@skrr-ai/cli 0.1.50 → 0.1.52

package/dist/commands/balance/show.d.ts

@@ -1,5 +1,6 @@
 import type { TSkyCodeUsageSnapshot } from '@skrr-ai/data-provider';
 import { BaseCommand } from '../../base-command';
+import type { WorkspaceBalance } from '../../lib/balance';
 import { type RuntimeMonthlySpend } from '../../lib/harnesses';
 /**
  * The hosted-runtime monthly cap rows, as lines.
@@ -8,6 +9,32 @@ import { type RuntimeMonthlySpend } from '../../lib/harnesses';
  * the wording is part of the observable contract and is pinned directly.
  */
 export declare function renderRuntimeSpend(spend: RuntimeMonthlySpend[], log: (line: string) => void): void;
+/**
+ * The workspace the next session on this machine is billed to, and why that one.
+ *
+ * `selected`: `workspaces use` / `--workspace` / a daemon handoff put it in
+ * `OVERSKY_WORKSPACE_ID`. `default`: nothing is selected, so the session carries
+ * the caller's server-side default workspace — the same resolution `whoami` and
+ * `workspaces list` describe ("resolves to your default workspace").
+ */
+export interface SessionBillingTarget {
+    workspaceId: string;
+    name?: string;
+    source: 'selected' | 'default';
+}
+/**
+ * The account the NEXT session bills against, as lines — printed FIRST (OSK-12122).
+ *
+ * `skrr balance` opened on the personal account, so a user whose sessions bill
+ * the default workspace read `Credits: 999,503,672,326 ($999,503.67)` while every
+ * session was refused against that workspace's $0. The screen that exists to
+ * answer "why was I refused for credit" answered for the one account the
+ * refusal was not about, and nothing on it said which account that was.
+ *
+ * `balance` absent means the read failed: say so, never print a figure.
+ * Pure so the wording is pinned directly, like `renderRuntimeSpend`.
+ */
+export declare function renderSessionBillingAccount(target: SessionBillingTarget, balance: WorkspaceBalance | null, log: (line: string) => void, bin?: string): void;
 /**
  * Your plan's ceilings, as lines.
  *
@@ -66,6 +93,13 @@ export default class BalanceShow extends BaseCommand {
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
+    /**
+     * Which workspace the next session carries: the selected one, else the
+     * caller's default. Fail-open — an unreadable listing with nothing selected
+     * returns null and the screen falls back to the personal view it always had,
+     * rather than guessing an account.
+     */
+    private resolveSessionBillingTarget;
     /**
      * Your plan's ceilings, beside the balance they are spent before.
      *

