
+ * `POST /api/daemons/:id/cli-installers/:provider/install` is the request the
+ * web app's Install button sends. From the CLI only ONE of them was reachable:
+ * `skrr code install`, whose provider is a constant. Everything else had to be
+ * installed by hand, or from the web app.
+ *
+ * `skrr harnesses install-token` made that worse rather than neutral. It is the
+ * only entry in `harnesses --help` with "install" in its name, so a user
+ * scanning for "how do I install a harness" lands on it — and it mints a daemon
+ * enrolment token for another machine, which is a different thing entirely.
+ *
+ * ## The provider name is validated here, against the shared vocabulary
+ *
+ * Unlike `harnesses list --provider`, where the set is open because a daemon
+ * registers a row per capability it detects, the INSTALLABLE set is closed and
+ * owned: `MANAGED_CLI_PROVIDER_IDS` in `@skrr-ai/data-provider`, which the
+ * daemon's own list is pinned against by `managedCliProviders.spec.ts`. So a
+ * typo can be rejected with the real options, rather than sent to the daemon to
+ * come back as an opaque refusal.
+ */
+export default class HarnessesInstall extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        provider: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        daemon: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+    /** What the daemon says about this provider right now, best effort. */
+    private installerNote;
+    private daemonIdFor;
+}

package/dist/commands/harnesses/install.js

@@ -0,0 +1,165 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../base-command");
+const cli_installers_1 = require("../../lib/cli-installers");
+const daemon_ref_1 = require("../../lib/daemon-ref");
+const daemon_target_1 = require("../../lib/daemon-target");
+/**
+ * Install one managed coding-agent CLI on a machine.
+ *
+ * ## Why this did not exist
+ *
+ * The daemon has installed any of seven providers since `d878b79581`, and
+ * `POST /api/daemons/:id/cli-installers/:provider/install` is the request the
+ * web app's Install button sends. From the CLI only ONE of them was reachable:
+ * `skrr code install`, whose provider is a constant. Everything else had to be
+ * installed by hand, or from the web app.
+ *
+ * `skrr harnesses install-token` made that worse rather than neutral. It is the
+ * only entry in `harnesses --help` with "install" in its name, so a user
+ * scanning for "how do I install a harness" lands on it — and it mints a daemon
+ * enrolment token for another machine, which is a different thing entirely.
+ *
+ * ## The provider name is validated here, against the shared vocabulary
+ *
+ * Unlike `harnesses list --provider`, where the set is open because a daemon
+ * registers a row per capability it detects, the INSTALLABLE set is closed and
+ * owned: `MANAGED_CLI_PROVIDER_IDS` in `@skrr-ai/data-provider`, which the
+ * daemon's own list is pinned against by `managedCliProviders.spec.ts`. So a
+ * typo can be rejected with the real options, rather than sent to the daemon to
+ * come back as an opaque refusal.
+ */
+class HarnessesInstall extends base_command_1.BaseCommand {
+    static description = 'Install a managed coding-agent CLI (claude, codex, devin, …) on one of your machines';
+    static examples = [
+        '<%= config.bin %> harnesses install devin',
+        '<%= config.bin %> harnesses install codex --daemon daemon_07c086e3c249_cli_default',
+    ];
+    static args = {
+        provider: core_1.Args.string({
+            ignoreStdin: true,
+            required: true,
+            description: `Which CLI to install (${data_provider_1.MANAGED_CLI_PROVIDER_IDS.join(', ')})`,
+        }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+        daemon: core_1.Flags.string({
+            description: 'Which machine to install on. Defaults to your only active daemon; required when several are active.',
+        }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(HarnessesInstall);
+        // Case-insensitive, and every accepted spelling of the first-party harness
+        // resolves to its canonical id — the same normalization the route applies.
+        const provider = (0, data_provider_1.normalizeManagedCliProvider)(args.provider);
+        if (!provider) {
+            this.error(`"${args.provider}" is not a managed CLI provider. Installable: ${data_provider_1.MANAGED_CLI_PROVIDER_IDS.join(', ')}.`, { exit: 2 });
+            return;
+        }
+        const target = await (0, daemon_target_1.resolveDaemonTarget)({
+            explicit: flags.daemon,
+            local: (0, daemon_target_1.localMachine)(),
+            listActiveDaemons: () => (0, daemon_target_1.listActiveDaemons)(this.resolvedCredential),
+        });
+        const daemonId = this.daemonIdFor(target);
+        let start;
+        try {
+            start = await (0, cli_installers_1.startManagedCliInstall)(daemonId, provider, this.resolvedCredential);
+        }
+        catch (err) {
+            this.handleApiError(err);
+            return;
+        }
+        const jobId = start.job?.id;
+        if (!start.started || !jobId) {
+            // The daemon declined and already knows why. Read its own reason off the
+            // provider state rather than inventing an explanation for the silence —
+            // "Already installed." and "Not available on this platform." want very
+            // different responses, and a generic "install failed" hides both.
+            const reason = start.provider?.installDisabledReason?.trim() ||
+                (await this.installerNote(daemonId, provider));
+            this.log(reason ? `${provider}: ${reason}` : `${provider}: the daemon started no install job.`);
+            return;
+        }
+        if (!flags.json)
+            this.logToStderr(`Installing ${provider} on ${(0, daemon_ref_1.formatDaemonRef)(daemonId)}…`);
+        const outcome = await (0, cli_installers_1.followManagedCliInstallJob)({
+            daemonId,
+            jobId,
+            credential: this.resolvedCredential,
+            onLogLine: flags.json ? undefined : (line) => this.logToStderr(`  ${line}`),
+        });
+        if (outcome.kind === 'missing') {
+            this.error(`The daemon no longer has install job ${jobId}.`, { exit: 1 });
+            return;
+        }
+        if (outcome.kind === 'timeout') {
+            // Not a failure: the daemon is still working, and calling this failed
+            // would send someone to debug a download that is going fine.
+            this.error(`Still installing after ${Math.round(cli_installers_1.INSTALL_MAX_WAIT_MS / 60000)} minutes — the daemon is still working on job ${jobId}. Check \`${this.config.bin} harnesses installers\` in a while.`, { exit: 1 });
+            return;
+        }
+        const job = outcome.job;
+        if (flags.json) {
+            this.log(JSON.stringify({ daemonId, provider, job }, null, 2));
+            if (job.status !== 'succeeded')
+                process.exitCode = 1;
+            return;
+        }
+        if (job.status === 'failed') {
+            this.error(`Installing ${provider} failed: ${job.error || 'the daemon gave no reason.'}`, {
+                exit: 1,
+            });
+            return;
+        }
+        // Report the state the install actually produced, not "done". Installing a
+        // binary is not the same as being able to run it: Devin lands
+        // `interactive-required`, and a user told only "installed" would find that
+        // out on their first turn instead.
+        const state = await this.installerNote(daemonId, provider, true);
+        this.log(`${provider} installed.${state ? ` ${state}` : ''}`);
+    }
+    /** What the daemon says about this provider right now, best effort. */
+    async installerNote(daemonId, provider, readiness = false) {
+        try {
+            const res = await (0, cli_installers_1.listCliInstallers)(daemonId, this.resolvedCredential);
+            const row = (res.providers ?? []).find((p) => (0, data_provider_1.normalizeManagedCliProvider)(p.provider) === provider);
+            if (!row)
+                return null;
+            if (readiness) {
+                const verdict = (0, cli_installers_1.readinessOf)(row);
+                return `${verdict.label}: ${verdict.detail}`;
+            }
+            const reason = row.installDisabledReason?.trim();
+            if (!reason)
+                return null;
+            return row.version ? `${reason} (${row.version})` : reason;
+        }
+        catch {
+            return null;
+        }
+    }
+    daemonIdFor(target) {
+        if (target.kind === 'daemon')
+            return target.daemonId;
+        if (target.kind === 'this-machine') {
+            if (target.daemonId)
+                return target.daemonId;
+            this.error('This machine is a Dedicated Runtime whose daemon has not published an id this process can read. Name a machine with --daemon.', { exit: 1 });
+        }
+        if (target.kind === 'none') {
+            this.error(`No active daemon is registered for this account, so nothing can perform the install. Start the local runtime with \`${this.config.bin} daemon start\`.`, { exit: 1 });
+        }
+        const choices = target.daemons
+            .slice(0, 10)
+            .map((d) => `  ${(0, daemon_ref_1.formatDaemonRef)(d.id)}  ${d.name || '—'}`)
+            .join('\n');
+        this.error(`${target.daemons.length} active daemons — say which machine to install on:\n${choices}\n` +
+            `Pass one with --daemon, or see them all with \`${this.config.bin} list-daemons\`.`, { exit: 1 });
+    }
+}
+exports.default = HarnessesInstall;

