@skrr-ai/cli 0.1.40 → 0.1.41

package/dist/lib/agentic-stream.js

@@ -51,7 +51,12 @@ function writeJsonLine(output, value) {
  * The assistant text inside a `session:output` frame's envelopes.
  *
  * Envelope shape: `{ ev: { t: 'text', text: '…' } }`. Frames whose `ev.t` is
- * anything else (tool calls, status) are not the answer and are skipped.
+ * anything else (tool calls, status) are not the answer and are skipped, and so
+ * is text marked `thinking: true` — the model's reasoning, which the session
+ * protocol carries in the same `text` event. Folded in, a Devin turn asked for
+ * one word printed "I need to output only the word SECOND, … single
+ * word.SECOND" as its answer, and `run.result.text` kept it, because the
+ * stream then held the final result as a suffix and the longer text won.
  */
 function envelopesText(event) {
     const envelopes = event.envelopes;
@@ -59,9 +64,11 @@ function envelopesText(event) {
         return '';
     let out = '';
     for (const envelope of envelopes) {
-        const ev = envelope?.ev;
-        if (ev && ev.t === 'text' && typeof ev.text === 'string')
+        const ev = envelope
+            ?.ev;
+        if (ev && ev.t === 'text' && ev.thinking !== true && typeof ev.text === 'string') {
             out += ev.text;
+        }
     }
     return out;
 }
@@ -306,6 +313,8 @@ class AgenticStreamClient {
     /** Text already written to the terminal, for suffix-only rendering. */
     renderedText = '';
     idleTimer = null;
+    /** Releases a connect wait still in flight; `close()` calls it. */
+    abandonConnectWait = null;
     reconciling = false;
     responseMessageId;
     lastEvent;
@@ -351,7 +360,13 @@ class AgenticStreamClient {
             reconnectionDelayMax: 10_000,
         });
         this.installHandlers();
-        await this.waitForConnect();
+        await this.waitForConnect(this.options.attachTimeoutMs);
+        // A refused handshake asks the durable record, and the record can settle
+        // the run before any attach succeeds. `close()` then ends the wait, and
+        // there is nothing left to join: returning here is what lets the caller see
+        // the result instead of awaiting an attach nobody is still attempting.
+        if (this.settled || this.closed || !this.socket)
+            return result;
         this.socket.emit('session:join', { sessionId: this.options.sessionId });
         this.emit({ type: 'session.joined', sessionId: this.options.sessionId });
         this.armIdleProbe();
@@ -365,6 +380,14 @@ class AgenticStreamClient {
      * rather than giving up — a 200-second tool call is silence, not a failure —
      * so the cost of being wrong is one cheap read, while the cost of not asking
      * was an interactive session that never returned.
+     *
+     * The timer is deliberately NOT unref'd. It exists for the moment the socket
+     * stops holding the process open — a server-side disconnect, or a reconnect
+     * the server refuses, after which socket.io does not retry. Unref'd, it was
+     * the last thing pending at exactly that moment, so Node's event loop emptied
+     * and the CLI exited 0 with the run unsettled: `--no-stream --json` printed
+     * nothing at all for a turn the record said had failed (OSK-10061). A run
+     * that has not settled is a reason to stay alive; `close()` clears the timer.
      */
     armIdleProbe() {
         if (!this.options.reconcileTerminal)
@@ -374,7 +397,6 @@ class AgenticStreamClient {
         if (this.idleTimer)
             clearTimeout(this.idleTimer);
         this.idleTimer = setTimeout(() => void this.probeTerminal('idle'), this.options.idleTerminalProbeMs ?? 20_000);
-        this.idleTimer.unref?.();
     }
     /**
      * Settle from the durable record, if it has reached a terminal state.
@@ -438,6 +460,7 @@ class AgenticStreamClient {
             clearTimeout(this.idleTimer);
             this.idleTimer = null;
         }
+        this.abandonConnectWait?.();
         const socket = this.socket;
         this.socket = null;
         // Stop dispatch BEFORE tearing anything down. socket.io can deliver a
@@ -838,6 +861,11 @@ class AgenticStreamClient {
         if (finalText && finalText !== this.accumulated && !accumulationIsSuperset) {
             this.accumulated = finalText;
         }
+        // The finished answer, as every other surface shows it: the web applies
+        // this same sanitizer, so a scheduling JSON block or leaked function-call
+        // XML the model wrote into its reply is removed here too instead of being
+        // printed as part of the agent's answer.
