@skrr-ai/cli 0.1.40 → 0.1.42

package/dist/commands/convos/show.js

@@ -5,6 +5,7 @@ const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const web_url_1 = require("../../lib/web-url");
+const format_1 = require("../../lib/format");
 class ConvosShow extends base_command_1.BaseCommand {
     static description = 'Show details for a single conversation';
     static examples = [
@@ -38,10 +39,10 @@ class ConvosShow extends base_command_1.BaseCommand {
         this.log(`Model:    ${c.model ?? '-'}`);
         this.log(`User:     ${c.user ?? '-'}`);
         if (c.createdAt) {
-            this.log(`Created:  ${formatTime(c.createdAt)}`);
+            this.log(`Created:  ${(0, format_1.localTime)(c.createdAt)}`);
         }
         if (c.updatedAt) {
-            this.log(`Updated:  ${formatTime(c.updatedAt)}`);
+            this.log(`Updated:  ${(0, format_1.localTime)(c.updatedAt)}`);
         }
         if (c.agent_id || c.agentId) {
             this.log(`Agent:    ${typeof c.agentName === 'string' && c.agentName ? `${c.agentName} (${c.agent_id ?? c.agentId})` : (c.agent_id ?? c.agentId)}`);
@@ -102,17 +103,9 @@ function formatHandoverParty(entry, baseURL) {
     if (entry.by)
         lines.push(`  By:           ${entry.by}`);
     if (entry.at)
-        lines.push(`  At:           ${formatTime(entry.at)}`);
+        lines.push(`  At:           ${(0, format_1.localTime)(entry.at)}`);
     // The reason last, because it is the sentence rather than a field.
     if (entry.reason)
         lines.push(`  Reason:       ${entry.reason}`);
     return lines;
 }
-function formatTime(value) {
-    try {
-        return new Date(String(value)).toISOString().slice(0, 19).replace('T', ' ');
-    }
-    catch {
-        return String(value);
-    }
-}

package/dist/commands/daemon/index.js

@@ -37,10 +37,10 @@ class Daemon extends core_1.Command {
             this.log((0, exec_runtime_binary_1.notInstalledMessage)());
             this.exit(127);
         }
-        this.log(`runtime binary: ${bin}`);
+        this.log(`background service binary: ${bin}`);
         this.log('');
-        this.log('Local runtime:');
-        this.log('  skrr daemon install    — install the runtime as a background service');
+        this.log('Background service on this computer:');
+        this.log('  skrr daemon install    — install it as a background service');
         this.log('  skrr daemon uninstall  — remove that service (local state is left alone)');
         this.log('  skrr daemon start      — start the daemon');
         this.log('  skrr daemon stop       — stop the daemon');

package/dist/commands/daemon/install.js

@@ -35,7 +35,7 @@ class DaemonInstall extends core_1.Command {
     // whole topic, and without a per-command alias only the bare topic
     // resolved: every subcommand under it failed.
     static aliases = ['daemons:install'];
-    static summary = 'Install the local skrr runtime as a background service';
+    static summary = 'Install the skrr background service on this computer';
     static description = (0, exec_runtime_binary_1.forwardedFlagsNote)('install', {
         binds: true,
         bootstrapsRuntime: true,
@@ -57,11 +57,11 @@ class DaemonInstall extends core_1.Command {
         // is a floor under the missing case, not a second update channel competing
         // with the daemon's own.
         if (!(0, exec_runtime_binary_1.isCurrentRuntimeBinary)((0, exec_runtime_binary_1.findRuntimeBinary)())) {
-            this.log('No local skrr runtime found. Fetching the signed release...');
+            this.log('No skrr background service installed on this computer. Fetching the signed release...');
             const outcome = await (0, daemon_installer_1.installDaemon)();
             if (!outcome.ok) {
                 this.log('');
-                this.log(`  Could not install the runtime: ${outcome.error}`);
+                this.log(`  Could not install the background service: ${outcome.error}`);
                 this.log('');
                 this.log('  You can install it directly instead:');
                 this.log('    macOS:   brew install dush1023/oversky/oversky');
@@ -84,7 +84,7 @@ class DaemonInstall extends core_1.Command {
                 // Reachable only if the runtime vanished between the bootstrap above
                 // and this line. Saying so beats repeating install instructions for
                 // something that was just installed.
-                this.log('The skrr runtime disappeared between installing it and running it.');
+                this.log('The skrr background service disappeared between installing it and running it.');
                 this.exit(127);
             }
             throw err;

