@skrr-ai/cli 0.1.40 → 0.1.42

package/dist/lib/cli-installers.js

@@ -1,11 +1,19 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.INSTALL_POLL_INTERVAL_MS = exports.INSTALL_MAX_WAIT_MS = void 0;
+exports.INSTALL_POLL_INTERVAL_MS = exports.INSTALL_MAX_WAIT_MS = exports.ROW_READINESS_TIMEOUT_MS = exports.MANAGED_CLI_PROVIDER_SINCE = void 0;
+exports.describeProvidersNotOffered = describeProvidersNotOffered;
 exports.providersNotOffered = providersNotOffered;
 exports.listCliInstallers = listCliInstallers;
 exports.readinessOf = readinessOf;
+exports.readinessByProvider = readinessByProvider;
+exports.readinessKey = readinessKey;
+exports.readinessForRows = readinessForRows;
 exports.startManagedCliInstall = startManagedCliInstall;
+exports.startManagedCliUpdate = startManagedCliUpdate;
+exports.updateOutcomeLine = updateOutcomeLine;
 exports.readManagedCliInstallJob = readManagedCliInstallJob;
+exports.unseenLogLines = unseenLogLines;
+exports.newLogLinesByCount = newLogLinesByCount;
 exports.followManagedCliInstallJob = followManagedCliInstallJob;
 /**
  * The daemon's managed-CLI installer inventory, as the CLI reads it.
@@ -21,19 +29,24 @@ exports.followManagedCliInstallJob = followManagedCliInstallJob;
  * The CLI called the route from exactly one place (`commands/code/install.ts`),
  * for one provider, to read one field, and showed the user none of it. So from
  * the CLI there was no way to learn that a harness listed as `online` had no
- * binary at all — which is the state this account's `skrr-code` row was in.
+ * binary at all — which is the state this account's first-party harness row was in.
  *
  * The shape lives here rather than beside a command because two commands read
  * it now. Root `CLAUDE.md`: a second declaration is how a surface silently
  * drifts from the server that produced it.
  */
+const auth_core_1 = require("@skrr-ai/auth-core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const api_fetch_1 = require("./api-fetch");
+/** A provider in its canonical spelling, or '' for a missing one. */
+function canonical(value) {
+    return typeof value === 'string' ? String((0, data_provider_1.canonicalHarnessProvider)(value) ?? value) : '';
+}
 /**
  * Providers the platform knows about that this daemon did not offer.
  *
  * The inventory is whatever the CONNECTED daemon supports, and an older daemon
- * legitimately supports fewer: `devin` arrived in daemon 0.8.43, so a machine
+ * legitimately supports fewer: `devin` arrived in the 0.8.45 daemon release, so a machine
  * running 0.8.35 answers with six providers instead of seven. Observed here —
  * the desktop app restarted the daemon from its bundled 0.8.35 copy and Devin
  * disappeared from the install list between two page loads, with nothing on
@@ -45,19 +58,47 @@ const api_fetch_1 = require("./api-fetch");
  * is already on this side of the wire. Naming the gap is what turns "Devin is
  * gone" into "this daemon is older than Devin".
  */
+/**
+ * The first STABLE daemon release (`daemon-v*` tag) whose
+ * MANAGED_CLI_PROVIDER_IDS included each provider. Release tags, not
+ * package.json at the commit that added it: the version is bumped before a
+ * release is cut, so the commit that added devin already read 0.8.43 while the
+ * 0.8.43 release did not contain it — this table said "added in 0.8.43" to a
+ * 0.8.43 user (OSK-9537 verifier). Derived with, per provider:
+ *   for t in $(git tag -l 'daemon-v*' | sort -V); do
+ *     git show "$t:daemon/src/cli-installers.ts" | grep -q "'devin'" && echo "$t" && break
+ *   done
+ * Providers present since managed installers first shipped (0.8.1) are omitted.
+ */
+exports.MANAGED_CLI_PROVIDER_SINCE = Object.freeze({
+    // First offered under its older spelling; the canonical key covers both.
+    [auth_core_1.FIRST_PARTY_HARNESS.provider]: '0.8.2',
+    devin: '0.8.45',
+});
+/**
+ * "Not offered" with the release that added each provider, so a reader learns
+ * WHICH update fixes it rather than only that one might (OSK-9537).
+ */
+function describeProvidersNotOffered(missing) {
+    return missing
+        .map((provider) => {
+        const since = exports.MANAGED_CLI_PROVIDER_SINCE[canonical(provider)];
+        return since ? `${provider} (added in daemon ${since})` : provider;
+    })
+        .join(', ');
+}
 function providersNotOffered(offered, known) {
     // Canonicalize BOTH sides. An older daemon answers under the spelling it was
-    // built with — the 0.8.35 build reports the first-party harness as
-    // `sky-code`, so a raw comparison against `skrr-code` reported it missing on
+    // built with — the 0.8.35 build reports the first-party harness under its
+    // older spelling, so a raw comparison against the current one reported it missing on
