@skrr-ai/cli 0.1.39 → 0.1.41

package/dist/lib/label-ref.d.ts

@@ -59,12 +59,19 @@ export declare function closestNames(typed: string, names: string[], limit?: num
 export interface LabelVocabularyContext {
     /** Narrow to labels attachable to this entity type. Omit for all of them. */
     applicableTo?: LabelApplicable;
-    /** Narrows to the workspace scope; `--workspace` / OVERSKY_WORKSPACE_ID. */
+    /**
+     * Narrows to this workspace scope. When omitted the AMBIENT workspace is
+     * resolved (`--workspace` / OVERSKY_WORKSPACE_ID / the server's default
+     * workspace): a session that never selected a workspace still writes to
+     * one, and a vocabulary that cannot see it refuses names that exist.
+     */
     workspaceId?: string;
     /** Archived labels are excluded unless asked for. */
     includeArchived?: boolean;
     /** Injected in tests. */
     getLabels?: typeof dataService.getLabels;
+    /** Injected in tests; defaults to `workspaces.ambientWorkspaceId`. */
+    resolveWorkspaceId?: () => Promise<string | undefined>;
 }
 export interface LabelRefContext extends LabelVocabularyContext {
     /** Which entity the resolved labels will be attached to. */

package/dist/lib/label-ref.js

@@ -39,6 +39,7 @@ exports.closestNames = closestNames;
 exports.collectLabelVocabulary = collectLabelVocabulary;
 exports.resolveLabelRefs = resolveLabelRefs;
 const data_provider_1 = require("@skrr-ai/data-provider");
+const workspaces_1 = require("./workspaces");
 /** A canonical v4 uuid, which is what every label id is. */
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function looksLikeLabelId(ref) {
@@ -89,9 +90,18 @@ function closestNames(typed, names, limit = 3) {
  */
 async function collectLabelVocabulary(context) {
     const getLabels = context.getLabels ?? data_provider_1.dataService.getLabels;
+    let workspaceId = context.workspaceId;
+    if (!workspaceId) {
+        try {
+            workspaceId = await (context.resolveWorkspaceId ?? workspaces_1.ambientWorkspaceId)();
+        }
+        catch {
+            workspaceId = undefined;
+        }
+    }
     const requests = [{ scope: 'user' }];
-    if (context.workspaceId)
-        requests.push({ scope: 'workspace', scopeId: context.workspaceId });
+    if (workspaceId)
+        requests.push({ scope: 'workspace', scopeId: workspaceId });
     const settled = await Promise.allSettled(requests.map((request) => getLabels({
         ...request,
         ...(context.applicableTo ? { applicableTo: context.applicableTo } : {}),

package/dist/lib/local-skills.d.ts

@@ -38,7 +38,23 @@ export declare function isUserInvocable(skill: Pick<DaemonLocalSkill, 'triggers'
  * dropped, because the server's own rule is that a skill the user picked and
  * the turn did not load must fail the turn rather than run without it.
  */
-export declare function resolveLocalSkillRefs(inventory: ReadonlyArray<DaemonLocalSkill>, requested: ReadonlyArray<string>): {
+/**
+ * The restart that refreshes THIS daemon's inventory. A daemon id is
+ * `daemon_<machine>_<source>_<profile>`; a bare `skrr daemon restart` restarts
+ * the default profile, so for any other profile the hint named a different
+ * daemon than the one whose list was stale (OSK-10080 verifier).
+ */
+export declare function daemonRestartCommand(daemonId: string | undefined): string;
+export declare function resolveLocalSkillRefs(inventory: ReadonlyArray<DaemonLocalSkill>, requested: ReadonlyArray<string>, options?: {
+    /**
+     * The inventory is what the daemon reported when it last registered, not a
+     * live read. A skill added since is missing from it — for up to an hour, until
+     * the daemon reconnects — so "not on this machine" would be false (OSK-10080).
+     */
+    snapshot?: boolean;
+    /** Whose snapshot, so the refresh hint restarts the right daemon. */
+    daemonId?: string;
+}): {
     refs: Array<{
         name: string;
         pathHash: string;