package/dist/commands/balance/show.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderRuntimeSpend = renderRuntimeSpend;
+exports.renderSessionBillingAccount = renderSessionBillingAccount;
 exports.renderPlanCeilings = renderPlanCeilings;
 const core_1 = require("@oclif/core");
 const auth_core_1 = require("@skrr-ai/auth-core");
@@ -37,6 +38,45 @@ function renderRuntimeSpend(spend, log) {
         }
     }
 }
+/**
+ * The account the NEXT session bills against, as lines — printed FIRST (OSK-12122).
+ *
+ * `skrr balance` opened on the personal account, so a user whose sessions bill
+ * the default workspace read `Credits: 999,503,672,326 ($999,503.67)` while every
+ * session was refused against that workspace's $0. The screen that exists to
+ * answer "why was I refused for credit" answered for the one account the
+ * refusal was not about, and nothing on it said which account that was.
+ *
+ * `balance` absent means the read failed: say so, never print a figure.
+ * Pure so the wording is pinned directly, like `renderRuntimeSpend`.
+ */
+function renderSessionBillingAccount(target, balance, log, bin = 'skrr') {
+    const label = target.name ? `"${target.name}" (${target.workspaceId})` : target.workspaceId;
+    const why = target.source === 'selected'
+        ? 'the workspace selected for this CLI'
+        : 'no workspace is selected, so sessions resolve to your default workspace';
+    log(`Next session bills: workspace ${label}`);
+    log(`  (${why})`);
+    if (!balance) {
+        log(`  Balance:        unavailable (\`${bin} balance show --workspace ${target.workspaceId}\` to retry)`);
+        return;
+    }
+    if (!balance.exists) {
+        log('  No billing account yet — nothing has ever been funded or spent here.');
+        log('  WARNING: a managed session carrying this workspace cannot be funded; it will be refused.');
+    }
+    else {
+        for (const line of (0, balance_1.workspaceBalanceLines)(balance))
+            log(line);
+        if (balance.availableMicros <= 0) {
+            log('  WARNING: nothing available — managed sessions billed here are refused for credit, ' +
+                'whatever your personal balance below says.');
+        }
+    }
+    if (balance.availableMicros <= 0) {
+        log(`  Add credit to this workspace, or bill another one with \`${bin} workspaces use <workspace>\`.`);
+    }
+}
 /**
  * Your plan's ceilings, as lines.
  *
@@ -135,17 +175,42 @@ class BalanceShow extends base_command_1.BaseCommand {
         catch (err) {
             this.handleApiError(err);
         }
+        // OSK-12122 — the account the next session bills, resolved the way the
+        // session resolves it, read before anything is printed so it can go first.
+        const sessionTarget = await this.resolveSessionBillingTarget();
+        let sessionBalance = null;
+        if (sessionTarget) {
+            try {
+                sessionBalance = await (0, balance_1.getWorkspaceBalance)(sessionTarget.workspaceId);
+            }
+            catch {
+                sessionBalance = null;
+            }
+        }
         if (flags.json) {
-            this.log(JSON.stringify(balance, null, 2));
+            // Additive: the personal balance keeps its shape, and the account a
+            // session bills rides beside it (`null` when no workspace resolves).
+            this.log(JSON.stringify({
+                ...(balance ?? {}),
+                sessionBilling: sessionTarget
+                    ? { ...sessionTarget, balance: sessionBalance, balanceReadable: !!sessionBalance }
+                    : null,
+            }, null, 2));
             return;
         }
         if (!balance) {
             this.error('No balance record for this account.', { exit: 1 });
         }
+        if (sessionTarget) {
+            renderSessionBillingAccount(sessionTarget, sessionBalance, (line) => this.log(line), this.config.bin);
+            this.log('');
+        }
         // Name the account. "Hosted usage balance" alone reads as "the balance
         // that matters here", which is exactly the wrong reading for someone sent
         // by a workspace refusal.
-        this.log('Hosted usage balance — your personal account');
+        this.log(sessionTarget
+            ? 'Hosted usage balance — your personal account (not what the session above bills)'
+            : 'Hosted usage balance — your personal account');
         // Credits AND dollars, because a credit is a micro-dollar and nothing on
         // this surface said so. Four spend screens reported four units with no
         // stated relationship between them (OSK-4664).
@@ -235,6 +300,31 @@ class BalanceShow extends base_command_1.BaseCommand {
         this.log('`skrr balance show --workspace <id>`. `skrr payments wallet` is the');
         this.log('separate x402 crypto wallet, in USDC — not this balance.');
     }
+    /**
+     * Which workspace the next session carries: the selected one, else the
+     * caller's default. Fail-open — an unreadable listing with nothing selected
+     * returns null and the screen falls back to the personal view it always had,
+     * rather than guessing an account.
+     */
+    async resolveSessionBillingTarget() {
+        const selected = process.env.OVERSKY_WORKSPACE_ID?.trim();
+        let listing = null;
+        try {
+            listing = await (0, workspaces_1.listWorkspaceListing)();
+        }
+        catch {
+            listing = null;
+        }
+        const workspaceId = selected || listing?.defaultWorkspaceId || null;
+        if (!workspaceId)
+            return null;
+        const name = listing?.rows.find((row) => row.id === workspaceId)?.name;
+        return {
+            workspaceId,
+            ...(name ? { name } : {}),
+            source: selected ? 'selected' : 'default',
+        };
+    }
     /**
      * Your plan's ceilings, beside the balance they are spent before.
      *