     // a machine where it is installed and working. Caught by running this against
     // the very daemon the finding was about: the first version of this helper
-    // said "Not offered: devin, skrr-code" when only `devin` was true.
-    const canonical = (value) => typeof value === 'string' ? String((0, data_provider_1.canonicalHarnessProvider)(value) ?? value) : '';
+    // said "Not offered: devin, <first-party harness>" when only `devin` was true.
     const seen = new Set((offered ?? []).map((provider) => canonical(provider.provider)).filter(Boolean));
     return known.filter((provider) => !seen.has(canonical(provider)));
 }
-async function listCliInstallers(daemonId, credential) {
-    return (0, api_fetch_1.apiFetch)(`/api/daemons/${encodeURIComponent(daemonId)}/cli-installers`, { credential: credential });
+async function listCliInstallers(daemonId, credential, opts = {}) {
+    return (0, api_fetch_1.apiFetch)(`/api/daemons/${encodeURIComponent(daemonId)}/cli-installers`, { credential: credential, ...(opts.signal ? { signal: opts.signal } : {}) });
 }
 /**
  * The one-word readiness verdict for a provider, and whether it is good news.
@@ -95,18 +136,143 @@ function readinessOf(provider) {
     if (!auth) {
         return {
             label: 'unknown',
-            detail: 'Installed. This daemon cannot read this provider’s credential state.',
+            detail: (0, data_provider_1.managedCliReadinessUnknownMessage)(),
             ok: false,
         };
     }
     return { label: auth.status, detail: auth.message, ok: auth.status === 'ready' };
 }
+/** A job the daemon runs to install one managed provider. */
+/**
+ * Readiness per provider for one daemon, keyed by CANONICAL provider — or null
+ * when the daemon could not be asked (disconnected, older, refused).
+ *
+ * The harness row's `authStatus` is the DAEMON's standing with skrr, written
+ * across every row of a daemon at once, so `harnesses show`, `machines show`
+ * and `ping` answered "ok" per provider for a Devin its own CLI called "Not
+ * logged in" (OSK-9263, OSK-9265). This is the per-provider answer those
+ * surfaces print instead. Best-effort by design: a failure here must never
+ * fail the command that asked.
+ */
+async function readinessByProvider(daemonId, credential, opts = {}) {
+    let response;
+    try {
+        response = await listCliInstallers(daemonId, credential, opts);
+    }
+    catch {
+        return null;
+    }
+    const out = new Map();
+    for (const provider of response.providers ?? []) {
+        const key = canonical(provider.provider);
+        if (key)
+            out.set(key, readinessOf(provider));
+    }
+    return out;
+}
+/** The canonical provider a harness row names, for looking it up in that map. */
+function readinessKey(provider) {
+    return canonical(provider);
+}
+/** How long one daemon may take to answer before a list prints `-` for it. */
+exports.ROW_READINESS_TIMEOUT_MS = 5_000;
+/**
+ * Readiness for many harness rows at once: ONE installer read per connected
+ * daemon, all in parallel, however many rows each daemon has.
+ *
+ * Only a row whose daemon can answer is asked for — online and not superseded;
+ * an offline or replaced registration has nobody on the other end. Each read is
+ * bounded, because a list must not hang on one slow machine; a daemon that does
+ * not answer in time reads as unknown (`undefined`), never as `ready`.
+ *
+ * `asked` and `answered` let a caller tell "this daemon does not report it"
+ * from "nothing could be asked", which call for different next steps.
+ */
+async function readinessForRows(rows, credential, opts = {}) {
+    const daemonIds = [
+        ...new Set(rows
+            .filter((row) => row.status === 'online' && !row.superseded && row.daemonId)
+            .map((row) => row.daemonId)),
+    ];
+    const timeoutMs = opts.timeoutMs ?? exports.ROW_READINESS_TIMEOUT_MS;
+    const answers = await Promise.all(daemonIds.map(async (daemonId) => [
+        daemonId,
+        await readinessByProvider(daemonId, credential, {
+            signal: AbortSignal.timeout(timeoutMs),
+        }),
+    ]));
+    const byDaemon = new Map(answers);
+    return {
+        lookup: (row) => row.status === 'online' && !row.superseded && row.daemonId
+            ? byDaemon.get(row.daemonId)?.get(readinessKey(row.provider))
+            : undefined,
+        daemonAnswered: (row) => Boolean(row.daemonId && byDaemon.get(row.daemonId)),
+        asked: daemonIds.length,
+        answered: answers.filter(([, answer]) => answer !== null).length,
+    };
+}
 async function startManagedCliInstall(daemonId, provider, credential) {
     return (0, api_fetch_1.apiFetch)(`/api/daemons/${encodeURIComponent(daemonId)}/cli-installers/${encodeURIComponent(provider)}/install`, { method: 'POST', body: {}, credential: credential });