package/dist/commands/harnesses/installers.d.ts

@@ -0,0 +1,45 @@
+import { BaseCommand } from '../../base-command';
+/**
+ * What each managed provider's state is on one machine.
+ *
+ * ## Why this command exists
+ *
+ * `d878b79581` replaced "is the binary there" with four states — installed,
+ * ready, interactive-required, headless-key-required — and routed them from
+ * `cli-installers` through health to the web harness create modal. It reached
+ * exactly one surface. From the CLI there was no way to ask.
+ *
+ * That gap is not cosmetic, because `skrr harnesses list` answers a DIFFERENT
+ * question and looks like it answers this one. Its `status` is the daemon's
+ * socket, so on this account `skrr-code` read `online` with no binary installed
+ * at all, and `harnesses ping` answered it in 78ms — the daemon was there, the
+ * harness was not. A user could not discover that from inside the product; it
+ * took `command -v` in a shell.
+ *
+ * So this prints what the DAEMON says about each provider: whether the binary
+ * is present, which one and where, and whether it is signed in. The four states
+ * keep their server-side names here rather than being re-prosed, so that a
+ * message quoted from the CLI matches the one in the modal.
+ *
+ * `unknown` is a first-class answer and is not `ready`. A provider whose recipe
+ * declares no credential resolver genuinely cannot be assessed from here, and
+ * saying so is the point — the failure this whole vocabulary exists to prevent
+ * is a surface that reports ready for a harness that will refuse on first use.
+ */
+export default class HarnessesInstallers extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        daemon: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+    /**
+     * Refuse rather than guess which machine to report on.
+     *
+     * Reading is harmless, but naming the wrong machine is not: the whole value
+     * here is "is the thing on MY laptop usable", and an answer about a sandbox
+     * the user forgot about is worse than no answer, because it looks like one.
+     */
+    private daemonIdFor;
+}