package/dist/commands/commitments/doctor.d.ts

@@ -6,6 +6,7 @@ export declare function doctorVerdict(input: {
 }): {
     verdict: string;
     next: string;
+    why?: string;
 };
 export default class CommitmentsDoctor extends BaseCommand {
     static description: string;

package/dist/commands/commitments/doctor.js

@@ -15,8 +15,12 @@ function doctorVerdict(input) {
     if (operatingState.status === 'waiting_approval') {
         return { verdict: 'waiting_approval', next: 'Open the pending prepared action for review' };
     }
-    if (operatingState.coverage && operatingState.coverage.complete === false) {
-        return { verdict: 'degraded', next: 'Retry doctor; one or more operating-state projections are unavailable' };
+    if (operatingState.coverage &&
+        operatingState.coverage.complete === false) {
+        return {
+            verdict: 'degraded',
+            next: 'Retry doctor; one or more operating-state projections are unavailable',
+        };
     }
     const autonomy = operatingState.autonomy;
     const budget = autonomy?.budget;
@@ -30,9 +34,18 @@ function doctorVerdict(input) {
     }
     if (operatingState.status && commitment.status === 'active') {
         const status = String(operatingState.status);
+        const healthy = ['on_track', 'healthy'].includes(status);
+        // Where the latest cycle stopped, as the server words it. "Read the raw
+        // trace" was the only next step an unhealthy Commitment was ever given,
+        // even when the stop already named the fix (OSK-12120).
+        const latestCheck = operatingState.latestCheck;
+        const stop = latestCheck?.stop;
+        const fix = typeof stop?.fix === 'string' && stop.fix ? stop.fix : undefined;
+        const why = typeof stop?.detail === 'string' && stop.detail ? stop.detail : undefined;
         return {
-            verdict: ['on_track', 'healthy'].includes(status) ? 'active_healthy' : status,
-            next: 'skrr commitments trace <id> --limit 50',
+            verdict: healthy ? 'active_healthy' : status,
+            next: !healthy && fix ? fix : 'skrr commitments trace <id> --limit 50',
+            ...(!healthy && why ? { why } : {}),
         };
     }
     if (commitment.status !== 'active')
@@ -81,6 +94,8 @@ class CommitmentsDoctor extends base_command_1.BaseCommand {
             this.log(JSON.stringify(report, null, 2));
         else {
             this.log(`Verdict: ${diagnosis.verdict}`);
+            if (diagnosis.why)
+                this.log(`Why:     ${diagnosis.why}`);
             this.log(`Next:    ${diagnosis.next.replace('<id>', args.id)}`);
             const autonomy = operatingState.autonomy;
             if (autonomy) {

package/dist/commands/commitments/effective-policy.js

@@ -15,6 +15,9 @@ function effectivePolicyLines(policy) {
     const governance = policy.governance || {};
     const owner = policy.owner || {};
     const lines = [`Mode in force: ${(0, commitment_product_1.productModeLabel)(governance.effectiveAutonomyMode)}`];
+    // Whose permissions a run uses (OSK-11975), directly under the mode it can
+    // contradict — an Execute Commitment on a plan-mode Agent (OSK-12065).
+    lines.push(...(0, commitments_1.permissionLines)(policy.permissions));
     if (governance.blocked) {
         lines.push(`Workspace status: blocked${governance.blockedReason ? ` — ${governance.blockedReason}` : ''}`);
     }
@@ -56,7 +59,18 @@ function effectivePolicyLines(policy) {
     // part that is NOT enforced, because that is the one an operator granting
     // it has to see.
     const observation = policy.observation;
-    if (observation?.sensing) {
+    if (observation?.sensing && observation.retired) {
+        // OSK-11975 retired the sensing fence: printing "granted — read-only" for
+        // a grant that no longer fences anything is the claim this must not make.
+        const recorded = [
+            observation.shell?.granted ? 'shell' : null,
+            observation.browser?.granted ? 'browser' : null,
+        ].filter(Boolean);
+        lines.push(`Sensing runs: the Agent's own permissions${recorded.length
+            ? ` (recorded ${recorded.join(' and ')} grant is retired and has no effect)`
+            : ''}`);
+    }
+    else if (observation?.sensing) {
         lines.push(`Sensing shell: ${observation.shell?.granted
             ? 'granted — read-only filesystem on the Hosted Machine; network NOT fenced (a command can still change remote state); withheld on your own machine'
             : 'not granted'}`);