+        this.accumulated = (0, data_provider_1.sanitizeFinalText)(this.accumulated);
         if (!this.options.quiet && !this.options.jsonl && this.accumulated) {
             const output = this.options.output ?? process.stdout;
             const { append, shown } = renderableDelta(this.renderedText, this.accumulated);
@@ -872,6 +900,10 @@ class AgenticStreamClient {
      * Now errors are surfaced as events and retried until a bounded deadline, so
      * only a sustained inability to attach gives up — and the caller turns that
      * into "accepted but detached", never "failed".
+     *
+     * The deadline and retry timers hold the process open (see `armDeadline`), so
+     * `close()` is what releases them — and it ends the wait too, whether the
+     * caller gave up or the durable record settled the run first (OSK-10061).
      */
     waitForConnect(timeoutMs = 30_000) {
         if (this.socket?.connected)
@@ -889,7 +921,12 @@ class AgenticStreamClient {
                     reject(Object.assign(new Error(`Could not attach to the run stream within ${Math.round(ms / 1000)}s` +
                         `${lastError ? `: ${lastError.message}` : ''}`), { code: 'STREAM_ATTACH_TIMEOUT', lastError }));
                 }, ms);
-                handle.unref?.();
+                // Deliberately NOT unref'd, nor is the retry timer below. A connect
+                // refused by middleware leaves no live socket, so these timers are the
+                // only thing keeping the process alive while it waits. Unref'd, Node's
+                // event loop drained and `agents chat` exited 0 right after printing
+                // "Retrying in 30s" — before the retry, without the answer the run had
+                // produced, and without the detach notice a script needs.
                 return handle;
             }
             const onConnect = () => {
@@ -933,7 +970,6 @@ class AgenticStreamClient {
                         // must not reject here and turn a pause into a failure.
                     }
                 }, jitteredRetryDelay(refusal.retryAfterMs));
-                retryTimer.unref?.();
             };
             const cleanup = () => {
                 clearTimeout(timer);
@@ -941,6 +977,11 @@ class AgenticStreamClient {
                     clearTimeout(retryTimer);
                 socket.off('connect', onConnect);
                 socket.off('connect_error', onError);
+                this.abandonConnectWait = null;
+            };
+            this.abandonConnectWait = () => {
+                cleanup();
+                resolve();
             };
             socket.once('connect', onConnect);
             socket.on('connect_error', onError);

package/dist/lib/cli-installers.d.ts

@@ -44,7 +44,7 @@ export interface CliInstallersResponse {
  * Providers the platform knows about that this daemon did not offer.
  *
  * The inventory is whatever the CONNECTED daemon supports, and an older daemon
- * legitimately supports fewer: `devin` arrived in daemon 0.8.43, so a machine
+ * legitimately supports fewer: `devin` arrived in the 0.8.45 daemon release, so a machine
  * running 0.8.35 answers with six providers instead of seven. Observed here —
  * the desktop app restarted the daemon from its bundled 0.8.35 copy and Devin
  * disappeared from the install list between two page loads, with nothing on
@@ -56,8 +56,28 @@ export interface CliInstallersResponse {
  * is already on this side of the wire. Naming the gap is what turns "Devin is
  * gone" into "this daemon is older than Devin".
  */
+/**
+ * The first STABLE daemon release (`daemon-v*` tag) whose
+ * MANAGED_CLI_PROVIDER_IDS included each provider. Release tags, not
+ * package.json at the commit that added it: the version is bumped before a
+ * release is cut, so the commit that added devin already read 0.8.43 while the
+ * 0.8.43 release did not contain it — this table said "added in 0.8.43" to a
+ * 0.8.43 user (OSK-9537 verifier). Derived with, per provider:
+ *   for t in $(git tag -l 'daemon-v*' | sort -V); do
+ *     git show "$t:daemon/src/cli-installers.ts" | grep -q "'devin'" && echo "$t" && break
+ *   done
+ * Providers present since managed installers first shipped (0.8.1) are omitted.
