@skrr-ai/cli 0.1.42 → 0.1.43

package/dist/commands/tasks/complete.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.describePendingReview = describePendingReview;
 const core_1 = require("@oclif/core");
@@ -97,6 +130,11 @@ class TasksComplete extends base_command_1.BaseCommand {
             description: 'Exact Task Resource link id produced by `tasks deliverable add`',
         }),
         evidence: core_1.Flags.string({ multiple: true, description: 'Evidence as <kind>:<id-or-uri>' }),
+        attach: core_1.Flags.string({
+            multiple: true,
+            description: 'Upload a file as a Task asset (role: evidence) and cite it in evidenceRefs. ' +
+                'Repeatable. Re-attaching identical bytes dedupes on the server.',
+        }),
         remaining: core_1.Flags.string({ multiple: true, description: 'Remaining work item' }),
         'source-run': core_1.Flags.string({ multiple: true, description: 'Contributing Task Run id' }),
         'run-id': core_1.Flags.string({ description: 'Expected current Task Run id' }),
@@ -214,6 +252,23 @@ class TasksComplete extends base_command_1.BaseCommand {
                 retryable: false,
             });
         }
+        // --attach: upload once the input is known to be valid — a closeout the CLI
+        // is about to refuse must not leave stored bytes behind — and before the
+        // idempotency key is derived, so a retry sees the same refs.
+        const evidenceRefs = Array.isArray(input.evidenceRefs) ? [...input.evidenceRefs] : [];
+        if (flags.attach?.length) {
+            const { attachTaskAssetFiles } = await Promise.resolve().then(() => __importStar(require('../../lib/task-asset-upload')));
+            try {
+                evidenceRefs.push(...(await attachTaskAssetFiles({
+                    taskId: identity.id,
+                    files: flags.attach,
+                    role: 'evidence',
+                })));
+            }
+            catch (err) {
+                this.error(`--attach failed: ${err.message}`, { exit: 1 });
+            }
+        }
         const payload = {
             status,
             summary,
@@ -223,7 +278,7 @@ class TasksComplete extends base_command_1.BaseCommand {
             resourceLinkIds: Array.isArray(input.resourceLinkIds)
                 ? stringArray(input.resourceLinkIds)
                 : [],
-            evidenceRefs: Array.isArray(input.evidenceRefs) ? input.evidenceRefs : [],
+            evidenceRefs,
             remainingWork: Array.isArray(input.remainingWork) ? input.remainingWork : [],
             contributors: Array.isArray(input.contributors)
                 ? input.contributors

package/dist/commands/tasks/result/submit.d.ts

@@ -15,6 +15,7 @@ export default class TasksResultSubmit extends BaseCommand {
         'structured-json': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         deliverable: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         evidence: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        attach: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         remaining: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'run-id': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'source-run': import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
@@ -23,4 +24,6 @@ export default class TasksResultSubmit extends BaseCommand {
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
+    /** The two ways forward from a closed Task, named where the commands are known. */
+    private reopenRequired;
 }