package/dist/lib/local-skills.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.SKILL_CONVENTION_DISCOVERY_SINCE = void 0;
 exports.chooseDaemon = chooseDaemon;
 exports.isUserInvocable = isUserInvocable;
+exports.daemonRestartCommand = daemonRestartCommand;
 exports.resolveLocalSkillRefs = resolveLocalSkillRefs;
 exports.withSkillInvocations = withSkillInvocations;
 exports.looksLikeSkillPath = looksLikeSkillPath;
@@ -10,6 +11,7 @@ exports.findLocalSkillsNamed = findLocalSkillsNamed;
 exports.describeStoreSkillMiss = describeStoreSkillMiss;
 exports.daemonPredates = daemonPredates;
 const data_provider_1 = require("@skrr-ai/data-provider");
+const instruction_input_1 = require("./instruction-input");
 /**
  * Which machine to ask, or why there is no single answer.
  *
@@ -44,7 +46,19 @@ function isUserInvocable(skill) {
  * dropped, because the server's own rule is that a skill the user picked and
  * the turn did not load must fail the turn rather than run without it.
  */
-function resolveLocalSkillRefs(inventory, requested) {
+/**
+ * The restart that refreshes THIS daemon's inventory. A daemon id is
+ * `daemon_<machine>_<source>_<profile>`; a bare `skrr daemon restart` restarts
+ * the default profile, so for any other profile the hint named a different
+ * daemon than the one whose list was stale (OSK-10080 verifier).
+ */
+function daemonRestartCommand(daemonId) {
+    const profile = daemonId ? (0, instruction_input_1.parseDaemonId)(daemonId)?.profile : undefined;
+    return profile && profile !== 'default'
+        ? `skrr daemon restart --profile ${profile}`
+        : 'skrr daemon restart';
+}
+function resolveLocalSkillRefs(inventory, requested, options = {}) {
     const refs = [];
     const problems = [];
     const seen = new Set();
@@ -58,7 +72,11 @@ function resolveLocalSkillRefs(inventory, requested) {
         if (matches.length === 0) {
             problems.push(named.length > 0
                 ? `No skill "${name}" under ${root}. It is under: ${named.map((s) => s.source ?? '?').join(', ')}.`
-                : `No skill named "${name}" on this machine. See \`skrr skills local\`.`);
+                : options.snapshot
+                    ? `No skill named "${name}" in the list this machine's daemon reported when it last connected. ` +
+                        `A skill added since then appears after the daemon reconnects — run \`${daemonRestartCommand(options.daemonId)}\` on that machine. ` +
+                        'See `skrr skills local`.'
+                    : `No skill named "${name}" on this machine. See \`skrr skills local\`.`);
             continue;
         }
         if (matches.length > 1) {