+ */
+export declare const MANAGED_CLI_PROVIDER_SINCE: Readonly<Record<string, string>>;
+/**
+ * "Not offered" with the release that added each provider, so a reader learns
+ * WHICH update fixes it rather than only that one might (OSK-9537).
+ */
+export declare function describeProvidersNotOffered(missing: readonly string[]): string;
 export declare function providersNotOffered(offered: readonly ManagedCliProviderState[] | undefined, known: readonly string[]): string[];
-export declare function listCliInstallers(daemonId: string, credential?: unknown): Promise<CliInstallersResponse>;
+export declare function listCliInstallers(daemonId: string, credential?: unknown, opts?: {
+    signal?: AbortSignal;
+}): Promise<CliInstallersResponse>;
 /**
  * The one-word readiness verdict for a provider, and whether it is good news.
  *
@@ -74,10 +94,63 @@ export declare function readinessOf(provider: ManagedCliProviderState): {
     ok: boolean;
 };
 /** A job the daemon runs to install one managed provider. */
+/**
+ * Readiness per provider for one daemon, keyed by CANONICAL provider — or null
+ * when the daemon could not be asked (disconnected, older, refused).
+ *
+ * The harness row's `authStatus` is the DAEMON's standing with skrr, written
+ * across every row of a daemon at once, so `harnesses show`, `machines show`
+ * and `ping` answered "ok" per provider for a Devin its own CLI called "Not
+ * logged in" (OSK-9263, OSK-9265). This is the per-provider answer those
+ * surfaces print instead. Best-effort by design: a failure here must never
+ * fail the command that asked.
+ */
+export declare function readinessByProvider(daemonId: string, credential?: unknown, opts?: {
+    signal?: AbortSignal;
+}): Promise<Map<string, ReturnType<typeof readinessOf>> | null>;
+/** The canonical provider a harness row names, for looking it up in that map. */
+export declare function readinessKey(provider: string | null | undefined): string;
+export type ProviderReadiness = ReturnType<typeof readinessOf>;
+/** The fields of a harness row that decide whether, and whom, to ask. */
+export interface ReadinessRow {
+    daemonId?: string | null;
+    provider?: string | null;
+    status?: string | null;
+    superseded?: boolean;
+}
+/** How long one daemon may take to answer before a list prints `-` for it. */
+export declare const ROW_READINESS_TIMEOUT_MS = 5000;
+/**
+ * Readiness for many harness rows at once: ONE installer read per connected
+ * daemon, all in parallel, however many rows each daemon has.
+ *
+ * Only a row whose daemon can answer is asked for — online and not superseded;
+ * an offline or replaced registration has nobody on the other end. Each read is
+ * bounded, because a list must not hang on one slow machine; a daemon that does
+ * not answer in time reads as unknown (`undefined`), never as `ready`.
+ *
+ * `asked` and `answered` let a caller tell "this daemon does not report it"
+ * from "nothing could be asked", which call for different next steps.
+ */
+export declare function readinessForRows(rows: readonly ReadinessRow[], credential?: unknown, opts?: {
+    timeoutMs?: number;
+}): Promise<{
+    lookup: (row: ReadinessRow) => ProviderReadiness | undefined;
+    /** Whether this row's daemon answered at all — so a `-` can say why. */
+    daemonAnswered: (row: ReadinessRow) => boolean;
+    asked: number;
+    answered: number;
+}>;
 export interface ManagedCliInstallJob {
     id: string;
     status: 'queued' | 'running' | 'succeeded' | 'failed';
     error?: string;
+    /**
+     * The daemon's job log: the LAST lines only (a sliding window, 200 lines in
+     * `daemon/src/cli-installers.ts`). This is the field the daemon sends.
+     */
+    logTail?: string[];
+    /** Never sent by any daemon; kept so an older caller's shape still types. */
     log?: string[];
 }
 export interface StartInstallResponse {
@@ -92,6 +165,15 @@ export declare function startManagedCliInstall(daemonId: string, provider: strin
 export declare function readManagedCliInstallJob(daemonId: string, jobId: string, credential?: unknown): Promise<{
     job?: ManagedCliInstallJob;
 }>;
+/**
+ * The lines of a job's log tail not yet printed.
+ *
+ * The tail is a SLIDING window: once an installer writes more than the daemon
+ * keeps, earlier lines fall off the front, so an index into it skips or repeats
+ * lines. Instead, find the longest run at the start of the new tail that matches
+ * the end of what was already printed, and print only what follows it.
