@skrr-ai/cli 0.1.50 → 0.1.52

package/dist/commands/harnesses/models.js

@@ -1,9 +1,95 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.CURATED_ACCEPTS_ANY_ID = void 0;
+exports.describeModelDefaults = describeModelDefaults;
+exports.curatedReasonClause = curatedReasonClause;
+exports.describeModelSource = describeModelSource;
+exports.describeEmptyModels = describeEmptyModels;
 const core_1 = require("@oclif/core");
 const base_command_1 = require("../../base-command");
 const format_1 = require("../../lib/format");
 const harnesses_1 = require("../../lib/harnesses");
+/**
+ * What `default` means on this harness, in lines under the table (OSK-12114).
+ *
+ * Three candidates can answer "which model runs on `default`": the harness
+ * row's stored default, the harness's own configuration on that machine (for
+ * Codex, `model` in its config.toml), and the vendor's recommendation that the
+ * live list marks. They win in that order, and the list alone cannot see the
+ * middle one — so say the order rather than imply the marked model runs.
+ */
+function describeModelDefaults(report) {
+    const provider = report?.provider || 'the harness';
+    const lines = [];
+    const marked = (report?.models ?? []).find((m) => m.isDefault)?.value;
+    if (report?.defaultModel) {
+        lines.push(`Harness default: ${report.defaultModel} — what an agent on \`default\` runs on this harness.`);
+    }
+    else {
+        lines.push(`No harness default is set, so an agent on \`default\` runs the model the daemon's config ` +
+            `or ${provider}'s own config on that machine names` +
+            `${marked ? `, else ${marked} (* — ${provider}'s own recommendation)` : ''}.`);
+    }
+    if (report?.defaultReasoningEffort) {
+        lines.push(`Harness default effort: ${report.defaultReasoningEffort}.`);
+    }
+    lines.push('The model a turn actually ran is reported when it ends (`agents chat` prints `[run] model:`).');
+    return lines;
+}
+/**
+ * Stated under every curated answer: the list is ours, not the harness's
+ * admission rule. Without it `curated` reads as "these are the only choices"
+ * — the web card has always said this; the CLI never did.
+ */
+exports.CURATED_ACCEPTS_ANY_ID = 'Any model id the harness itself accepts works too, even if it is not listed — set it with `skrr agents update <agent> --model <id>`.';
+/**
+ * Why a curated answer is curated, as a clause. `codex · curated` used to
+ * print identically for an offline daemon, a daemon too old to probe, and a
+ * probe that timed out — three different next actions (OSK-12062).
+ */
+function curatedReasonClause(report) {
+    const provider = report?.provider || 'this harness';
+    const detail = report?.sourceDetail ? ` (${report.sourceDetail})` : '';
+    switch (report?.sourceReason) {
+        case 'no_live_catalog_for_harness':
+            return `${provider} has no way to list its own models, so this list is the catalog`;
+        case 'daemon_offline':
+            return `the machine running ${provider} is offline, so its live model list could not be read`;
+        case 'live_catalog_unsupported':
+            return `the daemon on that machine does not offer a live model list — update it to get one`;
+        case 'live_probe_failed':
+            return `asking ${provider} for its live model list failed${detail}`;
+        case undefined:
+        case '':
+            return 'the server did not say why the live list was not used';
+        default:
+            return `live list not used: ${report?.sourceReason}${detail}`;
+    }
+}
+/** One line saying where the list came from. */
+function describeModelSource(report) {
+    switch (report?.source) {
+        case 'managed':
+            return 'managed — the models your plan admits for this harness';
+        case 'live':