 }
+/** Ask the daemon to update an installed CLI in place (OSK-10096). */
+async function startManagedCliUpdate(daemonId, provider, credential) {
+    return (0, api_fetch_1.apiFetch)(`/api/daemons/${encodeURIComponent(daemonId)}/cli-installers/${encodeURIComponent(provider)}/update`, { method: 'POST', body: {}, credential: credential });
+}
+/**
+ * How an update job ended, from the versions the daemon recorded on it:
+ * "Updated Claude Code 2.1.270 → 2.1.280." or "Claude Code is still 2.1.270:
+ * its updater found nothing newer." Null when the job does not carry both.
+ */
+function updateOutcomeLine(job) {
+    const before = job.previousVersion;
+    const after = job.installedVersion;
+    if (!before || !after)
+        return null;
+    const name = job.displayName || job.provider || 'The CLI';
+    return before === after
+        ? `${name} is still ${after}: its updater found nothing newer.`
+        : `Updated ${name} ${before} → ${after}.`;
+}
 async function readManagedCliInstallJob(daemonId, jobId, credential) {
     return (0, api_fetch_1.apiFetch)(`/api/daemons/${encodeURIComponent(daemonId)}/cli-installers/jobs/${encodeURIComponent(jobId)}`, { credential: credential });
 }
+const MAX_TRACKED_LOG_LINES = 400;
+/**
+ * The lines of a job's log tail not yet printed.
+ *
+ * The tail is a SLIDING window: once an installer writes more than the daemon
+ * keeps, earlier lines fall off the front, so an index into it skips or repeats
+ * lines. Instead, find the longest run at the start of the new tail that matches
+ * the end of what was already printed, and print only what follows it.
+ */
+function unseenLogLines(printed, tail) {
+    for (let overlap = Math.min(printed.length, tail.length); overlap > 0; overlap -= 1) {
+        let matches = true;
+        for (let i = 0; i < overlap; i += 1) {
+            if (printed[printed.length - overlap + i] !== tail[i]) {
+                matches = false;
+                break;
+            }
+        }
+        if (matches)
+            return tail.slice(overlap);
+    }
+    return [...tail];
+}
+/**
+ * The new lines of a job's tail when the daemon reports its running line count:
+ * exactly the last `total − printedCount`, and how many of those already fell
+ * out of the window (the daemon keeps the last 200). Unlike overlap matching,
+ * this cannot mistake a repeated line for one already printed.
+ */
+function newLogLinesByCount(printedCount, tail, total) {
+    const unseen = Math.max(0, total - printedCount);
+    if (unseen === 0)
+        return { lines: [], skipped: 0 };
+    if (unseen > tail.length)
+        return { lines: [...tail], skipped: unseen - tail.length };
+    return { lines: tail.slice(tail.length - unseen), skipped: 0 };
+}
 /** A 100 MB download over a hotel connection is the case this has to survive. */
 exports.INSTALL_MAX_WAIT_MS = 10 * 60_000;
 exports.INSTALL_POLL_INTERVAL_MS = 2_000;
@@ -125,16 +291,33 @@ exports.INSTALL_POLL_INTERVAL_MS = 2_000;
  */
 async function followManagedCliInstallJob(input) {
     const deadline = Date.now() + (input.maxWaitMs ?? exports.INSTALL_MAX_WAIT_MS);
-    let printed = 0;
+    let printed = [];
+    let printedCount = 0;
     for (;;) {
         const res = await readManagedCliInstallJob(input.daemonId, input.jobId, input.credential);
         const job = res.job;
         if (!job)
             return { kind: 'missing', jobId: input.jobId };
         if (input.onLogLine) {
-            for (const line of (job.log ?? []).slice(printed))
+            // `logTail`, the field the daemon sends — this read `log`, which no daemon
+            // has ever sent, so every install printed nothing until it ended (OSK-10103).
+            const tail = job.logTail ?? job.log ?? [];
+            let fresh;
+            if (typeof job.logLineCount === 'number') {
+                // Exact: the daemon says how many lines exist in total (OSK-10179).
+                const { lines, skipped } = newLogLinesByCount(printedCount, tail, job.logLineCount);
+                if (skipped > 0) {
+                    input.onLogLine(`(… ${skipped} log line${skipped === 1 ? '' : 's'} not shown)`);
+                }
+                fresh = lines;
+                printedCount = Math.max(printedCount, job.logLineCount);
+            }
+            else {
+                fresh = unseenLogLines(printed, tail);
+            }
+            for (const line of fresh)
                 input.onLogLine(line);
-            printed = (job.log ?? []).length;
+            printed = [...printed, ...fresh].slice(-MAX_TRACKED_LOG_LINES);
         }
         if (job.status === 'succeeded' || job.status === 'failed')
             return { kind: 'settled', job };