package/dist/commands/tasks/result/submit.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
@@ -43,6 +76,11 @@ class TasksResultSubmit extends base_command_1.BaseCommand {
             multiple: true,
             description: 'Evidence reference as <kind>:<id-or-uri>',
         }),
+        attach: core_1.Flags.string({
+            multiple: true,
+            description: 'Upload a file as a Task asset (role: evidence) and cite it in evidenceRefs. ' +
+                'Repeatable. Re-attaching identical bytes dedupes on the server.',
+        }),
         remaining: core_1.Flags.string({ multiple: true, description: 'Remaining work item (repeatable)' }),
         'run-id': core_1.Flags.string({ description: 'Canonical Task Run that produced this Result' }),
         'source-run': core_1.Flags.string({ multiple: true, description: 'Contributing Run id (repeatable)' }),
@@ -85,6 +123,36 @@ class TasksResultSubmit extends base_command_1.BaseCommand {
             const value = raw.slice(split + 1);
             return /^https?:|^file:/.test(value) ? { kind, uri: value } : { kind, id: value };
         });
+        // --attach: upload first so the Result cites real asset ids. Uploads land
+        // before the idempotency key is derived, so a retry sees the same refs.
+        if (flags.attach?.length) {
+            const { attachTaskAssetFiles, readTaskForUpload } = await Promise.resolve().then(() => __importStar(require('../../../lib/task-asset-upload')));
+            // A closed Task refuses the Result, and the files would already be
+            // stored — indexed as unreferenced uploads nobody asked for. Ask first.
+            // The server's refusal below stays the authority; this only keeps a
+            // refusal we can already see from costing an upload.
+            let target;
+            try {
+                target = await readTaskForUpload(task.id);
+            }
+            catch (err) {
+                this.error(`--attach failed: ${err.message}`, { exit: 1 });
+            }
+            if ((0, task_closure_1.taskIsSettled)(target)) {
+                this.reopenRequired(task.id, 'This Task is closed, and a Result can only be submitted while it is open. ' +
+                    'Nothing was uploaded.');
+            }
+            try {
+                evidenceRefs.push(...(await attachTaskAssetFiles({
+                    taskId: task.id,
+                    files: flags.attach,
+                    role: 'evidence',
+                })));
+            }
+            catch (err) {
+                this.error(`--attach failed: ${err.message}`, { exit: 1 });
+            }
+        }
         const payload = {
             summary: flags.summary,
             body: flags.body,
@@ -127,14 +195,7 @@ class TasksResultSubmit extends base_command_1.BaseCommand {
             // (OSK-10031).
             const refusal = (0, base_command_1.apiRefusal)(error);
             if (refusal.code === 'TASK_REOPEN_REQUIRED') {
-                this.error([
-                    refusal.message ?? 'This Task is closed.',
-                    ...(0, task_closure_1.reopenRequiredLines)({
-                        bin: this.config.bin,
-                        task: task.id,
-                        command: 'result submit',
-                    }),
-                ].join('\n'), { exit: 1, code: 'TASK_REOPEN_REQUIRED' });
+                this.reopenRequired(task.id, refusal.message ?? 'This Task is closed.');
             }
             this.handleApiError(error);
         }
@@ -154,5 +215,12 @@ class TasksResultSubmit extends base_command_1.BaseCommand {
         if (url)
             this.log(`Task: ${url}`);
     }
+    /** The two ways forward from a closed Task, named where the commands are known. */
+    reopenRequired(taskId, message) {
+        this.error([
+            message,
+            ...(0, task_closure_1.reopenRequiredLines)({ bin: this.config.bin, task: taskId, command: 'result submit' }),
+        ].join('\n'), { exit: 1, code: 'TASK_REOPEN_REQUIRED' });
+    }
 }
 exports.default = TasksResultSubmit;

package/dist/commands/tasks/update.js

@@ -97,7 +97,9 @@ class TasksUpdate extends base_command_1.BaseCommand {
         // set of "move this task somewhere" options — which is how a reader
         // concludes the CLI cannot change a task's project at all (dogfood
         // OSK-4652). It can: `tasks move <id> --project <id|none>`.
-        goal: core_1.Flags.string({ description: 'Move task to a different goal' }),
+        goal: core_1.Flags.string({
+            description: 'Move task to a different goal (goal id), or "none" to detach it from its goal',
+        }),
         cycle: core_1.Flags.string({
             description: 'Set planning cycle by ID, or "current" / "next" in the task Space',
         }),
@@ -324,7 +326,7 @@ class TasksUpdate extends base_command_1.BaseCommand {
             // sees it and answers with the sentence that names `tasks move`.
             status: flags.status,
             duplicateOfId: flags['duplicate-of'],
-            goalId: flags.goal,
+            goalId: (0, tasks_2.resolveTaskGoalFlag)(flags.goal),
             cycleId: flags.cycle,
             spaceId: flags.space,
             assigneeAgentIds: flags['assignee-agent'],

package/dist/commands/tasks/updates/add.d.ts

@@ -15,6 +15,7 @@ export default class TasksUpdatesAdd extends BaseCommand {
         'spec-version': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         supersedes: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         reference: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        attach: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'idempotency-key': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
     };

