@skrr-ai/cli 0.1.40 → 0.1.41

package/dist/lib/daemon-target.js

@@ -45,6 +45,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.localMachine = localMachine;
 exports.resolveDaemonTarget = resolveDaemonTarget;
+exports.listConnectedDaemons = listConnectedDaemons;
 exports.listActiveDaemons = listActiveDaemons;
 const api_fetch_1 = require("./api-fetch");
 const daemonBroker_1 = require("./daemonBroker");
@@ -103,6 +104,37 @@ async function resolveDaemonTarget(input) {
         return { kind: 'none' };
     return { kind: 'ambiguous', daemons };
 }
+/**
+ * Daemons that are CONNECTED right now, under the id the daemon-control API
+ * takes (`daemon_…`, `dedicated-runtime-…`).
+ *
+ * `listActiveDaemons` returns Daemon RESOURCE rows: "active" means not revoked,
+ * and `id` is the resource's own id. The installer routes relay an RPC to a
+ * connected daemon by its connection id, so that list could not be used to pick
+ * one: its refusal counted 50 "active daemons" — most of them sandboxes gone for
+ * weeks — and suggested values like `d_69eb2d1e...` that `--daemon` then failed
+ * to find, and a single "active" daemon would have been auto-picked by an id no
+ * route accepts (OSK-9993). Online harness rows carry exactly the ids and the
+ * liveness needed, one row per (daemon, provider).
+ */
+async function listConnectedDaemons(credential) {
+    const res = await (0, api_fetch_1.apiFetch)('/api/harnesses?status=online', { credential });
+    const byDaemon = new Map();
+    for (const row of res.harnesses ?? []) {
+        if (row.status !== 'online' || !row.daemonId || byDaemon.has(row.daemonId))
+            continue;
+        // A harness is named "<provider> — <machine>"; the machine half names the daemon.
+        const separator = typeof row.name === 'string' ? row.name.indexOf(' — ') : -1;
+        byDaemon.set(row.daemonId, {
+            id: row.daemonId,
+            name: separator === -1 ? undefined : row.name.slice(separator + 3),
+            isActive: true,
+        });
+    }
+    // Stable order: the server returns rows most-recently-seen first, so two
+    // commands refusing one ambiguity listed the same daemons in different orders.
+    return [...byDaemon.values()].sort((a, b) => a.id.localeCompare(b.id));
+}
 /** The same list `skrr list-daemons` prints, so a refusal can name values that work. */
 async function listActiveDaemons(credential) {
     const res = await (0, api_fetch_1.apiFetch)('/api/daemon-resources?status=active&limit=50', { credential });

package/dist/lib/daemonBroker.js

@@ -311,7 +311,7 @@ async function attemptDaemonBrokerLogin(opts) {
             return {
                 ok: false,
                 reason: 'base_url_mismatch',
-                detail: `No local skrr runtime is logged in to ${opts.baseURL}; available daemon is logged in to ${mismatchedBootstrap.serverUrl}.`,
+                detail: `The skrr background service on this computer is not logged in to ${opts.baseURL}; it is logged in to ${mismatchedBootstrap.serverUrl}.`,
                 daemonServerUrl: mismatchedBootstrap.serverUrl,
             };
         }

package/dist/lib/daemonHandoff.js

@@ -208,7 +208,7 @@ async function handOffToLocalDaemon(env = process.env, opts = {}) {
         return {
             status: 'skipped',
             reason: 'legacy-binary',
-            detail: 'a legacy oversky runtime is installed; bootstrap a current skrr runtime',
+            detail: 'a legacy oversky background service is installed; bootstrap a current skrr one',
         };
     }
     // An older daemon has no `accept-handoff`, and spawning it would fail with

package/dist/lib/exec-runtime-binary.js

@@ -64,7 +64,7 @@ exports.RUNTIME_BINARY_NAMES = ['skrrd', 'oversky'];
  */
 function forwardedFlagsNote(verb, opts = {}) {
     const base = opts.bootstrapsRuntime
-        ? `If no local runtime exists, this command first fetches the signed release. After it is ` +
+        ? `If the background service is not on this computer yet, this command first fetches the signed release. After it is ` +
             `installed, flags are forwarded to \`skrrd ${verb}\` unchanged; run \`skrrd ${verb} --help\` ` +
             `for this verb's own flags, or \`skrrd --help\` for global ones such as \`--profile\`.`
         : `Flags are forwarded to \`skrrd ${verb}\` unchanged, so they are not listed here —` +
@@ -196,7 +196,7 @@ function isExecutable(p) {
  */
 function notInstalledMessage() {
     return [
-        'The skrr local runtime is not installed on this machine.',
+        'The skrr background service is not installed on this computer.',
         '',
         'Install:',
         '  macOS:   brew install dush1023/oversky/oversky',