package/dist/commands/daemon/login.js

@@ -28,7 +28,7 @@ const exec_runtime_binary_1 = require("../../lib/exec-runtime-binary");
  */
 class DaemonLogin extends core_1.Command {
     static aliases = ['daemons:login'];
-    static summary = 'Authenticate the local skrr runtime (separate from `skrr login`)';
+    static summary = 'Authenticate the skrr background service on this computer (separate from `skrr login`)';
     static description = (0, exec_runtime_binary_1.forwardedFlagsNote)('login', { binds: true });
     static strict = false; // forward all args verbatim — see run()
     async run() {

package/dist/commands/daemon/logs.d.ts

@@ -17,6 +17,7 @@ export interface DaemonLogsFlags {
     lines?: number;
     stderr?: boolean;
     path?: boolean;
+    profile?: string;
 }
 /**
  * Older daemons already kept logs in this profile-scoped location, even
@@ -50,7 +51,7 @@ export declare function describeLogAge(mtimeMs: number, now?: number): {
     line: string;
     stale: boolean;
 };
-export declare function resolveLegacyDaemonLogPath(flags: Pick<DaemonLogsFlags, 'stderr'>, options?: {
+export declare function resolveLegacyDaemonLogPath(flags: Pick<DaemonLogsFlags, 'stderr' | 'profile'>, options?: {
     home?: string;
     env?: NodeJS.ProcessEnv;
 }): string;
@@ -81,6 +82,7 @@ export default class DaemonLogs extends Command {
         lines: import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         stderr: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         path: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        profile: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
     };
     static examples: string[];
     run(): Promise<void>;

package/dist/commands/daemon/logs.js

@@ -64,8 +64,14 @@ function describeLogAge(mtimeMs, now = Date.now()) {
 function resolveLegacyDaemonLogPath(flags, options = {}) {
     const home = options.home ?? (0, node_os_1.homedir)();
     const env = options.env ?? process.env;
+    // An explicit --profile outranks the environment, as it does everywhere else.
+    const fromFlag = flags.profile?.trim();
     const fromEnv = env.OVERSKY_PROFILE?.trim();
-    let profile = fromEnv && PROFILE_NAME.test(fromEnv) ? fromEnv : undefined;
+    let profile = fromFlag && PROFILE_NAME.test(fromFlag)
+        ? fromFlag
+        : fromEnv && PROFILE_NAME.test(fromEnv)
+            ? fromEnv
+            : undefined;
     if (!profile) {
         try {
             const pinned = (0, node_fs_1.readFileSync)(node_path_1.default.join(home, '.skrr', 'profile.lock'), 'utf8').trim();
@@ -110,6 +116,8 @@ function readDaemonLogTail(filePath, maxLines) {
  */
 function buildOverskyLogsArgs(flags) {
     return [
+        // The runtime's own global option, placed before the subcommand.
+        ...(flags.profile ? ['--profile', flags.profile] : []),
         'logs',
         ...(flags.follow ? ['--follow'] : []),
         ...(flags.lines !== undefined ? ['--lines', String(flags.lines)] : []),
@@ -149,6 +157,12 @@ class DaemonLogs extends core_1.Command {
         path: core_1.Flags.boolean({
             description: 'Print the resolved log file path and exit',
         }),
+        // Every other daemon verb reaches a non-default profile with --profile; this
+        // one could only be steered by OVERSKY_PROFILE (OSK-10001).
+        profile: core_1.Flags.string({
+            char: 'p',
+            description: 'Read the logs of this daemon profile instead of the active one',
+        }),
     };
     static examples = [
         '<%= config.bin %> daemon logs',
@@ -156,6 +170,7 @@ class DaemonLogs extends core_1.Command {
         '<%= config.bin %> daemon logs --lines 500',
         '<%= config.bin %> daemon logs --stderr',
         '<%= config.bin %> daemon logs --path',
+        '<%= config.bin %> daemon logs --profile dogfood-laptop --lines 50',
     ];
     async run() {
         const { flags } = await this.parse(DaemonLogs);