package/dist/commands/tasks/updates/add.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
@@ -64,6 +97,12 @@ class TasksUpdatesAdd extends base_command_1.BaseCommand {
         }),
         supersedes: core_1.Flags.string({ description: 'Update id this correction supersedes' }),
         reference: core_1.Flags.string({ multiple: true, description: 'Reference as <kind>:<id-or-uri>' }),
+        attach: core_1.Flags.string({
+            multiple: true,
+            description: 'Upload a file as a Task asset (role: evidence) and cite it in this Update — appended to ' +
+                'data.evidenceRefs for finding/verification payloads, to the Update references otherwise. ' +
+                'Repeatable. Re-attaching identical bytes dedupes on the server.',
+        }),
         'idempotency-key': core_1.Flags.string({ description: 'Stable retry key for this exact Update' }),
         json: core_1.Flags.boolean({ description: 'Output JSON' }),
     };
@@ -88,6 +127,30 @@ class TasksUpdatesAdd extends base_command_1.BaseCommand {
             const value = raw.slice(split + 1);
             return /^https?:|^file:/.test(value) ? { kind, uri: value } : { kind, id: value };
         });
+        // --attach: upload first so the Update can cite the asset ids. For
+        // finding/verification the citation lands in data.evidenceRefs where the
+        // evidence renderer reads it; for the other Update kinds it becomes a
+        // task_attachment reference on the Update itself.
+        if (flags.attach?.length) {
+            const { attachTaskAssetFiles } = await Promise.resolve().then(() => __importStar(require('../../../lib/task-asset-upload')));
+            let refs;
+            try {
+                refs = await attachTaskAssetFiles({
+                    taskId: task.id,
+                    files: flags.attach,
+                    role: 'evidence',
+                });
+            }
+            catch (err) {
+                this.error(`--attach failed: ${err.message}`, { exit: 1 });
+            }
+            if (Array.isArray(data.evidenceRefs)) {
+                data = { ...data, evidenceRefs: [...data.evidenceRefs, ...refs] };
+            }
+            else {
+                references.push(...refs);
+            }
+        }
         const idempotencyKey = flags['idempotency-key'] ||
             (0, outbox_1.idempotencyKeyFor)('task-update', task.id, JSON.stringify({ type: flags.type, summary: flags.summary, data, resume }));
         let result;

package/dist/lib/api-fetch.js

@@ -93,9 +93,14 @@ async function apiFetch(pathOrUrl, opts = {}) {
             ? assertTrustedAutonomousUrl(pathOrUrl, baseURL)
             : pathOrUrl
         : `${baseURL.replace(/\/+$/, '')}${pathOrUrl.startsWith('/') ? '' : '/'}${pathOrUrl}`;
+    // A FormData body passes through untouched — fetch sets the multipart
+    // boundary itself, and stringifying would destroy it. Upload commands
+    // (tasks attachments) need this on the session-scoped path, which is not
+    // in dataService.
+    const isFormData = typeof FormData !== 'undefined' && opts.body instanceof FormData;
     let body;
     if (opts.body !== undefined && method !== 'GET') {
-        body = JSON.stringify(opts.body);
+        body = isFormData ? opts.body : JSON.stringify(opts.body);
     }
     // Same rule as every `dataService` write (`@skrr-ai/data-provider`
     // idempotency), chosen once so the 401 retries below resend the same key.
@@ -145,7 +150,7 @@ async function apiFetch(pathOrUrl, opts = {}) {
             Accept: 'application/json',
             'X-Oversky-Origin': (0, refresh_1.getCliOrigin)(),
         };
-        if (opts.body !== undefined && method !== 'GET') {
+        if (opts.body !== undefined && method !== 'GET' && !isFormData) {
             headers['Content-Type'] = 'application/json';
         }
         if (credential.token) {

package/dist/lib/cli-installers.d.ts

@@ -34,10 +34,7 @@ export interface ManagedCliProviderState {
     updateDisabledReason?: string | null;
     platformSupported?: boolean;
     authentication?: ManagedCliAuthentication | null;
-    job?: {
-        id?: string;
-        status?: string;
-    } | null;
+    job?: ManagedCliInstallJob | null;
 }
 export interface CliInstallersResponse {
     daemonId?: string;
@@ -155,6 +152,7 @@ export interface ManagedCliInstallJob {
     status: 'queued' | 'running' | 'succeeded' | 'failed';
     /** `update` for an in-place update; absent from an older daemon, meaning install. */
     kind?: 'install' | 'update';
+    startedAt?: string;
     previousVersion?: string | null;
     installedVersion?: string | null;
     error?: string;
@@ -184,6 +182,17 @@ export interface StartInstallResponse {
     };
 }
 export declare function startManagedCliInstall(daemonId: string, provider: string, credential?: unknown): Promise<StartInstallResponse>;
+/**
+ * How long after a start request times out a job for the same provider is taken
+ * to be the one that request began.
+ *
+ * The relay holds the request while the daemon answers, and a gateway can cut
+ * that off at its own deadline: an update returned HTTP 504 after 21.9s while
+ * the job it started ran to success, and the caller was told the outcome was
+ * unknown (OSK-10096 verifier). A job that started within this window of the
+ * request is that request's job.
+ */
+export declare const START_TIMEOUT_JOB_WINDOW_MS = 120000;
 /** Ask the daemon to update an installed CLI in place (OSK-10096). */
 export declare function startManagedCliUpdate(daemonId: string, provider: string, credential?: unknown): Promise<StartInstallResponse>;
 /**
@@ -191,6 +200,16 @@ export declare function startManagedCliUpdate(daemonId: string, provider: string
  * "Updated Claude Code 2.1.270 → 2.1.280." or "Claude Code is still 2.1.270:
  * its updater found nothing newer." Null when the job does not carry both.
  */
+/**
+ * The job a timed-out start request began, or null when none can be claimed.
+ *
+ * Read from the daemon's own inventory rather than assumed: it is the only
+ * party that knows whether the request reached it.
+ */
+export declare function jobStartedDespiteTimeout(daemonId: string, provider: string, credential?: unknown, opts?: {
+    now?: number;
+    windowMs?: number;
+}): Promise<ManagedCliInstallJob | null>;
 export declare function updateOutcomeLine(job: ManagedCliInstallJob): string | null;
 export declare function readManagedCliInstallJob(daemonId: string, jobId: string, credential?: unknown): Promise<{
     job?: ManagedCliInstallJob;