package/dist/lib/followups.d.ts

@@ -1,6 +1,12 @@
 import { withQuery } from './triggers';
 type Query = Parameters<typeof withQuery>[1];
 type Json = Record<string, unknown>;
+/**
+ * The line a settle verb prints. A follow-up that had already ended is said to
+ * have ended, with the terminal it actually has, rather than reported as the
+ * thing this command would have done (OSK-10038).
+ */
+export declare function settledLine(id: string, result: Record<string, unknown>, done: string): string;
 /**
  * The `id` argument every follow-up command that addresses one takes.
  *
@@ -37,6 +43,10 @@ export interface FollowUpRow {
     /** Who settled it: `trigger_fire` for the runtime, otherwise the actor. */
     terminalBy?: string | null;
     escalatedInitiativeId?: string | null;
+    /** The gate the fire passes: exempt_silent, exempt_user_directed, exempt_system, user_directed_guarded, autonomy_ladder, approval_ladder. */
+    gate?: string | null;
+    /** Set while its fire waits on an offline machine; it escalates after 60 minutes. */
+    parkedAt?: string | null;
     capsule?: unknown;
     nextRunAt?: string | null;
     deadlineAt?: string | null;

package/dist/lib/followups.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.followupsApi = exports.WATCH_WAIT_KINDS = exports.FOLLOWUP_RESOLVE_OUTCOMES = exports.FOLLOWUP_STATES = exports.FOLLOWUP_KINDS = exports.followUpIdArg = void 0;
+exports.settledLine = settledLine;
 exports.resolveFollowUpAgent = resolveFollowUpAgent;
 exports.parseSubjectRef = parseSubjectRef;
 exports.followupSummaryLine = followupSummaryLine;
@@ -26,6 +27,18 @@ const triggers_1 = require("./triggers");
 const agent_resolver_1 = require("./agent-resolver");
 const MOUNT = '/api/followups';
 const base = (id) => `${MOUNT}/${encodeURIComponent(id)}`;
+/**
+ * The line a settle verb prints. A follow-up that had already ended is said to
+ * have ended, with the terminal it actually has, rather than reported as the
+ * thing this command would have done (OSK-10038).
+ */
+function settledLine(id, result, done) {
+    const followup = result.followup;
+    if (result.alreadySettled === true) {
+        return `Follow-up ${id} was already settled${followup?.terminal ? ` (${followup.terminal})` : ''}; nothing changed.`;
+    }
+    return `Follow-up ${id} ${done}.`;
+}
 /**
  * The `id` argument every follow-up command that addresses one takes.
  *
@@ -79,7 +92,7 @@ function resolveFollowUpAgent(explicitAgentId, env = process.env) {
         if (explicitAgentId && explicitAgentId !== sessionAgent.id) {
             throw new agent_resolver_1.AgentResolutionError({
                 code: 'AGENT_CONTEXT_CONFLICT',
-                message: 'This local runtime is bound to a session agent. Do not override it with another agent ID.',
+                message: 'This session is bound to its session agent. Do not override it with another agent ID.',
                 suggestion: 'Use the bound session agent, or start a new daemon session for a different agent.',
                 details: { explicitAgentId, sessionAgentId: sessionAgent.id, source: sessionAgent.source },
             });

package/dist/lib/format.d.ts

@@ -78,6 +78,17 @@ export declare function renderTable<T extends Record<string, string>>(rows: T[],
  * should print it in the reader's zone and name that zone once.
  */
 export declare function localStamp(value: unknown): string;
+/**
+ * One timestamp that carries its own zone: `2026-08-21 17:54:03 PDT`.
+ *
+ * For key/value output and any row that cannot share a header naming the zone.
+ * About 25 commands formatted with `toISOString().slice(0, 19)` — UTC with no
+ * marker, which reads as local time — while `harnesses list` and `machines`
+ * printed local time with the zone named, so one CLI kept two clocks
+ * (OSK-10041). Seconds, because the commands that print these (task runs,
+ * activity, monitor) order events seconds apart. Never throws.
+ */
+export declare function localTime(value: unknown): string;
 /**
  * `PDT` — the zone `localStamp` renders in, to be named once per command
  * rather than repeated on every row.