package/dist/commands/commitments/next-tick.js

@@ -75,7 +75,9 @@ function formatNextTick(projection) {
         `Posture:    ${decision.posture ?? '-'}`,
         `Health:     ${decision.health ?? '-'}`,
         `Risk:       ${decision.riskLevel ?? '-'}`,
-        `Confidence: ${decision.confidence ?? '-'}`,
+        // Two decimals: the arbiter's arithmetic yields values like
+        // 0.6000000000000001, which reads as a precision the number does not have.
+        `Confidence: ${typeof decision.confidence === 'number' ? decision.confidence.toFixed(2) : '-'}`,
     ];
     if (decision.whyNow)
         lines.push(`Why now:    ${decision.whyNow}`);
@@ -84,10 +86,18 @@ function formatNextTick(projection) {
     // dispatch-refusal loop can't hide behind an on_track projection.
     if (projection.health || projection.liveness) {
         const census = projection.liveness?.terminalDispositionCensus;
+        const plural = (count) => (count === 1 ? '' : 's');
         const detail = [
             projection.liveness?.diagnosisKind,
             census?.workFailures
-                ? `${census.workFailures} recent run failure${census.workFailures === 1 ? '' : 's'}`
+                ? `${census.workFailures} recent run failure${plural(census.workFailures)}`
+                : null,
+            // A run that never started is not a failure of the work (OSK-12137).
+            census?.machineFailures
+                ? `${census.machineFailures} run${plural(census.machineFailures)} never started`
+                : null,
+            census?.contractFailures
+                ? `${census.contractFailures} result${plural(census.contractFailures)} rejected`
                 : null,
         ]
             .filter(Boolean)

package/dist/commands/commitments/preflight.js

@@ -110,6 +110,16 @@ class CommitmentsPreflight extends base_command_1.BaseCommand {
             return;
         }
         this.log(`${args.id ? 'Preflight' : 'Pre-create preview (nothing persisted)'}: ${report.verdict === 'ready' ? 'Ready to run' : report.verdict === 'blocked' ? 'Run is blocked' : 'A capability or configuration check is still needed'}`);
+        // Whose permissions the run will use (OSK-11975), before the gates, so an
+        // Execute Commitment on a plan-mode Agent is the first thing read
+        // (OSK-12065).
+        for (const line of (0, commitments_1.permissionLines)(report.permissions))
+            this.log(line);
+        if (flags.verbose) {
+            const retired = (0, commitments_1.retiredFieldsLine)(report.execution?.retired, report.execution?.retiredReason);
+            if (retired)
+                this.log(retired);
+        }
         this.log('\nGates:');
         for (const gate of report.gates || []) {
             for (const line of preflightGateLines(gate, flags.verbose))

package/dist/commands/commitments/show.js

@@ -50,6 +50,11 @@ class CommitmentsShow extends base_command_1.BaseCommand {
             return;
         }
         (0, commitments_1.renderCommitmentSummary)(response.commitment, (line) => this.log(line), response.latestCheck);
+        // Whose permissions a run uses (OSK-11975) — read from the operating state,
+        // which carries the same projection preflight reports (OSK-12065).
+        const autonomy = response.operatingState?.autonomy;
+        for (const line of (0, commitments_1.permissionLines)(autonomy?.permissions))
+            this.log(line);
         // `show` is the first surface a person reaches after linking something, and
         // it used to render only watchedSources — a freshly linked goal or task was
         // invisible until you knew to run `links list` (OSK-10963).
@@ -101,8 +106,13 @@ class CommitmentsShow extends base_command_1.BaseCommand {
             this.log('');
             this.log(`Full history:  ${this.config.bin} commitments checks ${args.id}`);
         }
-        if (flags.verbose)
+        if (flags.verbose) {
             this.log(`Compatibility policy: ${JSON.stringify(response.commitment.policy)}`);
+            const runtime = autonomy?.runtime;
+            const retired = (0, commitments_1.retiredFieldsLine)(runtime?.retired, runtime?.retiredReason);
+            if (retired)
+                this.log(retired);
+        }
         const url = (0, web_url_1.commitmentUrlFrom)(this.cliConfig.baseURL, response.commitment);
         if (url)
             this.log(`URL: ${url}`);