package/dist/commands/daemon/start.js

@@ -34,19 +34,19 @@ class DaemonStart extends core_1.Command {
             const status = await (0, exec_runtime_binary_1.execRuntimeBinaryCapture)((0, runtime_start_verification_1.statusArgsForStart)(argv));
             const verification = (0, runtime_start_verification_1.verifyRuntimeStart)(status.stdout, status.code, argv);
             if (verification.status === 'reauth_required') {
-                this.logToStderr(`Local runtime did not start: profile '${verification.profile}' requires ` +
+                this.logToStderr(`The background service did not start: profile '${verification.profile}' requires ` +
                     `re-authentication (reason: ${verification.reason ?? 'UNKNOWN'}). Run ` +
                     `\`${verification.recoveryCommand}\`, then retry \`skrr daemon start\`.`);
                 this.exit(runtime_start_verification_1.DAEMON_START_REAUTH_EXIT);
             }
             if (verification.status === 'not_running') {
-                this.logToStderr(`Local runtime did not remain running after skrrd exited successfully ` +
+                this.logToStderr(`The background service did not keep running after skrrd exited successfully ` +
                     `(profile '${verification.profile}', service status: ` +
                     `${verification.runtimeStatus ?? 'unknown'}). Run \`skrr daemon logs\` for the reason.`);
                 this.exit(runtime_start_verification_1.DAEMON_START_UNVERIFIED_EXIT);
             }
             if (verification.status === 'unreadable_status') {
-                this.logToStderr(`skrrd start exited successfully, but skrr could not verify a running local runtime ` +
+                this.logToStderr(`skrrd start exited successfully, but skrr could not verify a running background service ` +
                     `for profile '${verification.profile}'; refusing to report success. ` +
                     'Run `skrr daemon status` and `skrr daemon logs` for the reason.');
                 this.exit(runtime_start_verification_1.DAEMON_START_UNVERIFIED_EXIT);

package/dist/commands/daemon/status.d.ts

@@ -1,4 +1,13 @@
 import { Command } from '@oclif/core';
+/**
+ * The status report is the runtime's, and it describes the daemon: running,
+ * connected, which credential. Whether the coding-agent CLIs on the machine can
+ * actually run a turn — installed, signed in — is a different command, and
+ * nothing on this surface named it (OSK-10002). One line after a successful
+ * human report; never inside `--json`, whose contract is one document, and
+ * never after `--help` or a failure, where it would be noise beside the point.
+ */
+export declare function readinessPointer(argv: readonly string[], exitCode: number): string | null;
 export default class DaemonStatus extends Command {
     static aliases: string[];
     static summary: string;