+ */
+export declare function unseenLogLines(printed: readonly string[], tail: readonly string[]): string[];
 /** A 100 MB download over a hotel connection is the case this has to survive. */
 export declare const INSTALL_MAX_WAIT_MS: number;
 export declare const INSTALL_POLL_INTERVAL_MS = 2000;

package/dist/lib/cli-installers.js

@@ -1,11 +1,16 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.INSTALL_POLL_INTERVAL_MS = exports.INSTALL_MAX_WAIT_MS = void 0;
+exports.INSTALL_POLL_INTERVAL_MS = exports.INSTALL_MAX_WAIT_MS = exports.ROW_READINESS_TIMEOUT_MS = exports.MANAGED_CLI_PROVIDER_SINCE = void 0;
+exports.describeProvidersNotOffered = describeProvidersNotOffered;
 exports.providersNotOffered = providersNotOffered;
 exports.listCliInstallers = listCliInstallers;
 exports.readinessOf = readinessOf;
+exports.readinessByProvider = readinessByProvider;
+exports.readinessKey = readinessKey;
+exports.readinessForRows = readinessForRows;
 exports.startManagedCliInstall = startManagedCliInstall;
 exports.readManagedCliInstallJob = readManagedCliInstallJob;
+exports.unseenLogLines = unseenLogLines;
 exports.followManagedCliInstallJob = followManagedCliInstallJob;
 /**
  * The daemon's managed-CLI installer inventory, as the CLI reads it.
@@ -21,19 +26,24 @@ exports.followManagedCliInstallJob = followManagedCliInstallJob;
  * The CLI called the route from exactly one place (`commands/code/install.ts`),
  * for one provider, to read one field, and showed the user none of it. So from
  * the CLI there was no way to learn that a harness listed as `online` had no
- * binary at all — which is the state this account's `skrr-code` row was in.
+ * binary at all — which is the state this account's first-party harness row was in.
  *
  * The shape lives here rather than beside a command because two commands read
  * it now. Root `CLAUDE.md`: a second declaration is how a surface silently
  * drifts from the server that produced it.
  */
+const auth_core_1 = require("@skrr-ai/auth-core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const api_fetch_1 = require("./api-fetch");
+/** A provider in its canonical spelling, or '' for a missing one. */
+function canonical(value) {
+    return typeof value === 'string' ? String((0, data_provider_1.canonicalHarnessProvider)(value) ?? value) : '';
+}
 /**
  * Providers the platform knows about that this daemon did not offer.
  *
  * The inventory is whatever the CONNECTED daemon supports, and an older daemon
- * legitimately supports fewer: `devin` arrived in daemon 0.8.43, so a machine
+ * legitimately supports fewer: `devin` arrived in the 0.8.45 daemon release, so a machine
  * running 0.8.35 answers with six providers instead of seven. Observed here —
  * the desktop app restarted the daemon from its bundled 0.8.35 copy and Devin
  * disappeared from the install list between two page loads, with nothing on
@@ -45,19 +55,47 @@ const api_fetch_1 = require("./api-fetch");
  * is already on this side of the wire. Naming the gap is what turns "Devin is
  * gone" into "this daemon is older than Devin".
  */
+/**
+ * The first STABLE daemon release (`daemon-v*` tag) whose
+ * MANAGED_CLI_PROVIDER_IDS included each provider. Release tags, not
+ * package.json at the commit that added it: the version is bumped before a
+ * release is cut, so the commit that added devin already read 0.8.43 while the
+ * 0.8.43 release did not contain it — this table said "added in 0.8.43" to a
+ * 0.8.43 user (OSK-9537 verifier). Derived with, per provider:
+ *   for t in $(git tag -l 'daemon-v*' | sort -V); do
+ *     git show "$t:daemon/src/cli-installers.ts" | grep -q "'devin'" && echo "$t" && break
+ *   done
+ * Providers present since managed installers first shipped (0.8.1) are omitted.
+ */
+exports.MANAGED_CLI_PROVIDER_SINCE = Object.freeze({
+    // First offered under its older spelling; the canonical key covers both.