package/dist/commands/context.js

@@ -4,6 +4,7 @@ const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../base-command");
 const config_1 = require("../lib/config");
+const cli_id_1 = require("../lib/cli-id");
 const keychain_1 = require("../lib/keychain");
 const cli_runtime_1 = require("../lib/cli-runtime");
 const runtime_context_1 = require("../lib/runtime-context");
@@ -48,7 +49,7 @@ class Context extends base_command_1.BaseCommand {
             profile: (0, keychain_1.getActiveProfile)(),
             config: {
                 path: (0, config_1.getConfigPath)(),
-                cliId: this.cliConfig.cliId ?? null,
+                cliId: (0, cli_id_1.resolveCliId)(this.cliConfig) ?? null,
             },
             auth: {
                 signedIn: Boolean(this.resolvedCredential?.token),

package/dist/commands/daemon/config.d.ts

@@ -0,0 +1,15 @@
+import { Command } from '@oclif/core';
+/**
+ * `skrr daemon config` — set this machine's daemon configuration, including
+ * each tool category's permission mode (OSK-12099). Before this the only way
+ * to set a category was to guess the separate `skrrd` binary exists; every
+ * other daemon verb was forwarded and this one was not.
+ */
+export default class DaemonConfig extends Command {
+    static aliases: string[];
+    static summary: string;
+    static description: string;
+    static strict: boolean;
+    static examples: string[];
+    run(): Promise<void>;
+}

package/dist/commands/daemon/config.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const exec_runtime_binary_1 = require("../../lib/exec-runtime-binary");
+const live_runtime_binary_1 = require("../../lib/live-runtime-binary");
+/**
+ * `skrr daemon config` — set this machine's daemon configuration, including
+ * each tool category's permission mode (OSK-12099). Before this the only way
+ * to set a category was to guess the separate `skrrd` binary exists; every
+ * other daemon verb was forwarded and this one was not.
+ */
+class DaemonConfig extends core_1.Command {
+    static aliases = ['daemons:config'];
+    static summary = "Set the local daemon's configuration, e.g. a tool category's permission mode";
+    static description = (0, exec_runtime_binary_1.forwardedFlagsNote)('config');
+    static strict = false; // forward all args verbatim — see run()
+    static examples = [
+        '<%= config.bin %> daemon config --mode bash=manual',
+        '<%= config.bin %> daemon config --mode bash=auto --mode browser=auto',
+        '<%= config.bin %> daemon config --require-approvals',
+    ];
+    async run() {
+        // `this.argv`, NOT `this.parse()`: oclif would reject every `skrrd config`
+        // flag this wrapper has not redeclared (OSK-296).
+        const argv = this.argv;
+        try {
+            // Config writes the file the LIVE daemon reloads, so it must be parsed by
+            // the live daemon's own binary — the same routing status uses (OSK-12102).
+            // Forwarding to the first `skrrd` on PATH let an older build accept
+            // `--auto-approve-bash banana` as false and reject `--mode`, then write
+            // the live daemon's config anyway (OSK-12099 verifier).
+            const pathBinary = (0, exec_runtime_binary_1.findRuntimeBinary)();
+            const decision = pathBinary
+                ? (0, live_runtime_binary_1.decideStatusBinary)(pathBinary, (0, live_runtime_binary_1.profileFromArgs)(argv), (0, live_runtime_binary_1.defaultLiveRuntimeDeps)())
+                : null;
+            const note = decision ? (0, live_runtime_binary_1.describeStatusBinary)(decision) : null;
+            if (note)
+                process.stderr.write(`${note}\n`);
+            const code = await (0, exec_runtime_binary_1.execRuntimeBinary)(['config', ...argv], {
+                binary: decision?.binary,
+            });
+            this.exit(code);
+        }
+        catch (err) {
+            if (err.message === 'runtime-binary-not-installed') {
+                this.log((0, exec_runtime_binary_1.notInstalledMessage)());
+                this.exit(127);
+            }
+            throw err;
+        }
+    }
+}
+exports.default = DaemonConfig;