package/dist/commands/daemon/status.js

@@ -1,7 +1,26 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.readinessPointer = readinessPointer;
 const core_1 = require("@oclif/core");
 const exec_runtime_binary_1 = require("../../lib/exec-runtime-binary");
+/**
+ * The status report is the runtime's, and it describes the daemon: running,
+ * connected, which credential. Whether the coding-agent CLIs on the machine can
+ * actually run a turn — installed, signed in — is a different command, and
+ * nothing on this surface named it (OSK-10002). One line after a successful
+ * human report; never inside `--json`, whose contract is one document, and
+ * never after `--help` or a failure, where it would be noise beside the point.
+ */
+function readinessPointer(argv, exitCode) {
+    if (exitCode !== 0)
+        return null;
+    if (argv.some((arg) => arg === '--json' || arg === '--help' || arg === '-h'))
+        return null;
+    // Runnable as printed: `installers` picks the only connected daemon itself,
+    // and lists the ids to choose from when there are several (OSK-10002 verifier).
+    return ('  Coding agents: which CLIs are installed on this machine, and signed in where the daemon can tell — ' +
+        '`skrr harnesses installers` (add `--daemon <Daemon ID above>` if several daemons are connected)');
+}
 class DaemonStatus extends core_1.Command {
     // `skrr daemons <sub>` — the plural is advertised as an alias for the
     // whole topic, and without a per-command alias only the bare topic
@@ -23,6 +42,9 @@ class DaemonStatus extends core_1.Command {
         const argv = this.argv;
         try {
             const code = await (0, exec_runtime_binary_1.execRuntimeBinary)(['status', ...argv]);
+            const pointer = readinessPointer(argv, code);
+            if (pointer)
+                this.log(pointer);
             this.exit(code);
         }
         catch (err) {

package/dist/commands/dm/messages.js

@@ -87,7 +87,7 @@ class DmMessages extends base_command_1.BaseCommand {
             return;
         }
         (0, format_1.renderTable)(selected.map((message) => ({
-            when: formatTime(message.createdAt),
+            when: (0, format_1.localTime)(message.createdAt),
             role: String(message.sender ?? (message.isCreatedByUser ? 'user' : 'assistant')),
             text: textFromMessage(message).replace(/\s+/g, ' ').trim(),
             id: String(message.messageId ?? message._id ?? message.id ?? '-'),
@@ -100,16 +100,6 @@ class DmMessages extends base_command_1.BaseCommand {
     }
 }
 exports.default = DmMessages;
-function formatTime(value) {
-    if (!value)
-        return '-';
-    try {
-        return new Date(String(value)).toISOString().slice(0, 19);
-    }
-    catch {
-        return String(value);
-    }
-}
 function textFromMessage(message) {
     if (typeof message.text === 'string')
         return message.text;

package/dist/commands/followups/cancel.js

@@ -44,7 +44,7 @@ class FollowupsCancel extends base_command_1.BaseCommand {
             this.log(JSON.stringify(result, null, 2));
             return;
         }
-        this.log(`Follow-up ${args.id} cancelled.`);
+        this.log((0, followups_1.settledLine)(args.id, result, 'cancelled'));
     }
 }
 exports.default = FollowupsCancel;

package/dist/commands/followups/remind.js

@@ -95,6 +95,10 @@ class FollowupsRemind extends base_command_1.BaseCommand {
             return;
         }
         const row = response.followup;
+        if (response.reused && response.rescheduled) {
+            this.log(`Moved: ${row?.id} now fires at ${row?.nextRunAt ?? at} — the same reminder already existed, so it was rescheduled rather than duplicated.`);
+            return;
+        }
         if (response.reused) {
             this.log(`Already armed: ${row?.id} — the same reminder exists and was not duplicated.`);
             return;

package/dist/commands/followups/resolve.js

@@ -48,7 +48,7 @@ class FollowupsResolve extends base_command_1.BaseCommand {
             this.log(JSON.stringify(result, null, 2));
             return;
         }
-        this.log(`Follow-up ${args.id} settled: ${flags.outcome}.`);
+        this.log((0, followups_1.settledLine)(args.id, result, `settled: ${flags.outcome}`));
     }
 }
 exports.default = FollowupsResolve;