package/dist/lib/command-miss.d.ts

@@ -23,6 +23,8 @@ export type CommandLookup = {
     bin: string;
     findCommand: (id: string) => {
         flags?: Record<string, unknown>;
+        args?: Record<string, unknown>;
+        strict?: boolean;
     } | undefined;
     commandIDs: string[];
     topicNames: string[];
@@ -34,6 +36,26 @@ export declare function editDistance(a: string, b: string): number;
  * only a verdict.
  */
 export declare function nearestCommands(id: string, all: string[], limit?: number): string[];
+/**
+ * The command id a `--help` request is about, resolved the way oclif resolves
+ * the same words when they are RUN.
+ *
+ * The help override used to join every leading word into the id, so
+ * `skrr harnesses install devin --help` asked for `harnesses:install:devin`,
+ * found no such command, and reported that `harnesses install` "does not take
+ * the positional argument `devin`" — the positional its own help lists
+ * (OSK-10099). Running the same words works, because oclif stops collecting id
+ * words at the first resolved command that takes arguments: from there on a
+ * word is an argument, not part of the name. Adding `--help` to a command you
+ * are about to run is the commonest way to check it, so the two must agree.
+ *
+ * Mirrors `collateSpacedCmdIDFromArgs` in `@oclif/core/lib/help/util` (not a
+ * public export): a word extends the id while the longer id is a command or a
+ * prefix of one; otherwise it is appended only when the id so far is not a
+ * command that accepts arguments, so a genuinely wrong word under a command
+ * that takes none (`daemon reload`) still reaches the miss message.
+ */
+export declare function helpSubjectId(tokens: readonly string[], config: CommandLookup): string;
 /**
  * The message for a colon-joined id that did not resolve.
  *