package/dist/lib/format.js

@@ -7,6 +7,7 @@ exports.formatCell = formatCell;
 exports.collapseWhitespace = collapseWhitespace;
 exports.renderTable = renderTable;
 exports.localStamp = localStamp;
+exports.localTime = localTime;
 exports.localZone = localZone;
 /**
  * Code points that occupy TWO terminal columns (Unicode East Asian Wide and
@@ -212,6 +213,26 @@ function localStamp(value) {
     return (`${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())} ` +
         `${pad(date.getHours())}:${pad(date.getMinutes())}`);
 }
+/**
+ * One timestamp that carries its own zone: `2026-08-21 17:54:03 PDT`.
+ *
+ * For key/value output and any row that cannot share a header naming the zone.
+ * About 25 commands formatted with `toISOString().slice(0, 19)` — UTC with no
+ * marker, which reads as local time — while `harnesses list` and `machines`
+ * printed local time with the zone named, so one CLI kept two clocks
+ * (OSK-10041). Seconds, because the commands that print these (task runs,
+ * activity, monitor) order events seconds apart. Never throws.
+ */
+function localTime(value) {
+    if (value === null || value === undefined || value === '')
+        return '-';
+    const date = value instanceof Date ? value : new Date(typeof value === 'number' ? value : String(value));
+    if (Number.isNaN(date.getTime()))
+        return String(value);
+    const zone = localZone(date);
+    const seconds = `${date.getSeconds()}`.padStart(2, '0');
+    return `${localStamp(date)}:${seconds}${zone ? ` ${zone}` : ''}`;
+}
 /**
  * `PDT` — the zone `localStamp` renders in, to be named once per command
  * rather than repeated on every row.

package/dist/lib/harness-labels.d.ts

@@ -0,0 +1,39 @@
+/**
+ * How a harness row's provider and status read in human output — ONE rule for
+ * `harnesses list` and `harnesses show`.
+ *
+ * Both findings this closes were the same defect on two columns: the rule lived
+ * in one command and not the other.
+ *
+ *   - Status (OSK-9610): `list` printed `superseded` for a row a later
+ *     registration replaced; `show` printed `offline` for the same id. The server
+ *     sends `superseded` on both routes — `show` never read it.
+ *   - Provider (OSK-9649 / OSK-9290): the web renders the placeholder row of a
+ *     machine with no coding engine as "No coding agent installed" and folds the
+ *     first-party harness's older spelling into its current one. The CLI printed
+ *     the stored value — `oversky` on 111 rows, and the first-party harness's
+ *     older spelling beside its current one — so one product had three names here.
+ *
+ * `--json` keeps the stored values: it is the API contract, not a rendering.
+ */
+/** What the PROVIDER column says for a machine that has no coding engine. */
+export declare const NO_CODING_AGENT_PROVIDER_LABEL = "none";
+export declare function harnessStatusLabel(row: {
+    status?: string | null;
+    superseded?: boolean | null;
+}): string;
+export declare function isNoCodingAgentProvider(provider: string | null | undefined): boolean;
+export declare function harnessProviderLabel(provider: string | null | undefined): string;
+/**
+ * YOUR alias is what `name` shows and it differs from the name everyone else
+ * sees. The server sends both (`aliased`, `sharedName`); every human surface
+ * asks this one question of them, so `list`, `show` and `update --name` cannot
+ * disagree about whether a row is aliased (OSK-10004).
+ */
+export declare function isAliasCoveringSharedName(row: {
+    name?: string | null;
+    sharedName?: string | null;
+    aliased?: boolean | null;
+}): boolean;
+/** The longer phrase, for a single-row view with room for it. */
+export declare function harnessProviderDescription(provider: string | null | undefined): string;