package/dist/commands/followups/show.js

@@ -3,6 +3,15 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
 const base_command_1 = require("../../base-command");
 const followups_1 = require("../../lib/followups");
+/** What each gate posture means for whoever reads `show`. */
+const GATE_LABEL = {
+    exempt_silent: 'fires without approval (silent)',
+    exempt_user_directed: 'fires without approval (you asked for it)',
+    exempt_system: 'fires without approval (system)',
+    user_directed_guarded: 'fires without approval (you asked for it); still held by quiet hours, approval-only action classes and the spend cap',
+    autonomy_ladder: "follows the agent's autonomy mode",
+    approval_ladder: 'needs approval unless the autonomy mode allows it',
+};
 /** `skrr followups show <id>` — one follow-up, the same shape as the list rows. */
 class FollowupsShow extends base_command_1.BaseCommand {
     static description = 'Show one follow-up';
@@ -34,12 +43,19 @@ class FollowupsShow extends base_command_1.BaseCommand {
             ['why', row.why],
             ['intent', row.intentKey],
             ['producer', row.producer],
+            ['gate', row.gate ? (GATE_LABEL[row.gate] ?? row.gate) : undefined],
             ['terminal', row.terminal ? `${row.terminal} (${row.terminalReason ?? '—'})` : undefined],
             [
                 'settled',
                 row.terminal ? `${row.terminalAt ?? '—'} by ${row.terminalBy ?? 'unknown'}` : undefined,
             ],
             ['deadline', row.deadlineAt],
+            [
+                'waiting',
+                row.parkedAt && !row.terminal
+                    ? `on an offline machine since ${row.parkedAt} (escalates after 60 minutes)`
+                    : undefined,
+            ],
             ['escalated to', row.escalatedInitiativeId],
         ]) {
             if (value)

package/dist/commands/harnesses/forget.js

@@ -54,12 +54,29 @@ class HarnessesForget extends base_command_1.BaseCommand {
                 const current = await (0, harnesses_1.getHarness)(args.harness);
                 label = current?.harness?.name || args.harness;
             }
-            catch {
-                /* fall back to the id — the confirmation still has to happen */
+            catch (err) {
+                // Existence before consent (OSK-9995): asking "Forget harness X?" about
+                // a row that does not exist, then reporting NOT_FOUND only after --yes,
+                // made the prompt the first thing to fail. Any other read failure still
+                // falls back to the id — the confirmation has to happen regardless.
+                if (err instanceof api_fetch_1.ApiFetchError && err.status === 404) {
+                    // NOT_FOUND, the code `harnesses show` gives the same missing id, so a
+                    // script branching on the code sees one answer (OSK-9995 verifier).
+                    this.failWithCliError({
+                        message: `No harness on this account has id ${args.harness}. Run \`skrr harnesses list --all\` to see them.`,
+                        code: 'NOT_FOUND',
+                        status: 404,
+                        exit: 4,
+                        retryable: false,
+                    });
+                    return;
+                }
             }
             const ok = await this.confirm(`Forget harness "${label}"? Agents pinned to it lose their pin.`);
             if (!ok) {
-                this.log('Cancelled.');
+                // Non-zero because nothing was forgotten — the same rule as `tasks
+                // update`: a script can only read the exit code, and 0 read as success.
+                this.error('Cancelled — nothing was forgotten.', { exit: 1 });
                 return;
             }
         }

package/dist/commands/harnesses/install.d.ts

@@ -1,4 +1,5 @@
 import { BaseCommand } from '../../base-command';
+import { type ManagedCliProviderState } from '../../lib/cli-installers';
 /**
  * Install one managed coding-agent CLI on a machine.
  *
@@ -33,9 +34,26 @@ export default class HarnessesInstall extends BaseCommand {
     static flags: {
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         daemon: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        update: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
+    /**
+     * Update an installed CLI in place (OSK-10096).
+     *
+     * Asks the inventory first rather than posting blind: a daemon older than
+     * managed updates has no handler for the request and would leave it to time
+     * out, and a CLI that updates some other way (the copy inside Devin.app) has a
+     * reason the daemon already words. Both are answered before anything runs.
+     */
+    private update;
+    /** Follow a job to its end, or report why it could not be followed (and return nothing). */
+    private follow;
     /** What the daemon says about this provider right now, best effort. */
     private installerNote;
     private daemonIdFor;
 }
+/**
+ * The next step after "Already installed.": how to update it, or where its
+ * update comes from — or nothing from a daemon that cannot say (OSK-10096).
+ */
+export declare function updateHint(provider: string, state: ManagedCliProviderState | undefined, bin: string): string | null;