+            return `live — reported by the installed ${report.provider || 'harness'} on its machine`;
+        case 'curated':
+            return `curated — skrr's own list; ${curatedReasonClause(report)}`;
+        default:
+            return report?.source ?? 'unknown source';
+    }
+}
+/** What to print when the answer carries no models at all. */
+function describeEmptyModels(report) {
+    const resolved = report?.provider;
+    if (!resolved) {
+        return 'This harness resolved to no provider, so no model list could be built. That is a defect, not a configuration problem — report it with the harness id.';
+    }
+    // An empty answer is always curated: a live or managed answer with no models
+    // degrades to curated server-side. So the reason is what explains it — for
+    // opencode it is usually the live probe, which the old message never named.
+    return `No models are listed for ${resolved}: skrr's curated list has no entries for it, and ${curatedReasonClause(report)}. ${exports.CURATED_ACCEPTS_ANY_ID}`;
+}
 /**
  * Which models this harness can actually run.
  *
@@ -44,29 +130,36 @@ class HarnessesModels extends base_command_1.BaseCommand {
             // where the list comes from picks one — and, in the bug this replaced,
             // would have shown `provider` as null on a Claude harness and named the
             // defect on sight.
-            const resolved = report?.provider;
-            this.log(resolved
-                ? `No models are listed for ${resolved}. skrr keeps a curated list per provider and ${resolved} has no entries in it, so pick a model on the agent instead — \`skrr agents update <agent> --model <id>\` accepts an id this list does not name.`
-                : 'This harness resolved to no provider, so no model list could be built. That is a defect, not a configuration problem — report it with the harness id.');
+            this.log(describeEmptyModels(report));
             return;
         }
         if (report?.provider || report?.source) {
             // The source matters when the list is short: `curated` is our table,
-            // anything else came from the harness itself.
-            this.log(`${report.provider ?? 'unknown provider'} · ${report.source ?? 'unknown source'}`);
+            // anything else came from the harness itself — and a curated answer
+            // says why the harness's own list was not used.
+            this.log(`${report.provider ?? 'unknown provider'} · ${describeModelSource(report)}`);
+            if (report.source === 'curated')
+                this.log(exports.CURATED_ACCEPTS_ANY_ID);
             this.log('');
         }
         (0, format_1.renderTable)(models.map((m) => ({
-            model: (0, format_1.formatCell)(m.value),
+            // `*` is the harness's own recommendation, which the JSON carried as
+            // `isDefault` and this table dropped (OSK-12114).
+            model: `${(0, format_1.formatCell)(m.value)}${m.isDefault ? ' *' : ''}`,
             label: (0, format_1.formatCell)(m.label),
             // An empty efforts array means the model takes no effort setting at
             // all, which is different from one we failed to read.
             efforts: m.efforts && m.efforts.length > 0 ? m.efforts.join(', ') : '-',
+            defaultEffort: m.defaultEffort ? String(m.defaultEffort) : '-',
         })), [
             { key: 'model', header: 'MODEL' },
             { key: 'label', header: 'LABEL', maxWidth: 26 },
             { key: 'efforts', header: 'EFFORTS' },
+            { key: 'defaultEffort', header: 'DEFAULT EFFORT' },
         ], (line) => this.log(line));
+        this.log('');
+        for (const line of describeModelDefaults(report))
+            this.log(line);
     }
 }
 exports.default = HarnessesModels;