package/dist/lib/command-miss.js

@@ -22,10 +22,44 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.editDistance = editDistance;
 exports.nearestCommands = nearestCommands;
+exports.helpSubjectId = helpSubjectId;
 exports.describeCommandMiss = describeCommandMiss;
 exports.lookupFromConfig = lookupFromConfig;
 /** A uuid-ish token, which is what a stray space id looks like. */
 const LOOKS_LIKE_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const DAEMON_READINESS = [
+    {
+        id: 'harnesses:installers',
+        usage: 'harnesses installers --daemon <id>',
+        answers: 'whether each coding-agent CLI on that machine is installed, and signed in where the daemon can tell',
+    },
+    {
+        id: 'daemon:status',
+        usage: 'daemon status',
+        answers: 'whether the daemon itself is running and connected',
+    },
+];
+const ANSWERED_ELSEWHERE = {
+    daemon: {
+        health: DAEMON_READINESS,
+        readiness: DAEMON_READINESS,
+        ready: DAEMON_READINESS,
+        doctor: DAEMON_READINESS,
+        check: DAEMON_READINESS,
+    },
+};
+// `skrr daemons <sub>` is the same topic.
+const ANSWERED_ELSEWHERE_BY_COMMAND = { ...ANSWERED_ELSEWHERE, daemons: ANSWERED_ELSEWHERE.daemon };
+function describeAnsweredElsewhere(config, resolved, extras) {
+    if (extras.length !== 1)
+        return null;
+    const targets = (ANSWERED_ELSEWHERE_BY_COMMAND[resolved]?.[extras[0].toLowerCase()] ?? []).filter((target) => config.findCommand(target.id) !== undefined);
+    if (targets.length === 0)
+        return null;
+    const spoken = `${config.bin} ${resolved.split(':').join(' ')}`;
+    return (`\`${spoken}\` has no \`${extras[0]}\`. Depending on what you want to know:\n` +
+        targets.map((t) => `  \`${config.bin} ${t.usage}\` — ${t.answers}`).join('\n'));
+}
 /** Cheap edit distance, bounded — this runs only on a miss. */
 function editDistance(a, b) {
     const rows = a.length + 1;
@@ -60,6 +94,47 @@ function nearestCommands(id, all, limit = 3) {
         .slice(0, limit)
         .map(({ candidate }) => candidate));
 }
+/**
+ * The command id a `--help` request is about, resolved the way oclif resolves
+ * the same words when they are RUN.
+ *
+ * The help override used to join every leading word into the id, so
+ * `skrr harnesses install devin --help` asked for `harnesses:install:devin`,
+ * found no such command, and reported that `harnesses install` "does not take
+ * the positional argument `devin`" — the positional its own help lists
+ * (OSK-10099). Running the same words works, because oclif stops collecting id
+ * words at the first resolved command that takes arguments: from there on a
+ * word is an argument, not part of the name. Adding `--help` to a command you
+ * are about to run is the commonest way to check it, so the two must agree.
+ *
+ * Mirrors `collateSpacedCmdIDFromArgs` in `@oclif/core/lib/help/util` (not a
+ * public export): a word extends the id while the longer id is a command or a
+ * prefix of one; otherwise it is appended only when the id so far is not a
+ * command that accepts arguments, so a genuinely wrong word under a command
+ * that takes none (`daemon reload`) still reaches the miss message.
+ */
+function helpSubjectId(tokens, config) {
+    const usable = new Set();
+    for (const id of [...config.commandIDs, ...config.topicNames]) {
+        const parts = id.split(':');
+        for (let i = 1; i <= parts.length; i += 1)
+            usable.add(parts.slice(0, i).join(':'));
+    }
+    const taken = [];
+    for (const token of tokens) {
+        if (token.startsWith('-') || token.includes('='))
+            break;
+        if (usable.has([...taken, token].join(':'))) {
+            taken.push(token);
+            continue;
+        }
+        const current = taken.length > 0 ? config.findCommand(taken.join(':')) : undefined;
+        if (current && (current.strict === false || Object.keys(current.args ?? {}).length > 0))
+            break;
+        taken.push(token);
+    }
+    return taken.join(':');
+}
 /**
  * The message for a colon-joined id that did not resolve.
  *
@@ -81,6 +156,9 @@ function describeCommandMiss(config, id) {
         if (!found)
             continue;
         const extras = parts.slice(take);
+        const redirect = describeAnsweredElsewhere(config, parts.slice(0, take).join(':'), extras);
+        if (redirect)
+            return redirect;
         const spoken = `${config.bin} ${parts.slice(0, take).join(' ')}`;
         // Suggest the flag only when the command actually has it, so the hint can
         // never point at something that does not exist.

