@skrr-ai/cli 0.1.42 → 0.1.43

package/dist/lib/first-party-harness-doctor.js

@@ -42,17 +42,6 @@ const first_party_harness_1 = require("./first-party-harness");
 const auth_core_1 = require("@skrr-ai/auth-core");
 const harness_tiers_1 = require("./harness-tiers");
 const first_party_harness_managed_1 = require("./first-party-harness-managed");
-/**
- * The variable one purpose was read from, and — when that was an older name — the
- * sentence that says so. `undefined` when the neutral name (or nothing) was used.
- */
-function legacyEnvNote(key, name) {
-    const neutral = auth_core_1.FIRST_PARTY_HARNESS_ENV[key].name;
-    if (!name || name === neutral)
-        return undefined;
-    return (`${name} is an older name for this setting and is still read; ` +
-        `rename it to ${neutral}, which wins when both are set.`);
-}
 /**
  * Project-level state dir — the ENGINE's own project marker
  * (`FIRST_PARTY_HARNESS_ENGINE.projectDirectory`). Basename deliberately differs
@@ -78,10 +67,12 @@ function projectStateDir(cwd) {
  * the answer one copy-paste away and keeps the property — and the promise is
  * reworded to match what is delivered rather than the other way round.
  *
- * The URL is the CANONICAL feed candidate. A manifest may also be published under
- * each older spelling (`firstPartyHarnessFeedCandidates`), and an installer that
- * finds nothing at the canonical URL tries those next — so the remedy names them
- * too. Without that, "the canonical URL 404s" would read as "there is no release"
+ * The URL is the CANONICAL feed candidate. While a rename's alias window is open
+ * a manifest may also be published under each alias (`firstPartyHarnessFeedCandidates`
+ * for a channel read), and an installer that finds nothing at the canonical URL
+ * tries those next — so the remedy names them too. A retired spelling is not
+ * among them: its channel pointers stopped moving when publishing stopped writing
+ * them, and naming one would point at a stale release. Without that, "the canonical URL 404s" would read as "there is no release"
  * on a feed an older pipeline published under the other spelling. The doctor
  * cannot say which candidate actually holds a release, because it does not probe;
  * it says where to look, in the order an installer looks.
@@ -97,15 +88,13 @@ function releaseChannelCheck(env) {
         manifestFilename: candidate.manifestFilename,
         channel,
     }));
-    const legacyNote = legacyEnvNote('channel', source);
     if (invalid) {
         return {
             name: 'release-channel',
             status: 'warn',
             detail: `${source}='${invalid}' is not a channel; following '${channel}' instead — ${canonical}`,
             remedy: `Set ${auth_core_1.FIRST_PARTY_HARNESS_ENV.channel.name} to one of ${auth_core_1.FIRST_PARTY_HARNESS_CHANNELS.join(', ')}, ` +
-                'or unset it to follow the default.' +
-                (legacyNote ? ` ${legacyNote}` : ''),
+                'or unset it to follow the default.',
         };
     }
     const alsoTried = alternates.filter((url) => url !== canonical);
@@ -114,10 +103,7 @@ function releaseChannelCheck(env) {
         status: 'ok',
         detail: `${channel} — ${canonical}`,
         remedy: 'Fetch that URL to see whether the channel has a published release, and which version.' +
-            (alsoTried.length
-                ? ` If it has none, an installer also tries ${alsoTried.join(', ')}.`