package/dist/commands/harnesses/show.d.ts

@@ -10,6 +10,17 @@ export default class HarnessesShow extends BaseCommand {
     };
     run(): Promise<void>;
 }
+/**
+ * Which permission modes this harness accepts, and its own default (OSK-12130).
+ *
+ * The rule used to surface only as an agent write refusing a mode, so the way
+ * to learn that Gemini runs only as bypassPermissions was three refusals in a
+ * row. Printed only when the server sent it (a local harness row).
+ */
+export declare function harnessPermissionLines(harness: {
+    permissionModes?: unknown;
+    defaultPermissionMode?: unknown;
+}): string[];
 /**
  * Say what the caller DID pass, not only what they did not.
  *

package/dist/commands/harnesses/show.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.harnessPermissionLines = harnessPermissionLines;
 exports.describeWrongHarnessRef = describeWrongHarnessRef;
 exports.resolveHarnessRef = resolveHarnessRef;
 exports.pickHarnessRef = pickHarnessRef;
@@ -113,6 +114,8 @@ class HarnessesShow extends base_command_1.BaseCommand {
         }
         if (harness.daemonId)
             this.log(`  daemon      ${harness.daemonId}`);
+        for (const line of harnessPermissionLines(harness))
+            this.log(line);
         if (verdict) {
             this.log(`  readiness   ${verdict.label} — ${verdict.detail}`);
         }
@@ -124,6 +127,38 @@ class HarnessesShow extends base_command_1.BaseCommand {
     }
 }
 exports.default = HarnessesShow;
+const PERMISSION_MODES_SOURCE_LABELS = {
+    daemon: 'reported by the daemon',
+    daemon_record: 'as the daemon last reported it',
+    static: "from skrr's harness table",
+    vocabulary: 'not declared for this harness; the daemon enforces',
+};
+/**
+ * Which permission modes this harness accepts, and its own default (OSK-12130).
+ *
+ * The rule used to surface only as an agent write refusing a mode, so the way
+ * to learn that Gemini runs only as bypassPermissions was three refusals in a
+ * row. Printed only when the server sent it (a local harness row).
+ */
+function harnessPermissionLines(harness) {
+    const report = harness.permissionModes;
+    const modes = Array.isArray(report?.modes)
+        ? report.modes.filter((m) => typeof m === 'string')
+        : [];
+    if (modes.length === 0)
+        return [];
+    const source = typeof report?.source === 'string'
+        ? (PERMISSION_MODES_SOURCE_LABELS[report.source] ?? report.source)
+        : '';
+    const stored = typeof harness.defaultPermissionMode === 'string' && harness.defaultPermissionMode
+        ? harness.defaultPermissionMode
+        : null;
+    return [
+        `  permission  accepts ${modes.join(', ')}${source ? `  (${source})` : ''}`,
+        `              default ${stored ??
+            "not set — an agent's own mode applies, else the daemon's config (`harnesses update --default-permission-mode`)"}`,
+    ];
+}
 /**
  * Say what the caller DID pass, not only what they did not.
  *

package/dist/commands/harnesses/update.d.ts

@@ -1,7 +1,8 @@
 import { BaseCommand } from '../../base-command';
 import { getHarness } from '../../lib/harnesses';
 /**
- * Rename an harness, or change how Claude Code runs on it.
+ * Rename a harness, change how Claude Code runs on it, or set the model,
+ * reasoning effort and permission mode its sessions default to.
  *
  * `--name` renames it FOR EVERYONE it is shared with. `skrr harnesses alias`
  * changes only what you see; the two are different operations and the server
@@ -21,9 +22,35 @@ export default class HarnessesUpdate extends BaseCommand {
         name: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         description: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'claude-engine': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'default-model': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'clear-default-model': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'default-effort': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'clear-default-effort': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'default-permission-mode': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'clear-default-permission-mode': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
 }
+export interface HarnessUpdateFlags {
+    name?: string;
+    description?: string;
+    'claude-engine'?: string;
+    'default-model'?: string;
+    'clear-default-model'?: boolean;
+    'default-effort'?: string;
+    'clear-default-effort'?: boolean;
+    'default-permission-mode'?: string;
+    'clear-default-permission-mode'?: boolean;
+}
+/**
+ * Flags → the `patch` of `PATCH /api/harnesses/:id`. The clear spellings are
+ * the server's own: an empty string clears `defaultModel` and
+ * `defaultReasoningEffort`, `null` clears `defaultPermissionMode`. Clearing is
+ * a separate boolean flag rather than a sentinel value because `none` is a
+ * real reasoning effort (GPT-5.x accepts it), so `--default-effort none` has
+ * to mean "set it to none", not "remove it".
+ */
+export declare function buildHarnessPatch(flags: HarnessUpdateFlags): Record<string, unknown>;
 /**
  * `--name` sets the name everyone sees. When YOUR alias covers it, you will not
  * see the new name anywhere you look, and "Updated <name>." read as though the