+    [auth_core_1.FIRST_PARTY_HARNESS.provider]: '0.8.2',
+    devin: '0.8.45',
+});
+/**
+ * "Not offered" with the release that added each provider, so a reader learns
+ * WHICH update fixes it rather than only that one might (OSK-9537).
+ */
+function describeProvidersNotOffered(missing) {
+    return missing
+        .map((provider) => {
+        const since = exports.MANAGED_CLI_PROVIDER_SINCE[canonical(provider)];
+        return since ? `${provider} (added in daemon ${since})` : provider;
+    })
+        .join(', ');
+}
 function providersNotOffered(offered, known) {
     // Canonicalize BOTH sides. An older daemon answers under the spelling it was
-    // built with — the 0.8.35 build reports the first-party harness as
-    // `sky-code`, so a raw comparison against `skrr-code` reported it missing on
+    // built with — the 0.8.35 build reports the first-party harness under its
+    // older spelling, so a raw comparison against the current one reported it missing on
     // a machine where it is installed and working. Caught by running this against
     // the very daemon the finding was about: the first version of this helper
-    // said "Not offered: devin, skrr-code" when only `devin` was true.
-    const canonical = (value) => typeof value === 'string' ? String((0, data_provider_1.canonicalHarnessProvider)(value) ?? value) : '';
+    // said "Not offered: devin, <first-party harness>" when only `devin` was true.
     const seen = new Set((offered ?? []).map((provider) => canonical(provider.provider)).filter(Boolean));
     return known.filter((provider) => !seen.has(canonical(provider)));
 }
-async function listCliInstallers(daemonId, credential) {
-    return (0, api_fetch_1.apiFetch)(`/api/daemons/${encodeURIComponent(daemonId)}/cli-installers`, { credential: credential });
+async function listCliInstallers(daemonId, credential, opts = {}) {
+    return (0, api_fetch_1.apiFetch)(`/api/daemons/${encodeURIComponent(daemonId)}/cli-installers`, { credential: credential, ...(opts.signal ? { signal: opts.signal } : {}) });
 }
 /**
  * The one-word readiness verdict for a provider, and whether it is good news.
@@ -95,18 +133,110 @@ function readinessOf(provider) {
     if (!auth) {
         return {
             label: 'unknown',
-            detail: 'Installed. This daemon cannot read this provider’s credential state.',
+            detail: (0, data_provider_1.managedCliReadinessUnknownMessage)(),
             ok: false,
         };
     }
     return { label: auth.status, detail: auth.message, ok: auth.status === 'ready' };
 }
+/** A job the daemon runs to install one managed provider. */
+/**
+ * Readiness per provider for one daemon, keyed by CANONICAL provider — or null
+ * when the daemon could not be asked (disconnected, older, refused).
+ *
+ * The harness row's `authStatus` is the DAEMON's standing with skrr, written
+ * across every row of a daemon at once, so `harnesses show`, `machines show`
+ * and `ping` answered "ok" per provider for a Devin its own CLI called "Not
+ * logged in" (OSK-9263, OSK-9265). This is the per-provider answer those
+ * surfaces print instead. Best-effort by design: a failure here must never
+ * fail the command that asked.
+ */
+async function readinessByProvider(daemonId, credential, opts = {}) {
+    let response;
+    try {
+        response = await listCliInstallers(daemonId, credential, opts);
+    }
+    catch {
+        return null;
+    }
+    const out = new Map();
+    for (const provider of response.providers ?? []) {
+        const key = canonical(provider.provider);
+        if (key)
+            out.set(key, readinessOf(provider));
+    }
+    return out;
+}
+/** The canonical provider a harness row names, for looking it up in that map. */
+function readinessKey(provider) {
+    return canonical(provider);
+}
+/** How long one daemon may take to answer before a list prints `-` for it. */
+exports.ROW_READINESS_TIMEOUT_MS = 5_000;
+/**
+ * Readiness for many harness rows at once: ONE installer read per connected
+ * daemon, all in parallel, however many rows each daemon has.
+ *
+ * Only a row whose daemon can answer is asked for — online and not superseded;
+ * an offline or replaced registration has nobody on the other end. Each read is
+ * bounded, because a list must not hang on one slow machine; a daemon that does
+ * not answer in time reads as unknown (`undefined`), never as `ready`.