package/dist/lib/daemon-setup.js

@@ -62,7 +62,7 @@ async function offerDaemonSetup(opts = {}) {
     }
     const confirmImpl = opts.confirmImpl ?? prompt_1.confirm;
     log('');
-    log('  This machine has no skrr runtime. It is what lets your agents work here —');
+    log('  This computer has no skrr background service. It is what lets your agents work here —');
     log('  running commands, editing files, and driving a browser on this machine.');
     // This creates a persistent service with broad local capabilities, so a
     // bare Enter must visibly and behaviorally decline it. `confirm` names its
@@ -100,7 +100,7 @@ async function offerDaemonSetup(opts = {}) {
         if (err.message === 'runtime-binary-not-installed') {
             return {
                 status: 'failed',
-                detail: 'the runtime vanished between fetching and installing it',
+                detail: 'the background service vanished between fetching and installing it',
             };
         }
         return { status: 'failed', detail: err.message };

package/dist/lib/daemon-target.d.ts

@@ -99,5 +99,19 @@ export interface ResolveDaemonTargetInput {
     listActiveDaemons: () => Promise<ActiveDaemonRow[]>;
 }
 export declare function resolveDaemonTarget(input: ResolveDaemonTargetInput): Promise<DaemonTarget>;
+/**
+ * Daemons that are CONNECTED right now, under the id the daemon-control API
+ * takes (`daemon_…`, `dedicated-runtime-…`).
+ *
+ * `listActiveDaemons` returns Daemon RESOURCE rows: "active" means not revoked,
+ * and `id` is the resource's own id. The installer routes relay an RPC to a
+ * connected daemon by its connection id, so that list could not be used to pick
+ * one: its refusal counted 50 "active daemons" — most of them sandboxes gone for
+ * weeks — and suggested values like `d_69eb2d1e...` that `--daemon` then failed
+ * to find, and a single "active" daemon would have been auto-picked by an id no
+ * route accepts (OSK-9993). Online harness rows carry exactly the ids and the
+ * liveness needed, one row per (daemon, provider).
+ */
+export declare function listConnectedDaemons(credential: ResolvedCredential): Promise<ActiveDaemonRow[]>;
 /** The same list `skrr list-daemons` prints, so a refusal can name values that work. */
 export declare function listActiveDaemons(credential: ResolvedCredential): Promise<ActiveDaemonRow[]>;