package/dist/commands/harnesses/update.js

@@ -1,12 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildHarnessPatch = buildHarnessPatch;
 exports.sharedRenameMessage = sharedRenameMessage;
 const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const harnesses_1 = require("../../lib/harnesses");
 const harness_labels_1 = require("../../lib/harness-labels");
 /**
- * Rename an harness, or change how Claude Code runs on it.
+ * Rename a harness, change how Claude Code runs on it, or set the model,
+ * reasoning effort and permission mode its sessions default to.
  *
  * `--name` renames it FOR EVERYONE it is shared with. `skrr harnesses alias`
  * changes only what you see; the two are different operations and the server
@@ -16,10 +19,13 @@ const harness_labels_1 = require("../../lib/harness-labels");
  * version first and a concurrent edit answers 409 instead of overwriting.
  */
 class HarnessesUpdate extends base_command_1.BaseCommand {
-    static description = 'Rename a harness or set how Claude Code is driven on it';
+    static description = 'Rename a harness, set how Claude Code is driven on it, or set its default model, effort, and permission mode';
     static examples = [
         '<%= config.bin %> harnesses update <harness-id> --name "Studio iMac"',
         '<%= config.bin %> harnesses update <harness-id> --claude-engine sdk',
+        '<%= config.bin %> harnesses update <harness-id> --default-model opus --default-effort high',
+        '<%= config.bin %> harnesses update <harness-id> --default-permission-mode acceptEdits',
+        '<%= config.bin %> harnesses update <harness-id> --clear-default-model --clear-default-effort',
     ];
     static args = {
         harness: core_1.Args.string({ ignoreStdin: true, description: 'Harness ID', required: true }),
@@ -34,19 +40,45 @@ class HarnessesUpdate extends base_command_1.BaseCommand {
             description: 'How Claude Code runs on this machine: `sdk` in-process (needed for AskUserQuestion), `cli` as a child process. Local CLAUDE harnesses only — the server refuses it on any other provider, because nothing would ever read it.',
             options: ['cli', 'sdk'],
         }),
+        'default-model': core_1.Flags.string({
+            description: "Model this harness's sessions use when the agent or task names none, in the harness's own " +
+                'namespace (`opus`, `gpt-5-codex`, …). `skrr harnesses models <harness-id>` lists what it can run. ' +
+                'Not allowlisted: any safe model identifier is stored as given, so check the spelling.',
+            exclusive: ['clear-default-model'],
+        }),
+        'clear-default-model': core_1.Flags.boolean({
+            description: "Remove the default model, so the harness's own default applies",
+            exclusive: ['default-model'],
+        }),
+        'default-effort': core_1.Flags.string({
+            description: "Reasoning effort this harness's sessions default to. Checked against the model the write leaves " +
+                'in place (the new --default-model when you pass both); `skrr harnesses models <harness-id>` lists ' +
+                'the efforts each model accepts. Harnesses with no effort setting refuse it.',
+            exclusive: ['clear-default-effort'],
+        }),
+        'clear-default-effort': core_1.Flags.boolean({
+            description: "Remove the default reasoning effort, so the harness's own default applies",