package/dist/commands/daemon/index.js

@@ -47,6 +47,7 @@ class Daemon extends core_1.Command {
         this.log('  skrr daemon stop       — stop the daemon');
         this.log('  skrr daemon update     — update the daemon binary to the latest signed release');
         this.log('  skrr daemon status     — show running state and config');
+        this.log('  skrr daemon config     — set config, e.g. a tool category: --mode bash=manual');
         this.log('  skrr daemon logs       — tail recent daemon logs');
         this.log('  skrr daemon recover-offline-queue — restore recoverable offline WALs');
         this.log('  skrr daemon usage      — show local Claude Code and Codex usage limits');

package/dist/commands/daemon/status.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.readinessPointer = readinessPointer;
 const core_1 = require("@oclif/core");
 const exec_runtime_binary_1 = require("../../lib/exec-runtime-binary");
+const live_runtime_binary_1 = require("../../lib/live-runtime-binary");
 /**
  * The status report is the runtime's, and it describes the daemon: running,
  * connected, which credential. Whether the coding-agent CLIs on the machine can
@@ -41,7 +42,20 @@ class DaemonStatus extends core_1.Command {
         // mistake, one directory over.
         const argv = this.argv;
         try {
-            const code = await (0, exec_runtime_binary_1.execRuntimeBinary)(['status', ...argv]);
+            // Status describes the LIVE daemon, so render it with the live daemon's
+            // own binary when that is a different build from the first `skrrd` on
+            // PATH, and say which one rendered it either way (OSK-12102). The note
+            // goes to stderr so `--json` stays one document on stdout.
+            const pathBinary = (0, exec_runtime_binary_1.findRuntimeBinary)();
+            const decision = pathBinary
+                ? (0, live_runtime_binary_1.decideStatusBinary)(pathBinary, (0, live_runtime_binary_1.profileFromArgs)(argv), (0, live_runtime_binary_1.defaultLiveRuntimeDeps)())
+                : null;
+            const note = decision ? (0, live_runtime_binary_1.describeStatusBinary)(decision) : null;
+            if (note)
+                process.stderr.write(`${note}\n`);
+            const code = await (0, exec_runtime_binary_1.execRuntimeBinary)(['status', ...argv], {
+                binary: decision?.binary,
+            });
             const pointer = readinessPointer(argv, code);
             if (pointer)
                 this.log(pointer);