package/dist/lib/daemon-target.js

@@ -45,6 +45,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.localMachine = localMachine;
 exports.resolveDaemonTarget = resolveDaemonTarget;
+exports.listConnectedDaemons = listConnectedDaemons;
 exports.listActiveDaemons = listActiveDaemons;
 const api_fetch_1 = require("./api-fetch");
 const daemonBroker_1 = require("./daemonBroker");
@@ -103,6 +104,37 @@ async function resolveDaemonTarget(input) {
         return { kind: 'none' };
     return { kind: 'ambiguous', daemons };
 }
+/**
+ * Daemons that are CONNECTED right now, under the id the daemon-control API
+ * takes (`daemon_…`, `dedicated-runtime-…`).
+ *
+ * `listActiveDaemons` returns Daemon RESOURCE rows: "active" means not revoked,
+ * and `id` is the resource's own id. The installer routes relay an RPC to a
+ * connected daemon by its connection id, so that list could not be used to pick
+ * one: its refusal counted 50 "active daemons" — most of them sandboxes gone for
+ * weeks — and suggested values like `d_69eb2d1e...` that `--daemon` then failed
+ * to find, and a single "active" daemon would have been auto-picked by an id no
+ * route accepts (OSK-9993). Online harness rows carry exactly the ids and the
+ * liveness needed, one row per (daemon, provider).
+ */
+async function listConnectedDaemons(credential) {
+    const res = await (0, api_fetch_1.apiFetch)('/api/harnesses?status=online', { credential });
+    const byDaemon = new Map();
+    for (const row of res.harnesses ?? []) {
+        if (row.status !== 'online' || !row.daemonId || byDaemon.has(row.daemonId))
+            continue;
+        // A harness is named "<provider> — <machine>"; the machine half names the daemon.
+        const separator = typeof row.name === 'string' ? row.name.indexOf(' — ') : -1;
+        byDaemon.set(row.daemonId, {
+            id: row.daemonId,
+            name: separator === -1 ? undefined : row.name.slice(separator + 3),
+            isActive: true,
+        });
+    }
+    // Stable order: the server returns rows most-recently-seen first, so two
+    // commands refusing one ambiguity listed the same daemons in different orders.
+    return [...byDaemon.values()].sort((a, b) => a.id.localeCompare(b.id));
+}
 /** The same list `skrr list-daemons` prints, so a refusal can name values that work. */
 async function listActiveDaemons(credential) {
     const res = await (0, api_fetch_1.apiFetch)('/api/daemon-resources?status=active&limit=50', { credential });

package/dist/lib/daemonBroker.js

@@ -311,7 +311,7 @@ async function attemptDaemonBrokerLogin(opts) {
             return {
                 ok: false,
                 reason: 'base_url_mismatch',
-                detail: `No local skrr runtime is logged in to ${opts.baseURL}; available daemon is logged in to ${mismatchedBootstrap.serverUrl}.`,
+                detail: `The skrr background service on this computer is not logged in to ${opts.baseURL}; it is logged in to ${mismatchedBootstrap.serverUrl}.`,
                 daemonServerUrl: mismatchedBootstrap.serverUrl,
             };
         }

package/dist/lib/daemonHandoff.js

@@ -208,7 +208,7 @@ async function handOffToLocalDaemon(env = process.env, opts = {}) {
         return {
             status: 'skipped',
             reason: 'legacy-binary',
-            detail: 'a legacy oversky runtime is installed; bootstrap a current skrr runtime',
+            detail: 'a legacy oversky background service is installed; bootstrap a current skrr one',
         };
     }
     // An older daemon has no `accept-handoff`, and spawning it would fail with

package/dist/lib/exec-runtime-binary.js

@@ -64,7 +64,7 @@ exports.RUNTIME_BINARY_NAMES = ['skrrd', 'oversky'];
  */
 function forwardedFlagsNote(verb, opts = {}) {
     const base = opts.bootstrapsRuntime
-        ? `If no local runtime exists, this command first fetches the signed release. After it is ` +
+        ? `If the background service is not on this computer yet, this command first fetches the signed release. After it is ` +
             `installed, flags are forwarded to \`skrrd ${verb}\` unchanged; run \`skrrd ${verb} --help\` ` +
             `for this verb's own flags, or \`skrrd --help\` for global ones such as \`--profile\`.`
         : `Flags are forwarded to \`skrrd ${verb}\` unchanged, so they are not listed here —` +
@@ -196,7 +196,7 @@ function isExecutable(p) {
  */
 function notInstalledMessage() {
     return [
-        'The skrr local runtime is not installed on this machine.',
+        'The skrr background service is not installed on this computer.',
         '',
         'Install:',
         '  macOS:   brew install dush1023/oversky/oversky',