-                : '') +
-            (legacyNote ? ` ${legacyNote}` : ''),
+            (alsoTried.length ? ` If it has none, an installer also tries ${alsoTried.join(', ')}.` : ''),
     };
 }
 /**
@@ -159,7 +145,8 @@ function strandedLegacyEngine(env) {
 /**
  * Whether a managed engine resolved under an OLDER spelling of its file name.
  *
- * Not a fault: resolution tries every spelling on purpose, and the next
+ * Not a fault: resolution tries every artifact spelling on purpose (a former one
+ * included — the file predates the rename), and the next
  * `skrr code` run renames the file onto the canonical name (leaving a link at the
  * old one). Said anyway, because a path that does not match the name everything
  * else prints is exactly the surprise this module exists to explain.
@@ -196,14 +183,12 @@ function engineCheck(env) {
         };
     }
     if (bin && source === 'env') {
-        // Name the variable, not just "env": two names are read for this override,
-        // and the one to edit is the one that is set.
-        const legacyNote = resolution.legacyEnv ? legacyEnvNote('path', resolution.envName) : undefined;
+        // Name the variable, not just "env": an override is the one resolution the
+        // user set by hand, and the variable is what they would edit.
         return {
             name: 'engine',
             status: 'ok',
             detail: `${bin} (resolved via env ${resolution.envName})`,
-            ...(legacyNote ? { remedy: legacyNote } : {}),
         };
     }
     if (bin) {
@@ -232,7 +217,6 @@ function engineCheck(env) {
         };
     }
     const override = (0, auth_core_1.readFirstPartyHarnessEnv)(env, 'path');
-    const legacyNote = legacyEnvNote('path', override.name);
     if (override.value && !node_path_1.default.isAbsolute(override.value)) {
         return {
             name: 'engine',
@@ -241,7 +225,7 @@ function engineCheck(env) {
             // agent-invoked command the cwd is attacker-influenced, so a repo
             // containing a file named like the engine could otherwise hijack it.
             detail: `${override.name} is set to a relative path ('${override.value}') and was ignored`,
-            remedy: `Set ${pathVar} to an absolute path.${legacyNote ? ` ${legacyNote}` : ''}`,
+            remedy: `Set ${pathVar} to an absolute path.`,
         };
     }
     if (override.value) {
@@ -249,8 +233,7 @@ function engineCheck(env) {
             name: 'engine',
             status: 'fail',
             detail: `${override.name}='${override.value}' is not an executable file`,
-            remedy: `Point it at a real ${auth_core_1.FIRST_PARTY_HARNESS.displayName} engine build, or unset it to fall back to PATH.` +
-                (legacyNote ? ` ${legacyNote}` : ''),
+            remedy: `Point it at a real ${auth_core_1.FIRST_PARTY_HARNESS.displayName} engine build, or unset it to fall back to PATH.`,
         };
     }
     return {
@@ -451,7 +434,7 @@ function opencodeCheck(cwd) {
  * `daemon/src/harness-trust.ts` again.
  */
 function trustCheck() {
-    // The canonical slug. The shared table carries every spelling at the same tier,
+    // The canonical slug. The shared table carries every accepted spelling at the same tier,
     // so which one is asked does not change the answer — but the report prints the
     // name the platform stores.
     const harness = auth_core_1.FIRST_PARTY_HARNESS.provider;