package/dist/lib/harness-labels.js

@@ -0,0 +1,60 @@
+"use strict";
+/**
+ * How a harness row's provider and status read in human output — ONE rule for
+ * `harnesses list` and `harnesses show`.
+ *
+ * Both findings this closes were the same defect on two columns: the rule lived
+ * in one command and not the other.
+ *
+ *   - Status (OSK-9610): `list` printed `superseded` for a row a later
+ *     registration replaced; `show` printed `offline` for the same id. The server
+ *     sends `superseded` on both routes — `show` never read it.
+ *   - Provider (OSK-9649 / OSK-9290): the web renders the placeholder row of a
+ *     machine with no coding engine as "No coding agent installed" and folds the
+ *     first-party harness's older spelling into its current one. The CLI printed
+ *     the stored value — `oversky` on 111 rows, and the first-party harness's
+ *     older spelling beside its current one — so one product had three names here.
+ *
+ * `--json` keeps the stored values: it is the API contract, not a rendering.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NO_CODING_AGENT_PROVIDER_LABEL = void 0;
+exports.harnessStatusLabel = harnessStatusLabel;
+exports.isNoCodingAgentProvider = isNoCodingAgentProvider;
+exports.harnessProviderLabel = harnessProviderLabel;
+exports.isAliasCoveringSharedName = isAliasCoveringSharedName;
+exports.harnessProviderDescription = harnessProviderDescription;
+const data_provider_1 = require("@skrr-ai/data-provider");
+/** What the PROVIDER column says for a machine that has no coding engine. */
+exports.NO_CODING_AGENT_PROVIDER_LABEL = 'none';
+function harnessStatusLabel(row) {
+    if (row.superseded)
+        return 'superseded';
+    return typeof row.status === 'string' && row.status.length > 0 ? row.status : 'unknown';
+}
+function isNoCodingAgentProvider(provider) {
+    return typeof provider === 'string' && (0, data_provider_1.isManagedProductFallbackProvider)(provider);
+}
+function harnessProviderLabel(provider) {
+    if (typeof provider !== 'string' || provider.length === 0)
+        return 'unknown';
+    if (isNoCodingAgentProvider(provider))
+        return exports.NO_CODING_AGENT_PROVIDER_LABEL;
+    return String((0, data_provider_1.canonicalHarnessProvider)(provider) ?? provider);
+}
+/**
+ * YOUR alias is what `name` shows and it differs from the name everyone else
+ * sees. The server sends both (`aliased`, `sharedName`); every human surface
+ * asks this one question of them, so `list`, `show` and `update --name` cannot
+ * disagree about whether a row is aliased (OSK-10004).
+ */
+function isAliasCoveringSharedName(row) {
+    return Boolean(row.aliased && row.sharedName && row.sharedName !== row.name);
+}
+/** The longer phrase, for a single-row view with room for it. */
+function harnessProviderDescription(provider) {
+    if (isNoCodingAgentProvider(provider)) {
+        return `${exports.NO_CODING_AGENT_PROVIDER_LABEL} — ${(0, data_provider_1.managedProductFallbackLabel)().toLowerCase()} on this machine`;
+    }
+    return harnessProviderLabel(provider);
+}

package/dist/lib/harnesses.d.ts

@@ -51,6 +51,12 @@ export interface Harness {
     sharedName?: string;
     aliased?: boolean;
     status?: string;
+    /**
+     * A later registration on the same machine replaced this row. Sent by both
+     * the list and the single-row routes; human output shows it instead of the
+     * stored status (`harnessStatusLabel`, OSK-9610).
+     */
+    superseded?: boolean;
     harnessLocation?: 'local' | 'cloud';
     daemonId?: string;
     machineUuid?: string;

package/dist/lib/instruction-input.d.ts

@@ -76,3 +76,16 @@ export declare function describeTargetSync(target: {
     updatedAt?: string;
     driftCount?: number;
 }, now?: number, liveDaemonIds?: string[]): string;
+/**
+ * The command that re-binds a stalled target to the daemon now running on its
+ * machine, or null when no such daemon is live.
+ *
+ * A daemon started a different way on the same machine (launchd → cli) gets a
+ * new id, and a target stays bound to the old one. Placement is the machine, not
+ * the daemon, so the recovery is `update-target --daemon`, never a re-install,
+ * which the placement index refuses (OSK-9961).
+ */
+export declare function rebindCommandFor(target: {
+    id: string;
+    daemonId?: string | null;
+}, liveDaemonIds: readonly string[]): string | null;