package/dist/commands/harnesses/install.js

@@ -1,10 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.updateHint = updateHint;
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const cli_installers_1 = require("../../lib/cli-installers");
-const daemon_ref_1 = require("../../lib/daemon-ref");
 const daemon_target_1 = require("../../lib/daemon-target");
 /**
  * Install one managed coding-agent CLI on a machine.
@@ -32,10 +32,11 @@ const daemon_target_1 = require("../../lib/daemon-target");
  * come back as an opaque refusal.
  */
 class HarnessesInstall extends base_command_1.BaseCommand {
-    static description = 'Install a managed coding-agent CLI (claude, codex, devin, …) on one of your machines';
+    static description = 'Install a managed coding-agent CLI (claude, codex, devin, …) on one of your machines, or update one already installed (--update)';
     static examples = [
         '<%= config.bin %> harnesses install devin',
         '<%= config.bin %> harnesses install codex --daemon daemon_07c086e3c249_cli_default',
+        '<%= config.bin %> harnesses install claude --update',
     ];
     static args = {
         provider: core_1.Args.string({
@@ -47,7 +48,10 @@ class HarnessesInstall extends base_command_1.BaseCommand {
     static flags = {
         json: core_1.Flags.boolean({ description: 'Output as JSON' }),
         daemon: core_1.Flags.string({
-            description: 'Which machine to install on. Defaults to your only active daemon; required when several are active.',
+            description: 'Which machine to install on. Defaults to your only connected daemon; required when several are connected.',
+        }),
+        update: core_1.Flags.boolean({
+            description: "Update the CLI already installed, with that CLI's own updater. When a CLI updates some other way (e.g. inside its desktop app), the daemon says so instead.",
         }),
     };
     async run() {
@@ -63,9 +67,13 @@ class HarnessesInstall extends base_command_1.BaseCommand {
         const target = await (0, daemon_target_1.resolveDaemonTarget)({
             explicit: flags.daemon,
             local: (0, daemon_target_1.localMachine)(),
-            listActiveDaemons: () => (0, daemon_target_1.listActiveDaemons)(this.resolvedCredential),
+            listActiveDaemons: () => (0, daemon_target_1.listConnectedDaemons)(this.resolvedCredential),
         });
         const daemonId = this.daemonIdFor(target);
+        if (flags.update) {
+            await this.update(daemonId, provider, Boolean(flags.json));
+            return;
+        }
         let start;
         try {
             start = await (0, cli_installers_1.startManagedCliInstall)(daemonId, provider, this.resolvedCredential);
@@ -83,27 +91,22 @@ class HarnessesInstall extends base_command_1.BaseCommand {
             const reason = start.provider?.installDisabledReason?.trim() ||
                 (await this.installerNote(daemonId, provider));
             this.log(reason ? `${provider}: ${reason}` : `${provider}: the daemon started no install job.`);
+            // "Already installed." used to be the end of the road: the product could
+            // install a CLI and then had no word about updating it (OSK-10096).
+            if (start.alreadyInstalled) {
+                const next = updateHint(provider, start.provider, this.config.bin);
+                if (next)
+                    this.log(next);
+            }
             return;
         }
+        // The raw id: it is what `--daemon` takes, and a formatDaemonRef prefix of a
+        // `daemon_<hash>_…` id reads `d_daemon_4...` for every local daemon (OSK-10182).
         if (!flags.json)
-            this.logToStderr(`Installing ${provider} on ${(0, daemon_ref_1.formatDaemonRef)(daemonId)}…`);
-        const outcome = await (0, cli_installers_1.followManagedCliInstallJob)({
-            daemonId,
-            jobId,
-            credential: this.resolvedCredential,
-            onLogLine: flags.json ? undefined : (line) => this.logToStderr(`  ${line}`),
-        });