+            exclusive: ['default-effort'],
+        }),
+        'default-permission-mode': core_1.Flags.string({
+            description: "Permission mode this harness's sessions fall back to when the agent sets none. Local harnesses " +
+                'only. One-shot harnesses (gemini, opencode, cursor, copilot, goose, pi, openclaw) can only run as ' +
+                'bypassPermissions; any other mode is refused for them.',
+            options: [...data_provider_1.LOCAL_HARNESS_PERMISSION_MODES],
+            exclusive: ['clear-default-permission-mode'],
+        }),
+        'clear-default-permission-mode': core_1.Flags.boolean({
+            description: "Remove this harness's permission-mode override, so the daemon's own configured default applies",
+            exclusive: ['default-permission-mode'],
+        }),
     };
     async run() {
         this.requireAuth();
         const { args, flags } = await this.parse(HarnessesUpdate);
-        const patch = {};
-        if (flags.name !== undefined)
-            patch.name = flags.name;
-        if (flags.description !== undefined)
-            patch.description = flags.description;
-        if (flags['claude-engine'] !== undefined)
-            patch.claudeEngine = flags['claude-engine'];
+        const patch = buildHarnessPatch(flags);
         if (Object.keys(patch).length === 0) {
-            this.error('Nothing to change. Pass --name, --description, or --claude-engine.', { exit: 1 });
+            this.error('Nothing to change. Pass --name, --description, --claude-engine, --default-model, ' +
+                '--default-effort, --default-permission-mode, or a --clear-default-* flag.', { exit: 1 });
             return;
         }
         try {
@@ -65,6 +97,37 @@ class HarnessesUpdate extends base_command_1.BaseCommand {
     }
 }
 exports.default = HarnessesUpdate;
+/**
+ * Flags → the `patch` of `PATCH /api/harnesses/:id`. The clear spellings are
+ * the server's own: an empty string clears `defaultModel` and
+ * `defaultReasoningEffort`, `null` clears `defaultPermissionMode`. Clearing is
+ * a separate boolean flag rather than a sentinel value because `none` is a
+ * real reasoning effort (GPT-5.x accepts it), so `--default-effort none` has
+ * to mean "set it to none", not "remove it".
+ */
+function buildHarnessPatch(flags) {
+    const patch = {};
+    if (flags.name !== undefined)
+        patch.name = flags.name;
+    if (flags.description !== undefined)
+        patch.description = flags.description;
+    if (flags['claude-engine'] !== undefined)
+        patch.claudeEngine = flags['claude-engine'];
+    if (flags['default-model'] !== undefined)
+        patch.defaultModel = flags['default-model'];
+    if (flags['clear-default-model'])
+        patch.defaultModel = '';
+    if (flags['default-effort'] !== undefined)
+        patch.defaultReasoningEffort = flags['default-effort'];
+    if (flags['clear-default-effort'])
+        patch.defaultReasoningEffort = '';
+    if (flags['default-permission-mode'] !== undefined) {
+        patch.defaultPermissionMode = flags['default-permission-mode'];
+    }
+    if (flags['clear-default-permission-mode'])
+        patch.defaultPermissionMode = null;
+    return patch;
+}
 /**
  * `--name` sets the name everyone sees. When YOUR alias covers it, you will not
  * see the new name anywhere you look, and "Updated <name>." read as though the