package/dist/lib/instruction-input.js

@@ -7,6 +7,7 @@ exports.resolveBundleLabel = resolveBundleLabel;
 exports.parseDaemonId = parseDaemonId;
 exports.sameMachineDaemon = sameMachineDaemon;
 exports.describeTargetSync = describeTargetSync;
+exports.rebindCommandFor = rebindCommandFor;
 const promises_1 = require("node:fs/promises");
 async function readStdin() {
     const chunks = [];
@@ -180,7 +181,25 @@ function describeTargetSync(target, now = Date.now(), liveDaemonIds = []) {
         const live = parseDaemonId(elsewhere);
         const pinned = parseDaemonId(target.daemonId || '');
         // Kept under the STATUS column's `maxWidth: 78`, same constraint as below.
-        return `${base} — stalled ${days}d; daemon here now runs as ${live?.source}, not ${pinned?.source}: re-install`;
+        // Re-bind, not re-install: install refuses a second target on the same
+        // placement, so "re-install" was a remedy that could not succeed (OSK-9961).
+        // The full command does not fit the column; status prints it below.
+        return `${base} — stalled ${days}d; daemon here now runs as ${live?.source}, not ${pinned?.source}: re-bind below`;
     }
     return `${base} — stalled ${days}d; daemon may be gone: remove, then purge-target --force`;
 }
+/**
+ * The command that re-binds a stalled target to the daemon now running on its
+ * machine, or null when no such daemon is live.
+ *
+ * A daemon started a different way on the same machine (launchd → cli) gets a
+ * new id, and a target stays bound to the old one. Placement is the machine, not
+ * the daemon, so the recovery is `update-target --daemon`, never a re-install,
+ * which the placement index refuses (OSK-9961).
+ */
+function rebindCommandFor(target, liveDaemonIds) {
+    if (!target.daemonId || liveDaemonIds.includes(target.daemonId))
+        return null;
+    const live = sameMachineDaemon(target.daemonId, [...liveDaemonIds]);
+    return live ? `skrr instructions update-target ${target.id} --daemon ${live}` : null;
+}

package/dist/lib/local-skills.d.ts

@@ -38,7 +38,23 @@ export declare function isUserInvocable(skill: Pick<DaemonLocalSkill, 'triggers'
  * dropped, because the server's own rule is that a skill the user picked and
  * the turn did not load must fail the turn rather than run without it.
  */
-export declare function resolveLocalSkillRefs(inventory: ReadonlyArray<DaemonLocalSkill>, requested: ReadonlyArray<string>): {
+/**
+ * The restart that refreshes THIS daemon's inventory. A daemon id is
+ * `daemon_<machine>_<source>_<profile>`; a bare `skrr daemon restart` restarts
+ * the default profile, so for any other profile the hint named a different
+ * daemon than the one whose list was stale (OSK-10080 verifier).
+ */
+export declare function daemonRestartCommand(daemonId: string | undefined): string;
+export declare function resolveLocalSkillRefs(inventory: ReadonlyArray<DaemonLocalSkill>, requested: ReadonlyArray<string>, options?: {
+    /**
+     * The inventory is what the daemon reported when it last registered, not a
+     * live read. A skill added since is missing from it — for up to an hour, until
+     * the daemon reconnects — so "not on this machine" would be false (OSK-10080).
+     */
+    snapshot?: boolean;
+    /** Whose snapshot, so the refresh hint restarts the right daemon. */
+    daemonId?: string;
+}): {
     refs: Array<{
         name: string;
         pathHash: string;