package/dist/lib/first-party-harness-managed.d.ts

@@ -70,10 +70,15 @@ export declare const AGENT_FLAG_SPELLINGS: readonly ["--skrr-agent", "--oversky-
 export declare const AGENT_CONFIG_KEY: "firstPartyHarnessAgentId";
 /**
  * Keys earlier CLIs stored the agent setting under: `<camelCased spelling>AgentId`
- * for every spelling of the harness, canonical first.
- *
- * Derived rather than listed so no product name is written here — and so the key
- * is read for exactly as long as its spelling is accepted anywhere else.
+ * for every ARTIFACT spelling of the harness, canonical first.
+ *
+ * A config file on a user's disk is an artifact: a CLI that last ran before a
+ * rename wrote the key under the product name it had then, and that file does not
+ * change when the spelling stops being accepted anywhere. So the key is derived
+ * from `firstPartyHarnessArtifactSpellings` — former spellings included — and is
+ * read (and moved onto the neutral key) for as long as the identity remembers the
+ * spelling, not merely for as long as some ingress still accepts it. Derived
+ * rather than listed, so no product name is written here.
  */
 export declare function legacyAgentConfigKeys(): string[];
 export interface AgentSetting {

package/dist/lib/first-party-harness-managed.js

@@ -90,17 +90,22 @@ exports.AGENT_CONFIG_KEY = 'firstPartyHarnessAgentId';
 function camelCaseSlug(slug) {
     return slug.replace(/-([a-z0-9])/g, (_, next) => next.toUpperCase());
 }
-// TODO(identity): move to auth-core — the identity module records legacy ENV
-// names; it has no notion of a legacy CONFIG key yet.
+// TODO(identity): move to auth-core — the identity module derives on-disk binary
+// names from its artifact spellings; it has no notion of a legacy CONFIG key yet.
 /**
  * Keys earlier CLIs stored the agent setting under: `<camelCased spelling>AgentId`
- * for every spelling of the harness, canonical first.
+ * for every ARTIFACT spelling of the harness, canonical first.
  *
- * Derived rather than listed so no product name is written here — and so the key
- * is read for exactly as long as its spelling is accepted anywhere else.
+ * A config file on a user's disk is an artifact: a CLI that last ran before a
+ * rename wrote the key under the product name it had then, and that file does not
+ * change when the spelling stops being accepted anywhere. So the key is derived
+ * from `firstPartyHarnessArtifactSpellings` — former spellings included — and is
+ * read (and moved onto the neutral key) for as long as the identity remembers the
+ * spelling, not merely for as long as some ingress still accepts it. Derived
+ * rather than listed, so no product name is written here.
  */
 function legacyAgentConfigKeys() {
-    return (0, auth_core_1.firstPartyHarnessSpellings)().map((spelling) => `${camelCaseSlug(spelling)}AgentId`);
+    return (0, auth_core_1.firstPartyHarnessArtifactSpellings)().map((spelling) => `${camelCaseSlug(spelling)}AgentId`);
 }
 /** Read the setting from a config record: the neutral key first, then each older key. */
 function readAgentSetting(config) {
@@ -250,8 +255,7 @@ function managedSkipReason(env = process.env) {
             announce: false,
         };
     }
-    // The operator's opt-OUT (`FIRST_PARTY_HARNESS_ENV.managed`, neutral name first,
-    // older name second). Present because "run with my own key" has to be
+    // The operator's opt-OUT (`FIRST_PARTY_HARNESS_ENV.managed`). Present because "run with my own key" has to be
     // expressible without logging out, and because a test that asserts argv
     // forwarding must be able to say "this run is not about acquisition" rather
     // than depend on whether the machine happens to be signed in.
@@ -259,8 +263,7 @@ function managedSkipReason(env = process.env) {
     if (envFlagIsOff(managedFlag.value)) {
         return {
             kind: 'disabled',
-            // The variable that was actually read — two names are honoured, and the one
-            // to change is the one that is set.
+            // The variable that was actually read, so the sentence names what to change.
             detail: `${managedFlag.name} is off`,
             announce: false,
         };