package/dist/commands/doctor.js

@@ -43,6 +43,7 @@ const auth_core_1 = require("@skrr-ai/auth-core");
 const base_command_1 = require("../base-command");
 const auth_storage_1 = require("../lib/auth-storage");
 const config_1 = require("../lib/config");
+const cli_id_1 = require("../lib/cli-id");
 const keychain_1 = require("../lib/keychain");
 const cli_runtime_1 = require("../lib/cli-runtime");
 const command_manifest_1 = require("../lib/command-manifest");
@@ -272,6 +273,9 @@ class Doctor extends base_command_1.BaseCommand {
                 ? ['auth_token_present_but_user_lookup_failed']
                 : []),
             ...(!checks.authToken ? ['not_signed_in_or_no_token_available'] : []),
+            ...(credential.ownerStatus === 'foreign'
+                ? ['stored_credential_belongs_to_another_skrr_config_run_skrr_login']
+                : []),
         ];
         const payload = {
             ok: issues.length === 0,
@@ -286,13 +290,16 @@ class Doctor extends base_command_1.BaseCommand {
             profile: (0, keychain_1.getActiveProfile)(),
             config: {
                 path: (0, config_1.getConfigPath)(),
-                cliId: this.cliConfig.cliId ?? null,
+                cliId: (0, cli_id_1.resolveCliId)(this.cliConfig) ?? null,
             },
             auth: {
                 signedIn: Boolean(account),
                 tokenSource: this.credentialSourceLabel(),
                 tokenKind: this.resolvedCredential?.kind ?? null,
                 refreshAvailable: Boolean(credential.bundle?.refreshToken),
+                // OSK-12135 — why a stored credential was not used, when it belongs to
+                // another skrr config on this machine. Null when there is nothing to say.
+                storedCredentialOwner: (0, auth_storage_1.describeForeignCredential)(credential),
                 accessExpiresAt: accessExpiresAt ? new Date(accessExpiresAt).toISOString() : null,
                 accessExpired: accessExpiresAt ? accessExpiresAt <= now : null,
                 refreshExpiresAt: refreshExpiresAt ? new Date(refreshExpiresAt).toISOString() : null,

package/dist/commands/harnesses/models.d.ts

@@ -1,4 +1,58 @@
 import { BaseCommand } from '../../base-command';
+/**
+ * Why the server fell back to its curated list — `sourceReason` on
+ * `GET /api/harnesses/:id/models`, present only when `source` is `curated`.
+ * The server owns the vocabulary (`MODEL_SOURCE_REASONS` in
+ * `api/server/services/Harness/engineModelCatalog.js`); a value this build
+ * does not recognise still prints, verbatim, rather than vanishing.
+ */
+export type HarnessModelSourceReason = 'no_live_catalog_for_harness' | 'daemon_offline' | 'live_catalog_unsupported' | 'live_probe_failed';
+export interface HarnessModelsReport {
+    provider?: string | null;
+    source?: string;
+    sourceReason?: HarnessModelSourceReason | string;
+    sourceDetail?: string;
+    /** The harness row's own stored default model; empty when unset. */
+    defaultModel?: string | null;
+    /** The harness row's own stored default effort; empty when unset. */
+    defaultReasoningEffort?: string | null;
+    models?: Array<{
+        value?: string;
+        label?: string;
+        description?: string;
+        efforts?: string[];
+        /** The effort this model starts at when none is chosen. */
+        defaultEffort?: string | null;
+        /** The harness's OWN recommendation (Codex `model/list`), not skrr's. */
+        isDefault?: boolean;
+    }>;
+}
+/**
+ * What `default` means on this harness, in lines under the table (OSK-12114).
+ *
+ * Three candidates can answer "which model runs on `default`": the harness
+ * row's stored default, the harness's own configuration on that machine (for
+ * Codex, `model` in its config.toml), and the vendor's recommendation that the
+ * live list marks. They win in that order, and the list alone cannot see the
+ * middle one — so say the order rather than imply the marked model runs.
+ */
+export declare function describeModelDefaults(report: HarnessModelsReport | undefined): string[];
+/**
+ * Stated under every curated answer: the list is ours, not the harness's
+ * admission rule. Without it `curated` reads as "these are the only choices"
+ * — the web card has always said this; the CLI never did.
+ */
+export declare const CURATED_ACCEPTS_ANY_ID = "Any model id the harness itself accepts works too, even if it is not listed \u2014 set it with `skrr agents update <agent> --model <id>`.";
+/**
+ * Why a curated answer is curated, as a clause. `codex · curated` used to
+ * print identically for an offline daemon, a daemon too old to probe, and a
+ * probe that timed out — three different next actions (OSK-12062).
+ */
+export declare function curatedReasonClause(report: HarnessModelsReport | undefined): string;
+/** One line saying where the list came from. */
+export declare function describeModelSource(report: HarnessModelsReport | undefined): string;
+/** What to print when the answer carries no models at all. */
+export declare function describeEmptyModels(report: HarnessModelsReport | undefined): string;
 /**
  * Which models this harness can actually run.
  *