package/dist/lib/local-skills.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.SKILL_CONVENTION_DISCOVERY_SINCE = void 0;
 exports.chooseDaemon = chooseDaemon;
 exports.isUserInvocable = isUserInvocable;
+exports.daemonRestartCommand = daemonRestartCommand;
 exports.resolveLocalSkillRefs = resolveLocalSkillRefs;
 exports.withSkillInvocations = withSkillInvocations;
 exports.looksLikeSkillPath = looksLikeSkillPath;
@@ -10,6 +11,7 @@ exports.findLocalSkillsNamed = findLocalSkillsNamed;
 exports.describeStoreSkillMiss = describeStoreSkillMiss;
 exports.daemonPredates = daemonPredates;
 const data_provider_1 = require("@skrr-ai/data-provider");
+const instruction_input_1 = require("./instruction-input");
 /**
  * Which machine to ask, or why there is no single answer.
  *
@@ -44,7 +46,19 @@ function isUserInvocable(skill) {
  * dropped, because the server's own rule is that a skill the user picked and
  * the turn did not load must fail the turn rather than run without it.
  */
-function resolveLocalSkillRefs(inventory, requested) {
+/**
+ * The restart that refreshes THIS daemon's inventory. A daemon id is
+ * `daemon_<machine>_<source>_<profile>`; a bare `skrr daemon restart` restarts
+ * the default profile, so for any other profile the hint named a different
+ * daemon than the one whose list was stale (OSK-10080 verifier).
+ */
+function daemonRestartCommand(daemonId) {
+    const profile = daemonId ? (0, instruction_input_1.parseDaemonId)(daemonId)?.profile : undefined;
+    return profile && profile !== 'default'
+        ? `skrr daemon restart --profile ${profile}`
+        : 'skrr daemon restart';
+}
+function resolveLocalSkillRefs(inventory, requested, options = {}) {
     const refs = [];
     const problems = [];
     const seen = new Set();
@@ -58,7 +72,11 @@ function resolveLocalSkillRefs(inventory, requested) {
         if (matches.length === 0) {
             problems.push(named.length > 0
                 ? `No skill "${name}" under ${root}. It is under: ${named.map((s) => s.source ?? '?').join(', ')}.`
-                : `No skill named "${name}" on this machine. See \`skrr skills local\`.`);
+                : options.snapshot
+                    ? `No skill named "${name}" in the list this machine's daemon reported when it last connected. ` +
+                        `A skill added since then appears after the daemon reconnects — run \`${daemonRestartCommand(options.daemonId)}\` on that machine. ` +
+                        'See `skrr skills local`.'
+                    : `No skill named "${name}" on this machine. See \`skrr skills local\`.`);
             continue;
         }
         if (matches.length > 1) {

package/dist/lib/login.js

@@ -84,7 +84,7 @@ async function cliLogin(opts = {}) {
         });
         if (brokerResult.ok) {
             console.log('');
-            console.log('  Authorized via the local skrr runtime (no browser needed).');
+            console.log('  Authorized via the skrr background service on this computer (no browser needed).');
             return {
                 token: brokerResult.accessToken,
                 refreshToken: brokerResult.refreshToken,
@@ -107,7 +107,7 @@ async function cliLogin(opts = {}) {
         // broker failures — missing bootstrap, network blip, server 5xx —
         // silently fall through to PKCE / device-code below.
         if (brokerResult.reason === 'ci_token_refused') {
-            throw new Error('The local skrr runtime is bootstrapped from a CI token, which cannot broker an interactive CLI login. ' +
+            throw new Error('The skrr background service on this computer is bootstrapped from a CI token, which cannot broker an interactive CLI login. ' +
                 'Use `skrr create-token --name <name>` to mint a long-lived CI credential directly, ' +
                 'or run `skrr login` on a machine where the daemon was authenticated interactively.');
         }
@@ -126,19 +126,19 @@ async function cliLogin(opts = {}) {
             brokerRateLimited = true;
             if (!(0, ssh_detect_1.isNonInteractive)()) {
                 console.log('');
-                console.log('  The local skrr runtime has brokered several logins recently and the server is ' +
+                console.log('  The skrr background service on this computer has brokered several logins recently and the server is ' +
                     'rate-limiting them. Falling back to the browser flow.');
             }
         }
         if (brokerResult.reason === 'base_url_mismatch' && brokerResult.daemonServerUrl) {
             console.log('');
-            console.log(`  The local skrr runtime is logged in to ${brokerResult.daemonServerUrl}, but skrr is configured for ${serverUrl}.`);
+            console.log(`  The skrr background service on this computer is logged in to ${brokerResult.daemonServerUrl}, but skrr is configured for ${serverUrl}.`);
             console.log(`  Skipping the daemon-broker handoff. Run \`skrr login --base-url ${brokerResult.daemonServerUrl}\` to use the daemon instead.`);
         }
     }
     if ((0, ssh_detect_1.isNonInteractive)()) {
         throw new Error(brokerRateLimited
-            ? 'The local skrr runtime is being rate-limited while brokering logins, and this ' +
+            ? 'The skrr background service on this computer is being rate-limited while brokering logins, and this ' +
                 'shell cannot run the browser flow instead. The limit is per 15-minute window — ' +
                 'retry shortly. For CI, use `skrr create-token` and set OVERSKY_TOKEN=osk_ci_...'
             : 'skrr login requires an interactive terminal or an SSH session. ' +