package/dist/lib/first-party-harness.d.ts

@@ -18,8 +18,10 @@
  * Every product-named value — the binary's file name, the engine home, the env
  * var names, the display name — is read from the identity module in
  * `@skrr-ai/auth-core` (`docs/architecture/skrr-code-identifier-rename-2026-09-13.md`).
- * The engine's file name has more than one spelling while a rename is in
- * flight, so resolution tries every spelling, canonical first, in each location.
+ * An installed engine is an ARTIFACT: one installed before a rename is still on
+ * disk under its old file name after that name stops being accepted anywhere, so
+ * resolution tries every artifact spelling (`firstPartyHarnessArtifactSpellings`),
+ * canonical first, in each location. That recognises a file; it admits no input.
  */
 /**
  * The error `execEngine` throws when no engine resolves. A value the commands
@@ -44,11 +46,12 @@ export declare function engineHome(env?: NodeJS.ProcessEnv): string;
 /**
  * The user-level instruction root the engine owns.
  *
- * Read under the neutral variable first and its older name second
- * (`readFirstPartyHarnessEnv`). The older name is also the one the ENGINE reads,
- * which is why {@link engineOwnedEnv} hands the resolved value to the engine under
- * that name — otherwise the doctor would honour the neutral variable and the
- * engine would not.
+ * Read under the platform's neutral variable first, then under the variable the
+ * ENGINE itself reads (`FIRST_PARTY_HARNESS_ENGINE.env.home`). The second is not a
+ * legacy fallback: it is the engine's own name, the engine honours it whatever the
+ * platform does, and a CLI that ignored it would report one instruction root while
+ * the engine it launches used another. {@link engineOwnedEnv} closes the other
+ * direction, handing a neutral-variable value to the engine under its own name.
  */
 export declare function engineInstructionHome(env?: NodeJS.ProcessEnv): string;
 /**
@@ -58,8 +61,9 @@ export declare function engineInstructionHome(env?: NodeJS.ProcessEnv): string;
  */
 export declare function managedEnginePath(env?: NodeJS.ProcessEnv, provider?: string): string;
 /**
- * The same managed location under the PREVIOUS config root, for every spelling of
- * the binary and every engine home name, canonical first.
+ * The same managed location under the PREVIOUS config root, for every artifact
+ * spelling of the binary (former spellings included) and every engine home name,
+ * canonical first.
  *
  * The root moved `~/.oversky` → `~/.skrr` in the skrr rename, and an engine
  * installed before that is still on disk under the old one. `daemon/src/
@@ -69,7 +73,7 @@ export declare function managedEnginePath(env?: NodeJS.ProcessEnv, provider?: st
  *
  * The engine-home move (`migrateFirstPartyHarnessHome`) only ever works under the
  * CURRENT root, so nothing renames a binary here — which is why this list carries
- * every spelling rather than only the canonical one.
+ * every artifact spelling rather than only the canonical one.
  *
  * Empty when an explicit `OVERSKY_CONFIG_DIR` is set, matching the daemon: that
  * override names one root deliberately, and reaching past it to a hard-coded home
@@ -84,11 +88,9 @@ export interface EngineResolution {
     /**
      * The variable an explicit override was read from — set whenever one was set,
      * including an override that was refused. The doctor names it, because an
-     * operator fixing a bad override needs to know WHICH of its names they set.
+     * operator fixing a bad override needs to be told which variable to change.
      */
     envName?: string;
-    /** True when {@link envName} is an older name for the override. */
-    legacyEnv?: boolean;
 }
 /**
  * Resolve the engine binary, reporting WHERE it came from.
@@ -100,12 +102,12 @@ export interface EngineResolution {
  * The env override is checked first and is absolute-only. A relative override
  * would resolve against the caller's cwd, which for an agent-invoked command is
  * attacker-influenced: a repo containing a file named like the engine could
- * hijack it. It is read under its neutral name first and its older name second.
+ * hijack it.
  *
  * **Order: env → managed → PATH → well-known (WL-6.2).** Within each location
- * every spelling of the binary is tried, canonical first — the daemon's order —
- * so an engine installed under an older name still resolves, and the canonical
- * one wins wherever both exist.
+ * every artifact spelling of the binary is tried, canonical first — the daemon's
+ * order — so an engine installed under an older or former name still resolves,
+ * and the canonical one wins wherever both exist.
  *
  * The managed location beating `PATH` is the load-bearing part, and it is a
  * deliberate reversal of the obvious ordering.
@@ -376,10 +378,12 @@ export declare function engineSpawnEnv(env: NodeJS.ProcessEnv, extraEnv: Record<
  * `skrr code doctor` honour it while the engine it launches ignored it — two
  * answers to "where do my instructions live" from one command.
  *
- * Only when the value came from a name the engine does NOT read: a value set under
- * the engine's own name is inherited already, and rewriting it would only replace
- * the user's spelling of a path with ours. The resolved path is passed rather than
- * the raw value, so the engine and the doctor agree on `~` expansion too.
+ * Only when the neutral variable supplied the value: a value set only under the
+ * engine's own name is inherited already, and rewriting it would only replace the
+ * user's spelling of a path with ours. When both are set the neutral one wins, as
+ * it does in {@link engineInstructionHome}, so the engine is handed that one. The
+ * resolved path is passed rather than the raw value, so the engine and the doctor
+ * agree on `~` expansion too.
  *
  * Not a credential and never one: it cannot reintroduce anything the sanitizer
  * strips, and `extraEnv` still layers over it.