package/dist/lib/cli-installers.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.INSTALL_POLL_INTERVAL_MS = exports.INSTALL_MAX_WAIT_MS = exports.ROW_READINESS_TIMEOUT_MS = exports.MANAGED_CLI_PROVIDER_SINCE = void 0;
+exports.INSTALL_POLL_INTERVAL_MS = exports.INSTALL_MAX_WAIT_MS = exports.START_TIMEOUT_JOB_WINDOW_MS = exports.ROW_READINESS_TIMEOUT_MS = exports.MANAGED_CLI_PROVIDER_SINCE = void 0;
 exports.describeProvidersNotOffered = describeProvidersNotOffered;
 exports.providersNotOffered = providersNotOffered;
 exports.listCliInstallers = listCliInstallers;
@@ -10,6 +10,7 @@ exports.readinessKey = readinessKey;
 exports.readinessForRows = readinessForRows;
 exports.startManagedCliInstall = startManagedCliInstall;
 exports.startManagedCliUpdate = startManagedCliUpdate;
+exports.jobStartedDespiteTimeout = jobStartedDespiteTimeout;
 exports.updateOutcomeLine = updateOutcomeLine;
 exports.readManagedCliInstallJob = readManagedCliInstallJob;
 exports.unseenLogLines = unseenLogLines;
@@ -88,12 +89,14 @@ function describeProvidersNotOffered(missing) {
         .join(', ');
 }
 function providersNotOffered(offered, known) {
-    // Canonicalize BOTH sides. An older daemon answers under the spelling it was
-    // built with — the 0.8.35 build reports the first-party harness under its
-    // older spelling, so a raw comparison against the current one reported it missing on
-    // a machine where it is installed and working. Caught by running this against
-    // the very daemon the finding was about: the first version of this helper
-    // said "Not offered: devin, <first-party harness>" when only `devin` was true.
+    // Canonicalize BOTH sides. A daemon answers under the spelling it was built
+    // with — during the rename window the 0.8.35 build reported the first-party
+    // harness under its older spelling, so a raw comparison against the current
+    // one reported it missing on a machine where it was installed and working (the
+    // first version of this helper said "Not offered: devin, <first-party
+    // harness>" when only `devin` was true). This is INGRESS, so it canonicalizes
+    // accepted spellings only: since contract a retired spelling is not the
+    // harness, and a daemon still answering under one predates the wire release.
     const seen = new Set((offered ?? []).map((provider) => canonical(provider.provider)).filter(Boolean));
     return known.filter((provider) => !seen.has(canonical(provider)));
 }
@@ -214,6 +217,17 @@ async function readinessForRows(rows, credential, opts = {}) {
 async function startManagedCliInstall(daemonId, provider, credential) {
     return (0, api_fetch_1.apiFetch)(`/api/daemons/${encodeURIComponent(daemonId)}/cli-installers/${encodeURIComponent(provider)}/install`, { method: 'POST', body: {}, credential: credential });
 }
+/**
+ * How long after a start request times out a job for the same provider is taken
+ * to be the one that request began.
+ *
+ * The relay holds the request while the daemon answers, and a gateway can cut
+ * that off at its own deadline: an update returned HTTP 504 after 21.9s while
+ * the job it started ran to success, and the caller was told the outcome was
+ * unknown (OSK-10096 verifier). A job that started within this window of the
+ * request is that request's job.
+ */
+exports.START_TIMEOUT_JOB_WINDOW_MS = 120_000;
 /** Ask the daemon to update an installed CLI in place (OSK-10096). */
 async function startManagedCliUpdate(daemonId, provider, credential) {
     return (0, api_fetch_1.apiFetch)(`/api/daemons/${encodeURIComponent(daemonId)}/cli-installers/${encodeURIComponent(provider)}/update`, { method: 'POST', body: {}, credential: credential });
@@ -223,6 +237,32 @@ async function startManagedCliUpdate(daemonId, provider, credential) {
  * "Updated Claude Code 2.1.270 → 2.1.280." or "Claude Code is still 2.1.270:
  * its updater found nothing newer." Null when the job does not carry both.
  */
+/**
+ * The job a timed-out start request began, or null when none can be claimed.
+ *
+ * Read from the daemon's own inventory rather than assumed: it is the only
+ * party that knows whether the request reached it.
+ */
+async function jobStartedDespiteTimeout(daemonId, provider, credential, opts = {}) {
+    let response;
+    try {
+        response = await listCliInstallers(daemonId, credential);
+    }
+    catch {
+        return null;
+    }
+    const row = (response.providers ?? []).find((entry) => canonical(entry.provider) === canonical(provider));
+    const job = row?.job;
+    if (!job?.id)
+        return null;
+    if (job.status === 'queued' || job.status === 'running')
+        return job;
+    const startedAt = job.startedAt ? Date.parse(job.startedAt) : NaN;
+    if (!Number.isFinite(startedAt))
+        return null;
+    const now = opts.now ?? Date.now();
+    return now - startedAt <= (opts.windowMs ?? exports.START_TIMEOUT_JOB_WINDOW_MS) ? job : null;
+}
 function updateOutcomeLine(job) {
     const before = job.previousVersion;
     const after = job.installedVersion;