package/dist/lib/machines.d.ts

@@ -112,6 +112,12 @@ export interface Machine {
  * could come back says so, and a destroyed one cannot.
  */
 export declare function machineStateLabel(machine: Machine): string;
+/**
+ * What a list says it left out, by the label each hidden machine would have
+ * printed: `250 terminated, 5 offline, 1 paused`. "offline or terminated"
+ * called a paused machine offline after the table stopped doing so (OSK-9996).
+ */
+export declare function hiddenMachinesSummary(hidden: readonly Machine[]): string;
 /** Is this a machine a user could still use, or bring back? */
 export declare function isReachableMachine(machine: Machine): boolean;
 /** The user-editable slice. Identities, capabilities and lifecycle are not. */

package/dist/lib/machines.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.machineStateLabel = machineStateLabel;
+exports.hiddenMachinesSummary = hiddenMachinesSummary;
 exports.isReachableMachine = isReachableMachine;
 exports.liveHarnessCount = liveHarnessCount;
 exports.listMachines = listMachines;
@@ -30,8 +31,36 @@ function machineStateLabel(machine) {
     if (controls && controls.canResume === false && controls.canTerminate === false) {
         return 'terminated';
     }
+    // A leased machine at rest says WHICH rest. `machines hosted list` printed
+    // `paused` and this list printed `offline` for the same machine, with the
+    // reason only in `machines show` (OSK-9996). `offline` stays for a machine
+    // that simply is not connected.
+    const leaseState = machine.lease?.state;
+    if (leaseState === 'paused' || leaseState === 'stopped')
+        return leaseState;
+    // A lease the provider has ended cannot come back either; it read `offline`
+    // while an unleased dead sandbox read `terminated`, so the hidden-machine
+    // footer counted 95 ended leases as offline (OSK-9996 verifier).
+    if (leaseState === 'terminated')
+        return 'terminated';
     return 'offline';
 }
+/**
+ * What a list says it left out, by the label each hidden machine would have
+ * printed: `250 terminated, 5 offline, 1 paused`. "offline or terminated"
+ * called a paused machine offline after the table stopped doing so (OSK-9996).
+ */
+function hiddenMachinesSummary(hidden) {
+    const counts = new Map();
+    for (const machine of hidden) {
+        const label = machineStateLabel(machine);
+        counts.set(label, (counts.get(label) ?? 0) + 1);
+    }
+    return [...counts.entries()]
+        .sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]))
+        .map(([label, count]) => `${count} ${label}`)
+        .join(', ');
+}
 /** Is this a machine a user could still use, or bring back? */
 function isReachableMachine(machine) {
     return machineStateLabel(machine) !== 'terminated' && machine.status !== 'offline';
@@ -105,6 +134,22 @@ function hostedSandboxDaemonIds(ref) {
         return [];
     return [`hosted-machine-${ref}`, `hosted-job-machine-${ref}`];
 }
+/**
+ * An id with its identity-kind prefix removed: `lease:rtl_…` → `rtl_…`,
+ * `dedicated-runtime:rtl_…` → `rtl_…`, `machine:0354…` → `0354…`.
+ *
+ * Other commands print the bare form. `machines dedicated list` and the lease
+ * payloads name `rtl_…`, and `harnesses list`'s MACHINE column prints the head
+ * of the identifier after the kind — so the id a user has to hand often lacks
+ * the prefix this list keys on, and `machines show rtl_…` answered "No machine
+ * matches" for a machine it was listing as `lease:rtl_…` (OSK-9269, OSK-9290).
+ */
+function withoutIdentityKind(value) {
+    if (!value)
+        return undefined;
+    const separator = value.indexOf(':');
+    return separator === -1 ? undefined : value.slice(separator + 1);
+}
 function resolveMachineRef(machines, ref) {
     const needle = ref.trim();
     const lower = needle.toLowerCase();
@@ -121,13 +166,26 @@ function resolveMachineRef(machines, ref) {
         // two unrelated-looking ids, no way on screen to tell they are one
         // machine. Exact composition, not a substring search, so this cannot
         // match a machine that merely contains the text.
-        hostedSandboxDaemonIds(needle).some((candidate) => m.daemonId === candidate));
+        hostedSandboxDaemonIds(needle).some((candidate) => m.daemonId === candidate) ||
+        withoutIdentityKind(m.id) === needle ||
+        withoutIdentityKind(m.machineUuid) === needle ||
+        // A harness id names exactly one machine — the one it is registered on.
+        // Refusing it with "No machine matches" sent the user to a different
+        // command without saying which (OSK-9313).
+        (m.harnesses ?? []).some((h) => h.id === needle));
     if (exact.length === 1)
         return exact[0];
     const byName = machines.filter((m) => m.name?.toLowerCase() === lower);
     if (byName.length === 1)
         return byName[0];
-    const prefix = machines.filter((m) => [m.id, m.machineUuid, m.stableDaemonId, m.daemonId].some((candidate) => candidate && candidate.toLowerCase().startsWith(lower)));
+    const prefix = machines.filter((m) => [
+        m.id,
+        m.machineUuid,
+        m.stableDaemonId,
+        m.daemonId,
+        withoutIdentityKind(m.id),
+        withoutIdentityKind(m.machineUuid),
+    ].some((candidate) => candidate && candidate.toLowerCase().startsWith(lower)));
     if (prefix.length === 1)
         return prefix[0];
     if (prefix.length > 1) {
@@ -140,5 +198,13 @@ function resolveMachineRef(machines, ref) {
         throw new Error(`"${ref}" matches ${prefix.length} machines: ${shown.join(', ')}` +
             `${rest > 0 ? `, and ${rest} more` : ''}. Use a longer prefix or the full id.`);
     }
+    // A harness id prefix or a harness name is the other `show`'s input. Say so
+    // rather than only "no machine", which left the reader to guess that a
+    // sibling command takes it (OSK-9313).
+    const harnessMatch = machines.some((m) => (m.harnesses ?? []).some((h) => (lower.length >= 4 && h.id.toLowerCase().startsWith(lower)) ||
+        (typeof h.name === 'string' && h.name.toLowerCase() === lower)));
+    if (harnessMatch) {
+        throw new Error(`No machine matches "${ref}", but a harness does. \`skrr harnesses show ${ref}\` takes it.`);
+    }
     throw new Error(`No machine matches "${ref}". Run \`skrr machines list\` to see them.`);
 }