+ *
+ * `asked` and `answered` let a caller tell "this daemon does not report it"
+ * from "nothing could be asked", which call for different next steps.
+ */
+async function readinessForRows(rows, credential, opts = {}) {
+    const daemonIds = [
+        ...new Set(rows
+            .filter((row) => row.status === 'online' && !row.superseded && row.daemonId)
+            .map((row) => row.daemonId)),
+    ];
+    const timeoutMs = opts.timeoutMs ?? exports.ROW_READINESS_TIMEOUT_MS;
+    const answers = await Promise.all(daemonIds.map(async (daemonId) => [
+        daemonId,
+        await readinessByProvider(daemonId, credential, {
+            signal: AbortSignal.timeout(timeoutMs),
+        }),
+    ]));
+    const byDaemon = new Map(answers);
+    return {
+        lookup: (row) => row.status === 'online' && !row.superseded && row.daemonId
+            ? byDaemon.get(row.daemonId)?.get(readinessKey(row.provider))
+            : undefined,
+        daemonAnswered: (row) => Boolean(row.daemonId && byDaemon.get(row.daemonId)),
+        asked: daemonIds.length,
+        answered: answers.filter(([, answer]) => answer !== null).length,
+    };
+}
 async function startManagedCliInstall(daemonId, provider, credential) {
     return (0, api_fetch_1.apiFetch)(`/api/daemons/${encodeURIComponent(daemonId)}/cli-installers/${encodeURIComponent(provider)}/install`, { method: 'POST', body: {}, credential: credential });
 }
 async function readManagedCliInstallJob(daemonId, jobId, credential) {
     return (0, api_fetch_1.apiFetch)(`/api/daemons/${encodeURIComponent(daemonId)}/cli-installers/jobs/${encodeURIComponent(jobId)}`, { credential: credential });
 }
+const MAX_TRACKED_LOG_LINES = 400;
+/**
+ * The lines of a job's log tail not yet printed.
+ *
+ * The tail is a SLIDING window: once an installer writes more than the daemon
+ * keeps, earlier lines fall off the front, so an index into it skips or repeats
+ * lines. Instead, find the longest run at the start of the new tail that matches
+ * the end of what was already printed, and print only what follows it.
+ */
+function unseenLogLines(printed, tail) {
+    for (let overlap = Math.min(printed.length, tail.length); overlap > 0; overlap -= 1) {
+        let matches = true;
+        for (let i = 0; i < overlap; i += 1) {
+            if (printed[printed.length - overlap + i] !== tail[i]) {
+                matches = false;
+                break;
+            }
+        }
+        if (matches)
+            return tail.slice(overlap);
+    }
+    return [...tail];
+}
 /** A 100 MB download over a hotel connection is the case this has to survive. */
 exports.INSTALL_MAX_WAIT_MS = 10 * 60_000;
 exports.INSTALL_POLL_INTERVAL_MS = 2_000;
@@ -125,16 +255,19 @@ exports.INSTALL_POLL_INTERVAL_MS = 2_000;
  */
 async function followManagedCliInstallJob(input) {
     const deadline = Date.now() + (input.maxWaitMs ?? exports.INSTALL_MAX_WAIT_MS);
-    let printed = 0;
+    let printed = [];
     for (;;) {
         const res = await readManagedCliInstallJob(input.daemonId, input.jobId, input.credential);
         const job = res.job;
         if (!job)
             return { kind: 'missing', jobId: input.jobId };
         if (input.onLogLine) {
-            for (const line of (job.log ?? []).slice(printed))
+            // `logTail`, the field the daemon sends — this read `log`, which no daemon
+            // has ever sent, so every install printed nothing until it ended (OSK-10103).
+            const fresh = unseenLogLines(printed, job.logTail ?? job.log ?? []);
+            for (const line of fresh)
                 input.onLogLine(line);
-            printed = (job.log ?? []).length;
+            printed = [...printed, ...fresh].slice(-MAX_TRACKED_LOG_LINES);
         }
         if (job.status === 'succeeded' || job.status === 'failed')
             return { kind: 'settled', job };

package/dist/lib/command-miss.d.ts

@@ -23,6 +23,8 @@ export type CommandLookup = {
     bin: string;
     findCommand: (id: string) => {
         flags?: Record<string, unknown>;
+        args?: Record<string, unknown>;
+        strict?: boolean;
     } | undefined;
     commandIDs: string[];
     topicNames: string[];
@@ -34,6 +36,26 @@ export declare function editDistance(a: string, b: string): number;
  * only a verdict.