package/dist/lib/first-party-harness.js

@@ -19,8 +19,10 @@
  * Every product-named value — the binary's file name, the engine home, the env
  * var names, the display name — is read from the identity module in
  * `@skrr-ai/auth-core` (`docs/architecture/skrr-code-identifier-rename-2026-09-13.md`).
- * The engine's file name has more than one spelling while a rename is in
- * flight, so resolution tries every spelling, canonical first, in each location.
+ * An installed engine is an ARTIFACT: one installed before a rename is still on
+ * disk under its old file name after that name stops being accepted anywhere, so
+ * resolution tries every artifact spelling (`firstPartyHarnessArtifactSpellings`),
+ * canonical first, in each location. That recognises a file; it admits no input.
  */
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
@@ -81,14 +83,15 @@ function engineHome(env = process.env) {
 /**
  * The user-level instruction root the engine owns.
  *
- * Read under the neutral variable first and its older name second
- * (`readFirstPartyHarnessEnv`). The older name is also the one the ENGINE reads,
- * which is why {@link engineOwnedEnv} hands the resolved value to the engine under
- * that name — otherwise the doctor would honour the neutral variable and the
- * engine would not.
+ * Read under the platform's neutral variable first, then under the variable the
+ * ENGINE itself reads (`FIRST_PARTY_HARNESS_ENGINE.env.home`). The second is not a
+ * legacy fallback: it is the engine's own name, the engine honours it whatever the
+ * platform does, and a CLI that ignored it would report one instruction root while
+ * the engine it launches used another. {@link engineOwnedEnv} closes the other
+ * direction, handing a neutral-variable value to the engine under its own name.
  */
 function engineInstructionHome(env = process.env) {
-    const configured = (0, auth_core_1.readFirstPartyHarnessEnv)(env, 'home').value;
+    const configured = (0, auth_core_1.readFirstPartyHarnessEnv)(env, 'home').value ?? engineHomeVariable(env);
     // Falls through to `engineHome()` rather than re-deriving `~/.skrr` — the two
     // describe the same root, and re-deriving it is what made them disagree under
     // `OVERSKY_CONFIG_DIR` (OSK-300).
@@ -100,6 +103,11 @@ function engineInstructionHome(env = process.env) {
         return node_path_1.default.join((0, node_os_1.homedir)(), configured.slice(2));
     return node_path_1.default.resolve(configured);
 }
+/** The engine's own home variable, trimmed; undefined when unset or blank. */
+function engineHomeVariable(env) {
+    const raw = env[auth_core_1.FIRST_PARTY_HARNESS_ENGINE.env.home];
+    return typeof raw === 'string' && raw.trim() !== '' ? raw.trim() : undefined;
+}
 /**
  * The managed install location for one spelling of the binary (canonical by
  * default) — where the daemon, the Desktop app, and
@@ -109,8 +117,9 @@ function managedEnginePath(env = process.env, provider = auth_core_1.FIRST_PARTY
     return (0, auth_core_1.firstPartyHarnessInstalledBinaryPath)(env, provider, process.platform);
 }
 /**
- * The same managed location under the PREVIOUS config root, for every spelling of
- * the binary and every engine home name, canonical first.
+ * The same managed location under the PREVIOUS config root, for every artifact
+ * spelling of the binary (former spellings included) and every engine home name,
+ * canonical first.
  *
  * The root moved `~/.oversky` → `~/.skrr` in the skrr rename, and an engine
  * installed before that is still on disk under the old one. `daemon/src/
@@ -120,7 +129,7 @@ function managedEnginePath(env = process.env, provider = auth_core_1.FIRST_PARTY
  *
  * The engine-home move (`migrateFirstPartyHarnessHome`) only ever works under the
  * CURRENT root, so nothing renames a binary here — which is why this list carries
- * every spelling rather than only the canonical one.
+ * every artifact spelling rather than only the canonical one.
  *
  * Empty when an explicit `OVERSKY_CONFIG_DIR` is set, matching the daemon: that
  * override names one root deliberately, and reaching past it to a hard-coded home
@@ -149,11 +158,13 @@ function fallbackPaths(exeName) {
     ];
 }
 /**
- * The file names a PATH directory may hold the engine under, canonical first.
- * Windows also accepts a `.cmd` shim, as a package manager may install one.
+ * The file names a PATH directory may hold the engine under, canonical first —
+ * every artifact spelling, since a standalone install made before a rename keeps
+ * its old name. Windows also accepts a `.cmd` shim, as a package manager may
+ * install one.
  */