package/dist/commands/login.d.ts

@@ -44,7 +44,8 @@ export default class Login extends BaseCommand {
      *
      * `cliId` resolution priority:
      *   1. `OVERSKY_CLI_ID` env var — explicit, wins over everything.
-     *   2. `cliConfig.cliId` — set by a prior `skrr login` on this machine.
+     *   2. `resolveCliId(cliConfig)` — the id a prior `skrr login` of this
+     *      profile presents (its own, or the machine's).
      *      Honored so a same-machine restore "just works" without forcing
      *      the operator to re-export the cliId.
      *   3. error — without a cliId the refresh row binding can't be matched

package/dist/commands/login.js

@@ -7,6 +7,7 @@ const base_command_1 = require("../base-command");
 const daemonHandoff_1 = require("../lib/daemonHandoff");
 const daemon_setup_1 = require("../lib/daemon-setup");
 const config_1 = require("../lib/config");
+const cli_id_1 = require("../lib/cli-id");
 const keychain_1 = require("../lib/keychain");
 const login_1 = require("../lib/login");
 const device_code_1 = require("../lib/device-code");
@@ -40,16 +41,33 @@ const prompt_1 = require("../lib/prompt");
  * `cliLoginWithRefreshToken` for the full rationale.
  */
 class Login extends base_command_1.BaseCommand {
-    static description = 'Sign in to a skrr instance (PKCE localhost callback; device-code fallback). ' +
-        'On an interactive first login on a computer without the skrr background service, skrr ' +
-        'offers to install it. Choose no, or set SKRR_SKIP_DAEMON_HANDOFF=1 before running this ' +
-        'command, to skip that optional setup.';
+    // OSK-12152 — the help used to describe only the browser flow. `skrr login`
+    // asks the local daemon FIRST, and nothing said so; nor that what it stores
+    // differs from what plain commands borrow from the daemon on their own.
+    static description = 'Sign in to a skrr instance and store a durable session for this profile.\n\n' +
+        'It tries, in order:\n' +
+        '  1. the skrr background service on this computer, when one is running and signed in to the ' +
+        'same server — it mints this profile a CLI session with no browser;\n' +
+        '  2. a browser sign-in through a localhost callback (PKCE);\n' +
+        '  3. a device code — under SSH, with --device-code, or when the callback cannot run.\n' +
+        'If the background service answers but refuses, skrr says why before moving on.\n\n' +
+        'What it stores: a refresh session in this profile’s credential store (the macOS Keychain, ' +
+        'or ~/.skrr/cli-auth.json elsewhere) that keeps renewing itself. Plain skrr commands on a ' +
+        'computer whose background service is signed in need no login at all: they borrow a ' +
+        'short-lived token from it for each run and store nothing (an older background service ' +
+        'mints them a stored session instead). On a Dedicated Runtime, where the service only ' +
+        'lends short-lived tokens, nothing is stored.\n\n' +
+        'Set OVERSKY_SKIP_DAEMON_BROKER=1 to skip step 1 (--device-code skips it too). After signing ' +
+        'in, skrr also signs the background service in, and on an interactive first login on a ' +
+        'computer without it, offers to install it. Set SKRR_SKIP_DAEMON_HANDOFF=1 to skip that ' +
+        'optional setup; it does not skip step 1.';
     static examples = [
         '<%= config.bin %> login',
         '<%= config.bin %> login --env prod',
         '<%= config.bin %> login --base-url https://skrr.ai',
         '<%= config.bin %> login --server http://localhost:3090',
         '<%= config.bin %> login --device-code',
+        'OVERSKY_SKIP_DAEMON_BROKER=1 <%= config.bin %> login',
         '<%= config.bin %> login --port 1455',
         '<%= config.bin %> login --recovery-code "W7K2J-X9P3M-R6Y4Q-..."',
         'OVERSKY_REFRESH_TOKEN=... OVERSKY_CLI_ID=... <%= config.bin %> login',
@@ -244,7 +262,8 @@ class Login extends base_command_1.BaseCommand {
      *
      * `cliId` resolution priority:
      *   1. `OVERSKY_CLI_ID` env var — explicit, wins over everything.
-     *   2. `cliConfig.cliId` — set by a prior `skrr login` on this machine.
+     *   2. `resolveCliId(cliConfig)` — the id a prior `skrr login` of this
+     *      profile presents (its own, or the machine's).
      *      Honored so a same-machine restore "just works" without forcing
      *      the operator to re-export the cliId.
      *   3. error — without a cliId the refresh row binding can't be matched
@@ -252,8 +271,8 @@ class Login extends base_command_1.BaseCommand {
      *      pointing at `skrr whoami` on the original box.
      */
     async runRefreshTokenLogin(refreshToken) {
-        const envCliId = process.env.OVERSKY_CLI_ID;
-        const cliId = typeof envCliId === 'string' && envCliId.length > 0 ? envCliId : this.cliConfig.cliId;
+        // `resolveCliId` already puts OVERSKY_CLI_ID / SKRR_CLI_ID first.
+        const cliId = (0, cli_id_1.resolveCliId)(this.cliConfig);
         if (!cliId) {
             this.error('OVERSKY_REFRESH_TOKEN is set but no cliId is available. The refresh\n' +
                 'row is bound to the cliId it was issued for; without it the server\n' +