package/dist/lib/login.js

@@ -84,7 +84,7 @@ async function cliLogin(opts = {}) {
         });
         if (brokerResult.ok) {
             console.log('');
-            console.log('  Authorized via the local skrr runtime (no browser needed).');
+            console.log('  Authorized via the skrr background service on this computer (no browser needed).');
             return {
                 token: brokerResult.accessToken,
                 refreshToken: brokerResult.refreshToken,
@@ -107,7 +107,7 @@ async function cliLogin(opts = {}) {
         // broker failures — missing bootstrap, network blip, server 5xx —
         // silently fall through to PKCE / device-code below.
         if (brokerResult.reason === 'ci_token_refused') {
-            throw new Error('The local skrr runtime is bootstrapped from a CI token, which cannot broker an interactive CLI login. ' +
+            throw new Error('The skrr background service on this computer is bootstrapped from a CI token, which cannot broker an interactive CLI login. ' +
                 'Use `skrr create-token --name <name>` to mint a long-lived CI credential directly, ' +
                 'or run `skrr login` on a machine where the daemon was authenticated interactively.');
         }
@@ -126,19 +126,19 @@ async function cliLogin(opts = {}) {
             brokerRateLimited = true;
             if (!(0, ssh_detect_1.isNonInteractive)()) {
                 console.log('');
-                console.log('  The local skrr runtime has brokered several logins recently and the server is ' +
+                console.log('  The skrr background service on this computer has brokered several logins recently and the server is ' +
                     'rate-limiting them. Falling back to the browser flow.');
             }
         }
         if (brokerResult.reason === 'base_url_mismatch' && brokerResult.daemonServerUrl) {
             console.log('');
-            console.log(`  The local skrr runtime is logged in to ${brokerResult.daemonServerUrl}, but skrr is configured for ${serverUrl}.`);
+            console.log(`  The skrr background service on this computer is logged in to ${brokerResult.daemonServerUrl}, but skrr is configured for ${serverUrl}.`);
             console.log(`  Skipping the daemon-broker handoff. Run \`skrr login --base-url ${brokerResult.daemonServerUrl}\` to use the daemon instead.`);
         }
     }
     if ((0, ssh_detect_1.isNonInteractive)()) {
         throw new Error(brokerRateLimited
-            ? 'The local skrr runtime is being rate-limited while brokering logins, and this ' +
+            ? 'The skrr background service on this computer is being rate-limited while brokering logins, and this ' +
                 'shell cannot run the browser flow instead. The limit is per 15-minute window — ' +
                 'retry shortly. For CI, use `skrr create-token` and set OVERSKY_TOKEN=osk_ci_...'
             : 'skrr login requires an interactive terminal or an SSH session. ' +

package/dist/lib/machines.d.ts

@@ -112,6 +112,12 @@ export interface Machine {
  * could come back says so, and a destroyed one cannot.
  */
 export declare function machineStateLabel(machine: Machine): string;
+/**
+ * What a list says it left out, by the label each hidden machine would have
+ * printed: `250 terminated, 5 offline, 1 paused`. "offline or terminated"
+ * called a paused machine offline after the table stopped doing so (OSK-9996).
+ */
+export declare function hiddenMachinesSummary(hidden: readonly Machine[]): string;
 /** Is this a machine a user could still use, or bring back? */
 export declare function isReachableMachine(machine: Machine): boolean;
 /** The user-editable slice. Identities, capabilities and lifecycle are not. */