package/dist/lib/dedicated-machines.js

@@ -845,8 +845,10 @@ function selectDedicatedAttachHarness(lease, harnesses, engine) {
     }
     const providers = [...new Set(rows.map((row) => row.provider))];
     if (engine) {
-        // Any accepted spelling of an engine names it: a user who typed the first-party
-        // harness's older name means the row stored under its canonical one.
+        // Any ACCEPTED spelling of an engine names it — during a rename's alias window,
+        // a user who typed the first-party harness's older name means the row stored
+        // under its canonical one. A retired spelling is accepted nowhere, so it names
+        // no engine here either (`isSameHarnessProvider`).
         const match = rows.find((row) => (0, auth_core_1.isSameHarnessProvider)(row.provider, engine));
         if (!match) {
             return {

package/dist/lib/file-mime.js

@@ -68,7 +68,7 @@ const MIME_TYPES = {
     '.md': 'text/markdown',
     '.mjs': 'text/javascript',
     '.mkv': 'video/mkv',
-    '.mov': 'video/mov',
+    '.mov': 'video/quicktime',
     '.mp3': 'audio/mpeg',
     '.mp4': 'video/mp4',
     '.ogv': 'video/ogv',

package/dist/lib/first-party-harness-agent.js

@@ -220,7 +220,7 @@ async function resolveFirstPartyHarnessAgent(explicit, deps = {}, options = {})
         const created = options.createDefault === false
             ? null
             : await (deps.ensureDefaultAgent ?? ensureDefaultAgent)(
-            // Canonical: what the server stores. It accepts every spelling.
+            // Canonical: what the server stores, and the one spelling every server accepts.
             auth_core_1.FIRST_PARTY_HARNESS.provider, options.signal);
         if (created?.id) {
             return {
@@ -330,11 +330,12 @@ function readRawConfigKey() {
  * first real session read. Returns whether the file now holds it under the
  * neutral key.
  *
- * Reading alone used to leave it where it was, which is safe only while that key
- * is still an accepted spelling. The contract phase empties the identity's
- * aliases, `legacyAgentConfigKeys()` then stops naming the old key, and a user
+ * Reading alone used to leave it where it was. `legacyAgentConfigKeys()` keeps
+ * naming an old key after its spelling is retired (it reads the identity's
+ * ARTIFACT spellings, since the file predates the rename), but a key that is only
+ * ever read is one the next pruning of `formerSpellings` would strand, and a user
  * who never ran `--set`, `--clear` or logout would silently lose their setting.
- * Moving it here retires the old key long before that date.
+ * Moving it on the first session read retires the old key long before that.
  *
  * Only the session path calls this — `skrr code doctor` reports and never
  * writes. Best-effort: an unwritable config is left alone and still read.