package/dist/commands/logout.js

@@ -244,6 +244,9 @@ class Logout extends base_command_1.BaseCommand {
         (0, config_1.saveConfig)({
             baseURL: cfg.baseURL,
             ...(cfg.cliId ? { cliId: cfg.cliId } : {}),
+            // A named profile's own identity outlives a session exactly as the
+            // machine's does, so its next login re-presents it (OSK-12156).
+            ...(cfg.profileCliId ? { profileCliId: cfg.profileCliId } : {}),
             ...(agentSetting.value ? { [first_party_harness_managed_1.AGENT_CONFIG_KEY]: agentSetting.value } : {}),
             ...(cfg.credentials ? { credentials: cfg.credentials } : {}),
             migrated: { ...(cfg.migrated ?? {}), authOutOfConfig: true },

package/dist/commands/machines/dedicated/show.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
 const dedicated_lease_command_1 = require("../../../lib/dedicated-lease-command");
+const daemon_installer_1 = require("../../../lib/daemon-installer");
 const dedicated_machines_1 = require("../../../lib/dedicated-machines");
 const harnesses_1 = require("../../../lib/harnesses");
 class DedicatedMachinesShow extends dedicated_lease_command_1.DedicatedLeaseCommand {
@@ -40,6 +41,12 @@ class DedicatedMachinesShow extends dedicated_lease_command_1.DedicatedLeaseComm
         catch {
             harnesses = [];
         }
+        // The latest daemon RELEASE, from the same signed feed a daemon updates
+        // from. The lease says which daemon the approved image carries; only this
+        // says whether a newer release exists that no approved image carries yet —
+        // which is what `skrrd update --check` on the machine reports (OSK-12153).
+        // Best-effort: an unreachable feed is said, never read as "none newer".
+        const latestDaemonRelease = lease.health?.image ? await readLatestDaemonRelease() : null;
         if (flags.json) {
             const engines = (0, dedicated_machines_1.dedicatedLeaseHarnesses)(lease, harnesses).map((harness) => ({
                 harnessId: harness._id,
@@ -47,11 +54,27 @@ class DedicatedMachinesShow extends dedicated_lease_command_1.DedicatedLeaseComm
                 status: harness.status,
                 lastSeenAt: harness.lastSeenAt,
             }));
-            this.log(JSON.stringify({ ...response, harnesses: engines }, null, 2));
+            this.log(JSON.stringify({
+                ...response,
+                harnesses: engines,
+                ...(latestDaemonRelease ? { latestDaemonRelease } : {}),
+            }, null, 2));
             return;
         }
-        for (const line of (0, dedicated_machines_1.describeDedicatedLease)(lease, harnesses))
+        for (const line of (0, dedicated_machines_1.describeDedicatedLease)(lease, harnesses, { latestDaemonRelease })) {
             this.log(line);
+        }
     }
 }
 exports.default = DedicatedMachinesShow;
+async function readLatestDaemonRelease() {
+    try {
+        const result = await (0, daemon_installer_1.fetchVerifiedDaemonManifest)();
+        if (result.ok)
+            return { version: result.manifest.version };
+        return { error: result.code };
+    }
+    catch (err) {
+        return { error: err?.message || 'unreadable' };
+    }
+}