package/dist/lib/machines.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.machineStateLabel = machineStateLabel;
+exports.hiddenMachinesSummary = hiddenMachinesSummary;
 exports.isReachableMachine = isReachableMachine;
 exports.liveHarnessCount = liveHarnessCount;
 exports.listMachines = listMachines;
@@ -30,8 +31,36 @@ function machineStateLabel(machine) {
     if (controls && controls.canResume === false && controls.canTerminate === false) {
         return 'terminated';
     }
+    // A leased machine at rest says WHICH rest. `machines hosted list` printed
+    // `paused` and this list printed `offline` for the same machine, with the
+    // reason only in `machines show` (OSK-9996). `offline` stays for a machine
+    // that simply is not connected.
+    const leaseState = machine.lease?.state;
+    if (leaseState === 'paused' || leaseState === 'stopped')
+        return leaseState;
+    // A lease the provider has ended cannot come back either; it read `offline`
+    // while an unleased dead sandbox read `terminated`, so the hidden-machine
+    // footer counted 95 ended leases as offline (OSK-9996 verifier).
+    if (leaseState === 'terminated')
+        return 'terminated';
     return 'offline';
 }
+/**
+ * What a list says it left out, by the label each hidden machine would have
+ * printed: `250 terminated, 5 offline, 1 paused`. "offline or terminated"
+ * called a paused machine offline after the table stopped doing so (OSK-9996).
+ */
+function hiddenMachinesSummary(hidden) {
+    const counts = new Map();
+    for (const machine of hidden) {
+        const label = machineStateLabel(machine);
+        counts.set(label, (counts.get(label) ?? 0) + 1);
+    }
+    return [...counts.entries()]
+        .sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]))
+        .map(([label, count]) => `${count} ${label}`)
+        .join(', ');
+}
 /** Is this a machine a user could still use, or bring back? */
 function isReachableMachine(machine) {
     return machineStateLabel(machine) !== 'terminated' && machine.status !== 'offline';
@@ -105,6 +134,22 @@ function hostedSandboxDaemonIds(ref) {
         return [];
     return [`hosted-machine-${ref}`, `hosted-job-machine-${ref}`];
 }
+/**
+ * An id with its identity-kind prefix removed: `lease:rtl_…` → `rtl_…`,
+ * `dedicated-runtime:rtl_…` → `rtl_…`, `machine:0354…` → `0354…`.
+ *
+ * Other commands print the bare form. `machines dedicated list` and the lease
+ * payloads name `rtl_…`, and `harnesses list`'s MACHINE column prints the head
+ * of the identifier after the kind — so the id a user has to hand often lacks
+ * the prefix this list keys on, and `machines show rtl_…` answered "No machine
+ * matches" for a machine it was listing as `lease:rtl_…` (OSK-9269, OSK-9290).
+ */
+function withoutIdentityKind(value) {
+    if (!value)
+        return undefined;
+    const separator = value.indexOf(':');
+    return separator === -1 ? undefined : value.slice(separator + 1);
+}
 function resolveMachineRef(machines, ref) {
     const needle = ref.trim();
     const lower = needle.toLowerCase();
@@ -121,13 +166,26 @@ function resolveMachineRef(machines, ref) {
         // two unrelated-looking ids, no way on screen to tell they are one
         // machine. Exact composition, not a substring search, so this cannot
         // match a machine that merely contains the text.
-        hostedSandboxDaemonIds(needle).some((candidate) => m.daemonId === candidate));
+        hostedSandboxDaemonIds(needle).some((candidate) => m.daemonId === candidate) ||
+        withoutIdentityKind(m.id) === needle ||
+        withoutIdentityKind(m.machineUuid) === needle ||
+        // A harness id names exactly one machine — the one it is registered on.
+        // Refusing it with "No machine matches" sent the user to a different
+        // command without saying which (OSK-9313).
+        (m.harnesses ?? []).some((h) => h.id === needle));
     if (exact.length === 1)
         return exact[0];
     const byName = machines.filter((m) => m.name?.toLowerCase() === lower);
     if (byName.length === 1)
         return byName[0];
-    const prefix = machines.filter((m) => [m.id, m.machineUuid, m.stableDaemonId, m.daemonId].some((candidate) => candidate && candidate.toLowerCase().startsWith(lower)));
+    const prefix = machines.filter((m) => [
+        m.id,
+        m.machineUuid,
+        m.stableDaemonId,
+        m.daemonId,
+        withoutIdentityKind(m.id),
+        withoutIdentityKind(m.machineUuid),
+    ].some((candidate) => candidate && candidate.toLowerCase().startsWith(lower)));
     if (prefix.length === 1)
         return prefix[0];
     if (prefix.length > 1) {
@@ -140,5 +198,13 @@ function resolveMachineRef(machines, ref) {
         throw new Error(`"${ref}" matches ${prefix.length} machines: ${shown.join(', ')}` +
             `${rest > 0 ? `, and ${rest} more` : ''}. Use a longer prefix or the full id.`);
     }
+    // A harness id prefix or a harness name is the other `show`'s input. Say so
+    // rather than only "no machine", which left the reader to guess that a
+    // sibling command takes it (OSK-9313).
+    const harnessMatch = machines.some((m) => (m.harnesses ?? []).some((h) => (lower.length >= 4 && h.id.toLowerCase().startsWith(lower)) ||
+        (typeof h.name === 'string' && h.name.toLowerCase() === lower)));
+    if (harnessMatch) {
+        throw new Error(`No machine matches "${ref}", but a harness does. \`skrr harnesses show ${ref}\` takes it.`);
+    }
     throw new Error(`No machine matches "${ref}". Run \`skrr machines list\` to see them.`);
 }