-        if (outcome.kind === 'missing') {
-            this.error(`The daemon no longer has install job ${jobId}.`, { exit: 1 });
+            this.logToStderr(`Installing ${provider} on ${daemonId}…`);
+        const job = await this.follow(daemonId, jobId, 'install', Boolean(flags.json));
+        if (!job)
             return;
-        }
-        if (outcome.kind === 'timeout') {
-            // Not a failure: the daemon is still working, and calling this failed
-            // would send someone to debug a download that is going fine.
-            this.error(`Still installing after ${Math.round(cli_installers_1.INSTALL_MAX_WAIT_MS / 60000)} minutes — the daemon is still working on job ${jobId}. Check \`${this.config.bin} harnesses installers\` in a while.`, { exit: 1 });
-            return;
-        }
-        const job = outcome.job;
         if (flags.json) {
             this.log(JSON.stringify({ daemonId, provider, job }, null, 2));
             if (job.status !== 'succeeded')
@@ -123,6 +126,99 @@ class HarnessesInstall extends base_command_1.BaseCommand {
         const state = await this.installerNote(daemonId, provider, true);
         this.log(`${provider} installed.${state ? ` ${state}` : ''}`);
     }
+    /**
+     * Update an installed CLI in place (OSK-10096).
+     *
+     * Asks the inventory first rather than posting blind: a daemon older than
+     * managed updates has no handler for the request and would leave it to time
+     * out, and a CLI that updates some other way (the copy inside Devin.app) has a
+     * reason the daemon already words. Both are answered before anything runs.
+     */
+    async update(daemonId, provider, json) {
+        let inventory;
+        try {
+            inventory = await (0, cli_installers_1.listCliInstallers)(daemonId, this.resolvedCredential);
+        }
+        catch (err) {
+            this.handleApiError(err);
+            return;
+        }
+        const row = (inventory.providers ?? []).find((p) => (0, data_provider_1.normalizeManagedCliProvider)(p.provider) === provider);
+        if (!row || row.updatable === undefined) {
+            this.failWithCliError({
+                message: `The daemon ${daemonId} (${inventory.daemonVersion ?? 'version not reported'}) cannot update ${provider}: it predates managed updates. ` +
+                    `Update the daemon, then run this again — \`${this.config.bin} daemon status\` says how.`,
+                code: 'DAEMON_UPDATE_UNSUPPORTED',
+                exit: 1,
+                retryable: false,
+            });
+            return;
+        }
+        if (!row.updatable) {
+            this.failWithCliError({
+                message: `${provider}: ${row.updateDisabledReason?.trim() || 'the daemon cannot update it here.'}`,
+                code: 'CLI_NOT_UPDATABLE',
+                exit: 1,
+                retryable: false,
+            });
+            return;
+        }
+        let start;
+        try {
+            start = await (0, cli_installers_1.startManagedCliUpdate)(daemonId, provider, this.resolvedCredential);
+        }
+        catch (err) {
+            this.handleApiError(err);
+            return;
+        }
+        const jobId = start.job?.id;
+        if (!start.started || !jobId) {
+            this.log(start.alreadyRunning
+                ? `${provider}: an install or update is already running (job ${start.job?.id ?? 'unknown'}).`
+                : `${provider}: ${start.provider?.updateDisabledReason?.trim() || 'the daemon started no update job.'}`);
+            return;
+        }
+        if (!json) {
+            this.logToStderr(`Updating ${provider} ${row.version ? `${row.version} ` : ''}on ${daemonId}…`);
+        }
+        const job = await this.follow(daemonId, jobId, 'update', json);
+        if (!job)
+            return;
+        if (json) {
+            this.log(JSON.stringify({ daemonId, provider, job }, null, 2));
+            if (job.status !== 'succeeded')
+                process.exitCode = 1;
+            return;
+        }
+        if (job.status === 'failed') {