package/dist/lib/runtime-tool-support.d.ts

@@ -0,0 +1,34 @@
+import type { TPlugin } from '@skrr-ai/data-provider';
+/**
+ * What an agent turn can call, said where tools are configured.
+ *
+ * Plugin tools (`agents tools`, `--tools`) and OpenAPI actions
+ * (`agents api-actions add`) reach an agent turn through the runtime's
+ * `agent-tools` server (OSK-9750, OSK-9754). Two limits remain, and the CLI is
+ * where the tool is set up, so it says them there:
+ *  - image and file plugins save their output through a web request an agent
+ *    turn does not have, so they are stored but not loaded;
+ *  - an OAuth action runs only after the user authorizes it once, through a
+ *    link the agent hands over on its first call.
+ */
+/** The catalog's AGENT column. `?` for a server older than the `agentRuntime` field. */
+export declare function agentRuntimeLabel(tool: Pick<TPlugin, 'agentRuntime'>): string;
+export declare const AGENT_COLUMN_FOOTNOTE: string;
+/** Stored plugin keys the catalog says an agent turn does not load. */
+export declare function pluginKeysNotLoaded(keys: string[], catalog: TPlugin[]): string[];
+export declare function pluginsNotLoadedNotice(keys: string[]): string;
+/** Said after adding an OAuth action, since nothing works until both steps happen. */
+export declare function oauthActionNotice(redirectUrl: string): string;
+/** Split an agent's stored `tools` into plugin keys and OpenAPI action tool names. */
+export declare function splitStoredTools(tools: unknown): {
+    plugins: string[];
+    actions: string[];
+};
+/**
+ * After `--tools` is saved: warn about the plugin keys an agent turn will not load.
+ *
+ * Unknown keys are refused by the server (OSK-9545); this covers the known ones
+ * that are stored but skipped. Best effort: a catalog that cannot be read says
+ * nothing rather than failing a write that already succeeded.
+ */
+export declare function warnPluginsNotLoaded(tools: unknown, warn: (message: string) => void, fetchCatalog?: () => Promise<TPlugin[]>): Promise<void>;