package/dist/lib/option-hint.d.ts

@@ -0,0 +1,15 @@
+/**
+ * A "did you mean" for oclif's enum refusal (OSK-9735).
+ *
+ * Tasks, spaces, goals and key results each spell one lifecycle their own way —
+ * "under way" is `in_progress` for a space and `active` for a goal; "finished"
+ * is `done`, `completed` or `achieved` — and oclif's
+ * `Expected --status=in_progress to be one of: …` was the only place a user
+ * learned that. This names the value the command uses for the word that was
+ * typed, and otherwise the nearest spelling.
+ *
+ * It suggests and never substitutes. Some of the differences are deliberate (a
+ * key result's status is a health reading, not a lifecycle), so writing a mapped
+ * value would record a status nobody chose.
+ */
+export declare function invalidOptionHint(message: string): string | null;

package/dist/lib/option-hint.js

@@ -0,0 +1,75 @@
+"use strict";
+/**
+ * A "did you mean" for oclif's enum refusal (OSK-9735).
+ *
+ * Tasks, spaces, goals and key results each spell one lifecycle their own way —
+ * "under way" is `in_progress` for a space and `active` for a goal; "finished"
+ * is `done`, `completed` or `achieved` — and oclif's
+ * `Expected --status=in_progress to be one of: …` was the only place a user
+ * learned that. This names the value the command uses for the word that was
+ * typed, and otherwise the nearest spelling.
+ *
+ * It suggests and never substitutes. Some of the differences are deliberate (a
+ * key result's status is a health reading, not a lifecycle), so writing a mapped
+ * value would record a status nobody chose.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.invalidOptionHint = invalidOptionHint;
+/**
+ * Spellings of one concept across the CLI's vocabularies. A value is suggested
+ * only when it shares a group with what was typed.
+ */
+const CONCEPT_GROUPS = [
+    new Set(['in_progress', 'inprogress', 'active', 'started', 'ongoing', 'running', 'doing']),
+    new Set(['done', 'completed', 'complete', 'achieved', 'finished', 'closed', 'resolved']),
+    new Set(['cancelled', 'canceled', 'abandoned']),
+    new Set(['in_review', 'inreview', 'review', 'reviewing']),
+    new Set(['planned', 'todo', 'to_do', 'not_started']),
+];
+const REFUSAL = /Expected (--[\w-]+)=(.+?) to be one of: ([^\n]+)/;
+const normalize = (value) => value
+    .trim()
+    .toLowerCase()
+    .replace(/[\s-]+/g, '_');
+function editDistance(a, b) {
+    const row = Array.from({ length: b.length + 1 }, (_, i) => i);
+    for (let i = 1; i <= a.length; i += 1) {
+        let diagonal = row[0];
+        row[0] = i;
+        for (let j = 1; j <= b.length; j += 1) {
+            const above = row[j];
+            row[j] = Math.min(row[j] + 1, row[j - 1] + 1, diagonal + (a[i - 1] === b[j - 1] ? 0 : 1));
+            diagonal = above;
+        }
+    }
+    return row[b.length];
+}
+function invalidOptionHint(message) {
+    const match = REFUSAL.exec(message || '');
+    if (!match)
+        return null;
+    const [, flag, input, list] = match;
+    const options = list
+        .split(',')
+        .map((option) => option.trim())
+        .filter(Boolean);
+    const typed = normalize(input);
+    const exact = options.find((option) => normalize(option) === typed);
+    if (exact)
+        return `  Did you mean ${flag} ${exact}?`;
+    const group = CONCEPT_GROUPS.find((concept) => concept.has(typed));
+    const synonym = group && options.find((option) => group.has(normalize(option)));
+    if (synonym) {
+        return `  Did you mean ${flag} ${synonym}? Here "${input}" is spelled "${synonym}".`;
+    }
+    let nearest = null;
+    for (const option of options) {
+        const distance = editDistance(typed, normalize(option));
+        if (!nearest || distance < nearest.distance)
+            nearest = { option, distance };
+    }
+    if (nearest && nearest.distance <= Math.max(2, Math.floor(typed.length / 4))) {
+        return `  Did you mean ${flag} ${nearest.option}?`;
+    }
+    return null;
+}