package/dist/lib/followups.d.ts

@@ -1,6 +1,12 @@
 import { withQuery } from './triggers';
 type Query = Parameters<typeof withQuery>[1];
 type Json = Record<string, unknown>;
+/**
+ * The line a settle verb prints. A follow-up that had already ended is said to
+ * have ended, with the terminal it actually has, rather than reported as the
+ * thing this command would have done (OSK-10038).
+ */
+export declare function settledLine(id: string, result: Record<string, unknown>, done: string): string;
 /**
  * The `id` argument every follow-up command that addresses one takes.
  *
@@ -37,6 +43,10 @@ export interface FollowUpRow {
     /** Who settled it: `trigger_fire` for the runtime, otherwise the actor. */
     terminalBy?: string | null;
     escalatedInitiativeId?: string | null;
+    /** The gate the fire passes: exempt_silent, exempt_user_directed, exempt_system, user_directed_guarded, autonomy_ladder, approval_ladder. */
+    gate?: string | null;
+    /** Set while its fire waits on an offline machine; it escalates after 60 minutes. */
+    parkedAt?: string | null;
     capsule?: unknown;
     nextRunAt?: string | null;
     deadlineAt?: string | null;
@@ -46,6 +56,8 @@ export interface FollowUpRow {
 export interface FollowUpCreateResponse {
     followup: FollowUpRow | null;
     reused?: boolean;
+    /** A reused reminder asked for at a different time moved to that time. */
+    rescheduled?: boolean;
     dropped?: false | 'budget';
     proposal?: boolean;
     budget?: Json;

package/dist/lib/followups.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.followupsApi = exports.WATCH_WAIT_KINDS = exports.FOLLOWUP_RESOLVE_OUTCOMES = exports.FOLLOWUP_STATES = exports.FOLLOWUP_KINDS = exports.followUpIdArg = void 0;
+exports.settledLine = settledLine;
 exports.resolveFollowUpAgent = resolveFollowUpAgent;
 exports.parseSubjectRef = parseSubjectRef;
 exports.followupSummaryLine = followupSummaryLine;
@@ -26,6 +27,18 @@ const triggers_1 = require("./triggers");
 const agent_resolver_1 = require("./agent-resolver");
 const MOUNT = '/api/followups';
 const base = (id) => `${MOUNT}/${encodeURIComponent(id)}`;
+/**
+ * The line a settle verb prints. A follow-up that had already ended is said to
+ * have ended, with the terminal it actually has, rather than reported as the
+ * thing this command would have done (OSK-10038).
+ */
+function settledLine(id, result, done) {
+    const followup = result.followup;
+    if (result.alreadySettled === true) {
+        return `Follow-up ${id} was already settled${followup?.terminal ? ` (${followup.terminal})` : ''}; nothing changed.`;
+    }
+    return `Follow-up ${id} ${done}.`;
+}
 /**
  * The `id` argument every follow-up command that addresses one takes.
  *
@@ -79,7 +92,7 @@ function resolveFollowUpAgent(explicitAgentId, env = process.env) {
         if (explicitAgentId && explicitAgentId !== sessionAgent.id) {
             throw new agent_resolver_1.AgentResolutionError({
                 code: 'AGENT_CONTEXT_CONFLICT',
-                message: 'This local runtime is bound to a session agent. Do not override it with another agent ID.',
+                message: 'This session is bound to its session agent. Do not override it with another agent ID.',
                 suggestion: 'Use the bound session agent, or start a new daemon session for a different agent.',
                 details: { explicitAgentId, sessionAgentId: sessionAgent.id, source: sessionAgent.source },
             });

package/dist/lib/format.d.ts

@@ -78,6 +78,17 @@ export declare function renderTable<T extends Record<string, string>>(rows: T[],
  * should print it in the reader's zone and name that zone once.
  */
 export declare function localStamp(value: unknown): string;
+/**
+ * One timestamp that carries its own zone: `2026-08-21 17:54:03 PDT`.
+ *
+ * For key/value output and any row that cannot share a header naming the zone.
+ * About 25 commands formatted with `toISOString().slice(0, 19)` — UTC with no
+ * marker, which reads as local time — while `harnesses list` and `machines`
+ * printed local time with the zone named, so one CLI kept two clocks
+ * (OSK-10041). Seconds, because the commands that print these (task runs,
+ * activity, monitor) order events seconds apart. Never throws.
+ */
+export declare function localTime(value: unknown): string;
 /**
  * `PDT` — the zone `localStamp` renders in, to be named once per command
  * rather than repeated on every row.