 function pathExecutableNames(platform) {
-    return (0, auth_core_1.firstPartyHarnessSpellings)().flatMap((spelling) => platform === 'win32'
+    return (0, auth_core_1.firstPartyHarnessArtifactSpellings)().flatMap((spelling) => platform === 'win32'
         ? [(0, auth_core_1.firstPartyHarnessBinaryName)(spelling, platform), `${spelling}.cmd`]
         : [(0, auth_core_1.firstPartyHarnessBinaryName)(spelling, platform)]);
 }
@@ -176,12 +187,12 @@ function isExecutable(p) {
  * The env override is checked first and is absolute-only. A relative override
  * would resolve against the caller's cwd, which for an agent-invoked command is
  * attacker-influenced: a repo containing a file named like the engine could
- * hijack it. It is read under its neutral name first and its older name second.
+ * hijack it.
  *
  * **Order: env → managed → PATH → well-known (WL-6.2).** Within each location
- * every spelling of the binary is tried, canonical first — the daemon's order —
- * so an engine installed under an older name still resolves, and the canonical
- * one wins wherever both exist.
+ * every artifact spelling of the binary is tried, canonical first — the daemon's
+ * order — so an engine installed under an older or former name still resolves,
+ * and the canonical one wins wherever both exist.
  *
  * The managed location beating `PATH` is the load-bearing part, and it is a
  * deliberate reversal of the obvious ordering.
@@ -210,7 +221,7 @@ function resolveEngine(env = process.env) {
     const platform = process.platform;
     const override = (0, auth_core_1.readFirstPartyHarnessEnv)(env, 'path');
     if (override.value && override.name) {
-        const origin = { envName: override.name, legacyEnv: override.legacy };
+        const origin = { envName: override.name };
         const candidate = override.value;
         if (!node_path_1.default.isAbsolute(candidate))
             return { path: null, source: 'unresolved', ...origin };
@@ -218,7 +229,7 @@ function resolveEngine(env = process.env) {
             ? { path: candidate, source: 'env', ...origin }
             : { path: null, source: 'unresolved', ...origin };
     }
-    for (const spelling of (0, auth_core_1.firstPartyHarnessSpellings)()) {
+    for (const spelling of (0, auth_core_1.firstPartyHarnessArtifactSpellings)()) {
         const managed = managedEnginePath(env, spelling);
         if (isExecutable(managed))
             return { path: managed, source: 'managed' };
@@ -595,18 +606,19 @@ mode) {
  * `skrr code doctor` honour it while the engine it launches ignored it — two
  * answers to "where do my instructions live" from one command.
  *
- * Only when the value came from a name the engine does NOT read: a value set under
- * the engine's own name is inherited already, and rewriting it would only replace
- * the user's spelling of a path with ours. The resolved path is passed rather than
- * the raw value, so the engine and the doctor agree on `~` expansion too.
+ * Only when the neutral variable supplied the value: a value set only under the
+ * engine's own name is inherited already, and rewriting it would only replace the
+ * user's spelling of a path with ours. When both are set the neutral one wins, as
+ * it does in {@link engineInstructionHome}, so the engine is handed that one. The
+ * resolved path is passed rather than the raw value, so the engine and the doctor
+ * agree on `~` expansion too.
  *
  * Not a credential and never one: it cannot reintroduce anything the sanitizer
  * strips, and `extraEnv` still layers over it.
  */
 function engineOwnedEnv(env) {
     const out = {};
-    const home = (0, auth_core_1.readFirstPartyHarnessEnv)(env, 'home');
-    if (home.value && home.name !== auth_core_1.FIRST_PARTY_HARNESS_ENGINE.env.home) {
+    if ((0, auth_core_1.readFirstPartyHarnessEnv)(env, 'home').value) {
         out[auth_core_1.FIRST_PARTY_HARNESS_ENGINE.env.home] = engineInstructionHome(env);
     }
     return out;
@@ -615,7 +627,8 @@ async function execEngine(args, env = process.env, options = {}) {
     // Move an engine installed under an older binary name onto the canonical one,
     // BEFORE resolving. Idempotent, lossless, and it never throws: a move that
     // cannot be made leaves every file where it was, and `resolveEngine` still tries
-    // every spelling — so the worst case is today's path, never a missing engine.
+    // every artifact spelling — so the worst case is today's path, never a missing
+    // engine.
     // Here and not in `resolveEngine`, which the doctor also calls and which must
     // not move anything.
     (0, auth_core_1.migrateFirstPartyHarnessHome)({ env });