package/dist/lib/runtime-tool-support.d.ts

@@ -0,0 +1,34 @@
+import type { TPlugin } from '@skrr-ai/data-provider';
+/**
+ * What an agent turn can call, said where tools are configured.
+ *
+ * Plugin tools (`agents tools`, `--tools`) and OpenAPI actions
+ * (`agents api-actions add`) reach an agent turn through the runtime's
+ * `agent-tools` server (OSK-9750, OSK-9754). Two limits remain, and the CLI is
+ * where the tool is set up, so it says them there:
+ *  - image and file plugins save their output through a web request an agent
+ *    turn does not have, so they are stored but not loaded;
+ *  - an OAuth action runs only after the user authorizes it once, through a
+ *    link the agent hands over on its first call.
+ */
+/** The catalog's AGENT column. `?` for a server older than the `agentRuntime` field. */
+export declare function agentRuntimeLabel(tool: Pick<TPlugin, 'agentRuntime'>): string;
+export declare const AGENT_COLUMN_FOOTNOTE: string;
+/** Stored plugin keys the catalog says an agent turn does not load. */
+export declare function pluginKeysNotLoaded(keys: string[], catalog: TPlugin[]): string[];
+export declare function pluginsNotLoadedNotice(keys: string[]): string;
+/** Said after adding an OAuth action, since nothing works until both steps happen. */
+export declare function oauthActionNotice(redirectUrl: string): string;
+/** Split an agent's stored `tools` into plugin keys and OpenAPI action tool names. */
+export declare function splitStoredTools(tools: unknown): {
+    plugins: string[];
+    actions: string[];
+};
+/**
+ * After `--tools` is saved: warn about the plugin keys an agent turn will not load.
+ *
+ * Unknown keys are refused by the server (OSK-9545); this covers the known ones
+ * that are stored but skipped. Best effort: a catalog that cannot be read says
+ * nothing rather than failing a write that already succeeded.
+ */
+export declare function warnPluginsNotLoaded(tools: unknown, warn: (message: string) => void, fetchCatalog?: () => Promise<TPlugin[]>): Promise<void>;