  */
 export declare function nearestCommands(id: string, all: string[], limit?: number): string[];
+/**
+ * The command id a `--help` request is about, resolved the way oclif resolves
+ * the same words when they are RUN.
+ *
+ * The help override used to join every leading word into the id, so
+ * `skrr harnesses install devin --help` asked for `harnesses:install:devin`,
+ * found no such command, and reported that `harnesses install` "does not take
+ * the positional argument `devin`" — the positional its own help lists
+ * (OSK-10099). Running the same words works, because oclif stops collecting id
+ * words at the first resolved command that takes arguments: from there on a
+ * word is an argument, not part of the name. Adding `--help` to a command you
+ * are about to run is the commonest way to check it, so the two must agree.
+ *
+ * Mirrors `collateSpacedCmdIDFromArgs` in `@oclif/core/lib/help/util` (not a
+ * public export): a word extends the id while the longer id is a command or a
+ * prefix of one; otherwise it is appended only when the id so far is not a
+ * command that accepts arguments, so a genuinely wrong word under a command
+ * that takes none (`daemon reload`) still reaches the miss message.
+ */
+export declare function helpSubjectId(tokens: readonly string[], config: CommandLookup): string;
 /**
  * The message for a colon-joined id that did not resolve.
  *

package/dist/lib/command-miss.js

@@ -22,10 +22,44 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.editDistance = editDistance;
 exports.nearestCommands = nearestCommands;
+exports.helpSubjectId = helpSubjectId;
 exports.describeCommandMiss = describeCommandMiss;
 exports.lookupFromConfig = lookupFromConfig;
 /** A uuid-ish token, which is what a stray space id looks like. */
 const LOOKS_LIKE_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const DAEMON_READINESS = [
+    {
+        id: 'harnesses:installers',
+        usage: 'harnesses installers --daemon <id>',
+        answers: 'whether each coding-agent CLI on that machine is installed, and signed in where the daemon can tell',
+    },
+    {
+        id: 'daemon:status',
+        usage: 'daemon status',
+        answers: 'whether the daemon itself is running and connected',
+    },
+];
+const ANSWERED_ELSEWHERE = {
+    daemon: {
+        health: DAEMON_READINESS,
+        readiness: DAEMON_READINESS,
+        ready: DAEMON_READINESS,
+        doctor: DAEMON_READINESS,
+        check: DAEMON_READINESS,
+    },
+};
+// `skrr daemons <sub>` is the same topic.
+const ANSWERED_ELSEWHERE_BY_COMMAND = { ...ANSWERED_ELSEWHERE, daemons: ANSWERED_ELSEWHERE.daemon };
+function describeAnsweredElsewhere(config, resolved, extras) {
+    if (extras.length !== 1)
+        return null;
+    const targets = (ANSWERED_ELSEWHERE_BY_COMMAND[resolved]?.[extras[0].toLowerCase()] ?? []).filter((target) => config.findCommand(target.id) !== undefined);
+    if (targets.length === 0)
+        return null;
+    const spoken = `${config.bin} ${resolved.split(':').join(' ')}`;
+    return (`\`${spoken}\` has no \`${extras[0]}\`. Depending on what you want to know:\n` +
+        targets.map((t) => `  \`${config.bin} ${t.usage}\` — ${t.answers}`).join('\n'));
+}
 /** Cheap edit distance, bounded — this runs only on a miss. */
 function editDistance(a, b) {
     const rows = a.length + 1;
@@ -60,6 +94,47 @@ function nearestCommands(id, all, limit = 3) {
         .slice(0, limit)
         .map(({ candidate }) => candidate));
 }
+/**
+ * The command id a `--help` request is about, resolved the way oclif resolves
+ * the same words when they are RUN.
+ *
+ * The help override used to join every leading word into the id, so
+ * `skrr harnesses install devin --help` asked for `harnesses:install:devin`,
+ * found no such command, and reported that `harnesses install` "does not take
+ * the positional argument `devin`" — the positional its own help lists
+ * (OSK-10099). Running the same words works, because oclif stops collecting id
+ * words at the first resolved command that takes arguments: from there on a
+ * word is an argument, not part of the name. Adding `--help` to a command you
+ * are about to run is the commonest way to check it, so the two must agree.