package/dist/lib/harness-provider-input.d.ts

@@ -1,20 +1,25 @@
 /**
  * Harness-valued INPUT, normalised at the edge.
  *
- * The first-party harness has more than one accepted spelling while a rename is
- * in flight (`FIRST_PARTY_HARNESS.aliases`). Every flag, setting and filter that
- * takes a harness name must accept all of them — a script written against either
- * spelling keeps working — and must hand the rest of the CLI ONE value, so no
- * comparison downstream has to know there were two
- * (`docs/architecture/skrr-code-identifier-rename-2026-09-13.md` §2).
+ * INGRESS: every flag, setting and filter that takes a harness name accepts
+ * exactly the identity's ACCEPTED spellings (`firstPartyHarnessSpellings`) and
+ * hands the rest of the CLI ONE value, so no comparison downstream has to know
+ * whether there were several (`docs/architecture/skrr-code-identifier-rename-2026-09-13.md`
+ * §2). During a rename's alias window that is the canonical spelling plus
+ * `FIRST_PARTY_HARNESS.aliases`, so a script written against either keeps
+ * working; outside one it is the canonical spelling alone. A FORMER spelling is
+ * accepted on no input — it is passed through unchanged, so a flag offering only
+ * the accepted spellings rejects it — even though the CLI still recognises it on
+ * an engine binary already on disk (`first-party-harness.ts`).
  *
  * Two destinations, two spellings, and the difference is the point:
  *
  *   - to the SERVER (HTTP bodies, query params) and to the terminal: CANONICAL,
  *     which is what the platform stores and returns;
- *   - to the local DAEMON binary: the WIRE spelling, which every daemon version
- *     already installed on a user's machine understands. A daemon that predates
- *     the rename cannot be taught a new spelling by the CLI that talks to it.
+ *   - to the local DAEMON binary: the WIRE spelling (`wireProvider`). It sits on
+ *     the old spelling from a rename's flip until its wire phase, because a daemon
+ *     that predates the rename cannot be taught a new spelling by the CLI that
+ *     talks to it, and is canonical otherwise.
  *
  * Every other harness name passes through unchanged — this normalises one
  * harness's spellings, it is not a general lower-caser, and silently rewriting a
@@ -28,8 +33,9 @@ export declare function canonicalHarnessInputs(values: readonly string[]): strin
 export declare function daemonHarnessArgument(value: string): string;
 /**
  * The `options` list for an oclif flag that enumerates harness names: the given
- * names with every spelling of the first-party harness in place of its canonical
- * one, so oclif's own validation accepts an alias instead of rejecting it before
- * the command ever runs.
+ * names with every ACCEPTED spelling of the first-party harness in place of its
+ * canonical one, so oclif's own validation accepts an alias instead of rejecting
+ * it before the command ever runs — and rejects a former spelling, which no
+ * ingress accepts.
  */
 export declare function harnessFlagOptions(names: readonly string[]): string[];

package/dist/lib/harness-provider-input.js

@@ -2,20 +2,25 @@
 /**
  * Harness-valued INPUT, normalised at the edge.
  *
- * The first-party harness has more than one accepted spelling while a rename is
- * in flight (`FIRST_PARTY_HARNESS.aliases`). Every flag, setting and filter that
- * takes a harness name must accept all of them — a script written against either
- * spelling keeps working — and must hand the rest of the CLI ONE value, so no
- * comparison downstream has to know there were two
- * (`docs/architecture/skrr-code-identifier-rename-2026-09-13.md` §2).
+ * INGRESS: every flag, setting and filter that takes a harness name accepts
+ * exactly the identity's ACCEPTED spellings (`firstPartyHarnessSpellings`) and
+ * hands the rest of the CLI ONE value, so no comparison downstream has to know
+ * whether there were several (`docs/architecture/skrr-code-identifier-rename-2026-09-13.md`
+ * §2). During a rename's alias window that is the canonical spelling plus
+ * `FIRST_PARTY_HARNESS.aliases`, so a script written against either keeps
+ * working; outside one it is the canonical spelling alone. A FORMER spelling is
+ * accepted on no input — it is passed through unchanged, so a flag offering only
+ * the accepted spellings rejects it — even though the CLI still recognises it on
+ * an engine binary already on disk (`first-party-harness.ts`).
  *
  * Two destinations, two spellings, and the difference is the point:
  *
  *   - to the SERVER (HTTP bodies, query params) and to the terminal: CANONICAL,
  *     which is what the platform stores and returns;
- *   - to the local DAEMON binary: the WIRE spelling, which every daemon version
- *     already installed on a user's machine understands. A daemon that predates
- *     the rename cannot be taught a new spelling by the CLI that talks to it.
+ *   - to the local DAEMON binary: the WIRE spelling (`wireProvider`). It sits on
+ *     the old spelling from a rename's flip until its wire phase, because a daemon
+ *     that predates the rename cannot be taught a new spelling by the CLI that
+ *     talks to it, and is canonical otherwise.
  *
  * Every other harness name passes through unchanged — this normalises one
  * harness's spellings, it is not a general lower-caser, and silently rewriting a
@@ -48,9 +53,10 @@ function daemonHarnessArgument(value) {
 }
 /**
  * The `options` list for an oclif flag that enumerates harness names: the given
- * names with every spelling of the first-party harness in place of its canonical
- * one, so oclif's own validation accepts an alias instead of rejecting it before
- * the command ever runs.
+ * names with every ACCEPTED spelling of the first-party harness in place of its
+ * canonical one, so oclif's own validation accepts an alias instead of rejecting
+ * it before the command ever runs — and rejects a former spelling, which no
+ * ingress accepts.
  */
 function harnessFlagOptions(names) {
     return canonicalHarnessInputs(names).flatMap((name) => (0, auth_core_1.isFirstPartyHarnessProvider)(name) ? [...(0, auth_core_1.firstPartyHarnessSpellings)()] : [name]);