+            this.error(`Updating ${provider} failed: ${job.error || 'the daemon gave no reason.'}`, {
+                exit: 1,
+            });
+            return;
+        }
+        this.log((0, cli_installers_1.updateOutcomeLine)(job) ??
+            `${provider} updated${job.installedVersion ? ` to ${job.installedVersion}` : ''}.`);
+    }
+    /** Follow a job to its end, or report why it could not be followed (and return nothing). */
+    async follow(daemonId, jobId, verb, json) {
+        const outcome = await (0, cli_installers_1.followManagedCliInstallJob)({
+            daemonId,
+            jobId,
+            credential: this.resolvedCredential,
+            onLogLine: json ? undefined : (line) => this.logToStderr(`  ${line}`),
+        });
+        if (outcome.kind === 'missing') {
+            this.error(`The daemon no longer has ${verb} job ${jobId}.`, { exit: 1 });
+            return undefined;
+        }
+        if (outcome.kind === 'timeout') {
+            // Not a failure: the daemon is still working, and calling this failed
+            // would send someone to debug a download that is going fine.
+            this.error(`Still ${verb === 'install' ? 'installing' : 'updating'} after ${Math.round(cli_installers_1.INSTALL_MAX_WAIT_MS / 60000)} minutes — the daemon is still working on job ${jobId}. Check \`${this.config.bin} harnesses installers\` in a while.`, { exit: 1 });
+            return undefined;
+        }
+        return outcome.job;
+    }
     /** What the daemon says about this provider right now, best effort. */
     async installerNote(daemonId, provider, readiness = false) {
         try {
@@ -152,14 +248,39 @@ class HarnessesInstall extends base_command_1.BaseCommand {
             this.error('This machine is a Dedicated Runtime whose daemon has not published an id this process can read. Name a machine with --daemon.', { exit: 1 });
         }
         if (target.kind === 'none') {
-            this.error(`No active daemon is registered for this account, so nothing can perform the install. Start the local runtime with \`${this.config.bin} daemon start\`.`, { exit: 1 });
+            this.failWithCliError({
+                message: `No daemon is connected for this account, so nothing can perform the install. Start the background service on this computer with \`${this.config.bin} daemon start\`.`,
+                code: 'NO_DAEMON',
+                exit: 1,
+                retryable: false,
+            });
         }
         const choices = target.daemons
             .slice(0, 10)
-            .map((d) => `  ${(0, daemon_ref_1.formatDaemonRef)(d.id)}  ${d.name || '—'}`)
+            // Full ids: they are what `--daemon` takes (OSK-9993).
+            .map((d) => `  ${d.id}  ${d.name || '—'}`)
             .join('\n');
-        this.error(`${target.daemons.length} active daemons — say which machine to install on:\n${choices}\n` +
-            `Pass one with --daemon, or see them all with \`${this.config.bin} list-daemons\`.`, { exit: 1 });
+        // The same refusal, and the same code, as \`code install\` (OSK-9993 verifier).
+        this.failWithCliError({
+            message: `${target.daemons.length} connected daemons — say which machine to install on:\n${choices}\n` +
+                `Pass one with --daemon, or see each daemon id in the DAEMON ID column of \`${this.config.bin} harnesses list\`.`,
+            code: 'AMBIGUOUS_DAEMON',
+            exit: 1,
+            retryable: false,
+        });
     }
 }
 exports.default = HarnessesInstall;
+/**
+ * The next step after "Already installed.": how to update it, or where its
+ * update comes from — or nothing from a daemon that cannot say (OSK-10096).
+ */
+function updateHint(provider, state, bin) {
+    if (!state || state.updatable === undefined)
+        return null;
+    if (state.updatable) {
+        return `To update it: ${bin} harnesses install ${provider} --update`;
+    }
+    const reason = state.updateDisabledReason?.trim();
+    return reason ? `Updating: ${reason}` : null;
+}