+ *
+ * Mirrors `collateSpacedCmdIDFromArgs` in `@oclif/core/lib/help/util` (not a
+ * public export): a word extends the id while the longer id is a command or a
+ * prefix of one; otherwise it is appended only when the id so far is not a
+ * command that accepts arguments, so a genuinely wrong word under a command
+ * that takes none (`daemon reload`) still reaches the miss message.
+ */
+function helpSubjectId(tokens, config) {
+    const usable = new Set();
+    for (const id of [...config.commandIDs, ...config.topicNames]) {
+        const parts = id.split(':');
+        for (let i = 1; i <= parts.length; i += 1)
+            usable.add(parts.slice(0, i).join(':'));
+    }
+    const taken = [];
+    for (const token of tokens) {
+        if (token.startsWith('-') || token.includes('='))
+            break;
+        if (usable.has([...taken, token].join(':'))) {
+            taken.push(token);
+            continue;
+        }
+        const current = taken.length > 0 ? config.findCommand(taken.join(':')) : undefined;
+        if (current && (current.strict === false || Object.keys(current.args ?? {}).length > 0))
+            break;
+        taken.push(token);
+    }
+    return taken.join(':');
+}
 /**
  * The message for a colon-joined id that did not resolve.
  *
@@ -81,6 +156,9 @@ function describeCommandMiss(config, id) {
         if (!found)
             continue;
         const extras = parts.slice(take);
+        const redirect = describeAnsweredElsewhere(config, parts.slice(0, take).join(':'), extras);
+        if (redirect)
+            return redirect;
         const spoken = `${config.bin} ${parts.slice(0, take).join(' ')}`;
         // Suggest the flag only when the command actually has it, so the hint can
         // never point at something that does not exist.

package/dist/lib/daemon-setup.js

@@ -62,7 +62,7 @@ async function offerDaemonSetup(opts = {}) {
     }
     const confirmImpl = opts.confirmImpl ?? prompt_1.confirm;
     log('');
-    log('  This machine has no skrr runtime. It is what lets your agents work here —');
+    log('  This computer has no skrr background service. It is what lets your agents work here —');
     log('  running commands, editing files, and driving a browser on this machine.');
     // This creates a persistent service with broad local capabilities, so a
     // bare Enter must visibly and behaviorally decline it. `confirm` names its
@@ -100,7 +100,7 @@ async function offerDaemonSetup(opts = {}) {
         if (err.message === 'runtime-binary-not-installed') {
             return {
                 status: 'failed',
-                detail: 'the runtime vanished between fetching and installing it',
+                detail: 'the background service vanished between fetching and installing it',
             };
         }
         return { status: 'failed', detail: err.message };

package/dist/lib/daemon-target.d.ts

@@ -99,5 +99,19 @@ export interface ResolveDaemonTargetInput {
     listActiveDaemons: () => Promise<ActiveDaemonRow[]>;
 }
 export declare function resolveDaemonTarget(input: ResolveDaemonTargetInput): Promise<DaemonTarget>;
+/**
+ * Daemons that are CONNECTED right now, under the id the daemon-control API
+ * takes (`daemon_…`, `dedicated-runtime-…`).
+ *
+ * `listActiveDaemons` returns Daemon RESOURCE rows: "active" means not revoked,
+ * and `id` is the resource's own id. The installer routes relay an RPC to a
+ * connected daemon by its connection id, so that list could not be used to pick
+ * one: its refusal counted 50 "active daemons" — most of them sandboxes gone for
+ * weeks — and suggested values like `d_69eb2d1e...` that `--daemon` then failed
+ * to find, and a single "active" daemon would have been auto-picked by an id no
+ * route accepts (OSK-9993). Online harness rows carry exactly the ids and the
+ * liveness needed, one row per (daemon, provider).
+ */
+export declare function listConnectedDaemons(credential: ResolvedCredential): Promise<ActiveDaemonRow[]>;
 /** The same list `skrr list-daemons` prints, so a refusal can name values that work. */
 export declare function listActiveDaemons(credential: ResolvedCredential): Promise<ActiveDaemonRow[]>;