package/dist/lib/runtime-tool-support.js

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AGENT_COLUMN_FOOTNOTE = void 0;
+exports.agentRuntimeLabel = agentRuntimeLabel;
+exports.pluginKeysNotLoaded = pluginKeysNotLoaded;
+exports.pluginsNotLoadedNotice = pluginsNotLoadedNotice;
+exports.oauthActionNotice = oauthActionNotice;
+exports.splitStoredTools = splitStoredTools;
+exports.warnPluginsNotLoaded = warnPluginsNotLoaded;
+const data_provider_1 = require("@skrr-ai/data-provider");
+/**
+ * What an agent turn can call, said where tools are configured.
+ *
+ * Plugin tools (`agents tools`, `--tools`) and OpenAPI actions
+ * (`agents api-actions add`) reach an agent turn through the runtime's
+ * `agent-tools` server (OSK-9750, OSK-9754). Two limits remain, and the CLI is
+ * where the tool is set up, so it says them there:
+ *  - image and file plugins save their output through a web request an agent
+ *    turn does not have, so they are stored but not loaded;
+ *  - an OAuth action runs only after the user authorizes it once, through a
+ *    link the agent hands over on its first call.
+ */
+/** The catalog's AGENT column. `?` for a server older than the `agentRuntime` field. */
+function agentRuntimeLabel(tool) {
+    if (tool.agentRuntime === undefined)
+        return '?';
+    return tool.agentRuntime ? 'yes' : 'no';
+}
+exports.AGENT_COLUMN_FOOTNOTE = 'AGENT says whether an agent turn can call the tool. Image and file tools (AGENT no) ' +
+    'save their output through a web request an agent turn does not have.';
+/** Stored plugin keys the catalog says an agent turn does not load. */
+function pluginKeysNotLoaded(keys, catalog) {
+    const byKey = new Map(catalog.map((tool) => [tool.pluginKey, tool]));
+    return keys.filter((key) => byKey.get(key)?.agentRuntime === false);
+}
+function pluginsNotLoadedNotice(keys) {
+    const [subject, verb] = keys.length === 1 ? ['it', 'saves'] : ['they', 'save'];
+    return (`Saved, but an agent turn cannot call ${keys.join(', ')}: ${subject} ${verb} ` +
+        'output through a web request an agent turn does not have.');
+}
+/** Said after adding an OAuth action, since nothing works until both steps happen. */
+function oauthActionNotice(redirectUrl) {
+    return (`Register ${redirectUrl} as the redirect URL with the OAuth provider. ` +
+        "The agent's first call to one of these operations returns a link for you to authorize; " +
+        'after you finish, ask it to try again.');
+}
+/** Split an agent's stored `tools` into plugin keys and OpenAPI action tool names. */
+function splitStoredTools(tools) {
+    const list = Array.isArray(tools) ? tools.map(String) : [];
+    return {
+        plugins: list.filter((name) => !name.includes(data_provider_1.actionDelimiter)),
+        actions: list.filter((name) => name.includes(data_provider_1.actionDelimiter)),
+    };
+}
+/**
+ * After `--tools` is saved: warn about the plugin keys an agent turn will not load.
+ *
+ * Unknown keys are refused by the server (OSK-9545); this covers the known ones
+ * that are stored but skipped. Best effort: a catalog that cannot be read says
+ * nothing rather than failing a write that already succeeded.
+ */
+async function warnPluginsNotLoaded(tools, warn, fetchCatalog = () => data_provider_1.dataService.getAvailableTools()) {
+    const { plugins } = splitStoredTools(tools);
+    if (plugins.length === 0)
+        return;
+    let catalog;
+    try {
+        catalog = await fetchCatalog();
+    }
+    catch {
+        return;
+    }
+    const skipped = pluginKeysNotLoaded(plugins, catalog);
+    if (skipped.length > 0) {
+        warn(pluginsNotLoadedNotice(skipped));
+    }
+}

package/dist/lib/share-rows.d.ts

@@ -0,0 +1,17 @@
+/**
+ * How an agent-share row names its share and the other person.
+ *
+ * The share routes answer `{ shareId, owner: { userId, name }, recipient:
+ * { userId, name } }`. The four `agent-shares` listings read `id`/`_id` and
+ * stringified the person object, so every row printed SHARE ID `-` and FROM/TO
+ * `[object Object]` (OSK-10043): the one id `respond`/`revoke` need was
+ * unreadable, and so was who the share was with.
+ */
+/** The share's id, whichever key the row carries it under. */
+export declare function shareIdOf(share: Record<string, unknown>): string;
+/**
+ * A person as `Name (userId)` — the name to recognise, the id that
+ * `agent-shares with <userId>` takes. Accepts a bare id string too, which older
+ * rows used.
+ */
+export declare function sharePartyLabel(value: unknown): string;