package/dist/lib/harness-tiers.d.ts

@@ -47,9 +47,10 @@ export declare const HARNESS_TIER_AUTHORITY = "daemon/src/harness-trust.ts";
 /**
  * The tier the shared table records for a harness, or `null` for an unknown name.
  *
- * Canonicalised first, so no spelling of the first-party harness can reach the
- * lookup as an unknown name — the shared table also carries every spelling, and
- * this keeps the answer right even for one written in a different case.
+ * Canonicalised first, so no accepted spelling of the first-party harness can reach
+ * the lookup as an unknown name — the shared table also carries every accepted
+ * spelling, and this keeps the answer right even for one written in a different
+ * case. A retired spelling is an unknown name here, as everywhere trust is decided.
  */
 export declare function mirroredTier(harness: string): HarnessTrustTier | null;
 export interface TierDescription {

package/dist/lib/harness-tiers.js

@@ -52,9 +52,10 @@ exports.HARNESS_TIER_AUTHORITY = 'daemon/src/harness-trust.ts';
 /**
  * The tier the shared table records for a harness, or `null` for an unknown name.
  *
- * Canonicalised first, so no spelling of the first-party harness can reach the
- * lookup as an unknown name — the shared table also carries every spelling, and
- * this keeps the answer right even for one written in a different case.
+ * Canonicalised first, so no accepted spelling of the first-party harness can reach
+ * the lookup as an unknown name — the shared table also carries every accepted
+ * spelling, and this keeps the answer right even for one written in a different
+ * case. A retired spelling is an unknown name here, as everywhere trust is decided.
  */
 function mirroredTier(harness) {
     const key = String((0, auth_core_1.canonicalHarnessProvider)(harness));

package/dist/lib/html-text.js

@@ -19,10 +19,35 @@ exports.htmlToDisplayText = htmlToDisplayText;
 function looksLikeHtml(value) {
     return /<\/?[a-z][^>]*>/i.test(value);
 }
+/** Pull one attribute out of a tag body — `src="…"`, `src='…'`, `src=…`. */
+function tagAttr(tag, name) {
+    const m = new RegExp(`${name}\\s*=\\s*(?:"([^"]*)"|'([^']*)'|([^\\s>]+))`, 'i').exec(tag);
+    return m ? (m[1] ?? m[2] ?? m[3] ?? '') : '';
+}
 function htmlToDisplayText(value) {
     if (!looksLikeHtml(value))
         return value;
     return (value
+        // A <video> is the same kind of meaning as an <img>, and the tag strip
+        // would erase it the same way, leaving a terminal reader no sign the
+        // description holds a recording at all. Markdown has no video syntax, so
+        // it becomes a labelled link to the stable reference. The element's
+        // children — `<source>` and fallback text — go with it; a `<source>` src
+        // is used when the element itself carries none (OSK-10129).
+        .replace(/<video\b([^>]*)>([\s\S]*?)<\/video\s*>|<video\b([^>]*)\/?>/gi, (_m, open, inner, bare) => {
+        const tag = String(open ?? bare ?? '');
+        const src = tagAttr(tag, 'src') || tagAttr(/<source\b[^>]*>/i.exec(inner ?? '')?.[0] ?? '', 'src');
+        const title = tagAttr(tag, 'title');
+        return src ? `[video: ${title || 'recording'}](${src})\n` : '';
+    })
+        // An <img> carries meaning — the asset reference or URL — that the
+        // generic tag strip below would erase entirely. Keep it as a markdown
+        // image so `task-asset:<id>` refs stay legible in a terminal (OSK-9856).
+        .replace(/<img\b[^>]*>/gi, (tag) => {
+        const src = tagAttr(tag, 'src');
+        const alt = tagAttr(tag, 'alt');
+        return src ? `![${alt || 'image'}](${src})` : '';
+    })
         .replace(/<br\s*\/?>/gi, '\n')
         .replace(/<\/(p|div|li|h[1-6])>/gi, '\n')
         .replace(/<li[^>]*>/gi, '  - ')