package/dist/lib/share-rows.js

@@ -0,0 +1,35 @@
+"use strict";
+/**
+ * How an agent-share row names its share and the other person.
+ *
+ * The share routes answer `{ shareId, owner: { userId, name }, recipient:
+ * { userId, name } }`. The four `agent-shares` listings read `id`/`_id` and
+ * stringified the person object, so every row printed SHARE ID `-` and FROM/TO
+ * `[object Object]` (OSK-10043): the one id `respond`/`revoke` need was
+ * unreadable, and so was who the share was with.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.shareIdOf = shareIdOf;
+exports.sharePartyLabel = sharePartyLabel;
+/** The share's id, whichever key the row carries it under. */
+function shareIdOf(share) {
+    const id = share.shareId ?? share.id ?? share._id;
+    return typeof id === 'string' && id.length > 0 ? id : '-';
+}
+/**
+ * A person as `Name (userId)` — the name to recognise, the id that
+ * `agent-shares with <userId>` takes. Accepts a bare id string too, which older
+ * rows used.
+ */
+function sharePartyLabel(value) {
+    if (typeof value === 'string')
+        return value.length > 0 ? value : '-';
+    if (!value || typeof value !== 'object')
+        return '-';
+    const party = value;
+    const id = [party.userId, party.id].find((v) => typeof v === 'string' && v.length > 0);
+    const name = [party.name, party.email].find((v) => typeof v === 'string' && v.length > 0);
+    if (name && id)
+        return `${name} (${id})`;
+    return name ?? id ?? '-';
+}

package/dist/lib/workspaces.d.ts

@@ -56,6 +56,9 @@ export interface WorkspaceListing {
  */
 export declare function describeUnselectedWorkspace(listing: WorkspaceListing): string;
 export declare function listWorkspaces(): Promise<WorkspaceRow[]>;
+export declare function ambientWorkspaceId(env?: NodeJS.ProcessEnv): Promise<string | undefined>;
+/** Test seam — a memoized network result must not leak between specs. */
+export declare function clearAmbientWorkspaceCache(): void;
 /** `listWorkspaces`, keeping the envelope's caller-level fields. */
 export declare function listWorkspaceListing(): Promise<WorkspaceListing>;
 export declare function getWorkspace(workspaceId: string): Promise<WorkspaceRow>;

package/dist/lib/workspaces.js

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.describeUnselectedWorkspace = describeUnselectedWorkspace;
 exports.listWorkspaces = listWorkspaces;
+exports.ambientWorkspaceId = ambientWorkspaceId;
+exports.clearAmbientWorkspaceCache = clearAmbientWorkspaceCache;
 exports.listWorkspaceListing = listWorkspaceListing;
 exports.getWorkspace = getWorkspace;
 exports.matchWorkspace = matchWorkspace;
@@ -60,6 +62,42 @@ function describeUnselectedWorkspace(listing) {
 async function listWorkspaces() {
     return (await listWorkspaceListing()).rows;
 }
+/**
+ * The workspace a bare session actually writes to, for callers merging the
+ * caller's vocabulary or defaults across scopes.
+ *
+ * `OVERSKY_WORKSPACE_ID` is only populated when a workspace was SELECTED —
+ * `workspaces use`, `--workspace`, or a daemon session handoff. An account
+ * that never selected one still has a server-side `defaultWorkspaceId`, and
+ * every unscoped write lands there; a caller that only read the variable
+ * would reason about a smaller world than the one the server writes into
+ * (observed: `labels list` reported a user-only vocabulary while three
+ * workspace-scoped labels existed and were attachable).
+ *
+ * The listing fetch is memoized and fail-open: this runs to give a better
+ * answer, and must never become the error — an unreachable server returns
+ * `undefined`, which is the same world the caller saw before this existed.
+ */
+let memoizedDefaultWorkspaceId;
+async function ambientWorkspaceId(env = process.env) {
+    const explicit = env.OVERSKY_WORKSPACE_ID?.trim();
+    if (explicit)
+        return explicit;
+    if (memoizedDefaultWorkspaceId !== undefined) {
+        return memoizedDefaultWorkspaceId ?? undefined;
+    }
+    try {
+        memoizedDefaultWorkspaceId = (await listWorkspaceListing()).defaultWorkspaceId ?? null;
+    }
+    catch {
+        memoizedDefaultWorkspaceId = null;
+    }
+    return memoizedDefaultWorkspaceId ?? undefined;
+}
+/** Test seam — a memoized network result must not leak between specs. */
+function clearAmbientWorkspaceCache() {
+    memoizedDefaultWorkspaceId = undefined;
+}
 /** `listWorkspaces`, keeping the envelope's caller-level fields. */
 async function listWorkspaceListing() {
     const rows = [];