package/dist/commands/outbox/list.d.ts

@@ -1,6 +1,17 @@
 import { BaseCommand } from '../../base-command';
+import { type OutboxEntry } from '../../lib/outbox';
+/**
+ * Why one entry was queued, in words (OSK-12121). The queue holds more than
+ * outage casualties — a 401 is queued too, so authored content survives a lapsed
+ * sign-in — and a list that described every entry as "the API was unavailable"
+ * sent a signed-out reader to wait for an outage that was not happening.
+ */
+export declare function queuedBecause(entry: Pick<OutboxEntry, 'reason'>): {
+    label: string;
+    kind: 'auth' | 'throttled' | 'unavailable' | 'other';
+};
 export declare function outboxListSnapshot(profile?: string): {
-    queued: import("../../lib/outbox").OutboxEntry[];
+    queued: OutboxEntry[];
     incident: import("../../lib/outbox").IncidentState | null;
     incidentActive: boolean;
 };

package/dist/commands/outbox/list.js

@@ -1,11 +1,29 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.queuedBecause = queuedBecause;
 exports.outboxListSnapshot = outboxListSnapshot;
 const core_1 = require("@oclif/core");
 const base_command_1 = require("../../base-command");
 const keychain_1 = require("../../lib/keychain");
 const format_1 = require("../../lib/format");
 const outbox_1 = require("../../lib/outbox");
+/**
+ * Why one entry was queued, in words (OSK-12121). The queue holds more than
+ * outage casualties — a 401 is queued too, so authored content survives a lapsed
+ * sign-in — and a list that described every entry as "the API was unavailable"
+ * sent a signed-out reader to wait for an outage that was not happening.
+ */
+function queuedBecause(entry) {
+    const status = entry.reason?.status;
+    if (status === 401)
+        return { label: 'sign-in refused (401)', kind: 'auth' };
+    if (status === 429)
+        return { label: 'throttled (429)', kind: 'throttled' };
+    if ((typeof status === 'number' && status >= 500) || (0, outbox_1.isOutageFailure)(entry.reason)) {
+        return { label: status ? `unavailable (${status})` : 'unreachable', kind: 'unavailable' };
+    }
+    return { label: status ? `HTTP ${status}` : 'unknown', kind: 'other' };
+}
 function outboxListSnapshot(profile) {
     const queued = (0, outbox_1.listWrites)(profile);
     const incident = (0, outbox_1.readIncident)(profile);
@@ -24,7 +42,7 @@ function outboxListSnapshot(profile) {
  * where they find out.
  */
 class OutboxList extends base_command_1.BaseCommand {
-    static description = 'Show writes queued locally because the API was unavailable';
+    static description = 'Show writes queued locally because the server could not take them: an outage, throttling, or a lapsed sign-in';
     static examples = [
         '<%= config.bin %> outbox list',
         '<%= config.bin %> outbox list --json',
@@ -46,7 +64,9 @@ class OutboxList extends base_command_1.BaseCommand {
                 `${incident.consecutive} consecutive failure(s).`);
             this.log('');
         }
-        else if (incident) {
+        else if (incident && entries.some((e) => queuedBecause(e).kind === 'unavailable')) {
+            // A past incident is context only for entries an outage put here. Beside
+            // a queue of sign-in refusals it reads as the explanation, and is not.
             this.log(`Last service incident: ${incident.baseURL} failed at ${incident.lastOutageAt}` +
                 `${incident.status ? ` (HTTP ${incident.status})` : ''}. ` +
                 'No current outage is confirmed.');
@@ -61,6 +81,7 @@ class OutboxList extends base_command_1.BaseCommand {
             queued: e.queuedAt,
             command: e.command,
             summary: e.summary,
+            why: queuedBecause(e).label,
             // Surface the attempt count only once it matters; a column of "0"s is
             // noise, but an entry nearing the cap needs a human.
             attempts: e.attempts > 0 ? `${e.attempts}/${outbox_1.MAX_REPLAY_ATTEMPTS}` : '-',
@@ -69,6 +90,7 @@ class OutboxList extends base_command_1.BaseCommand {
             { key: 'queued', header: 'QUEUED', maxWidth: 24 },
             { key: 'command', header: 'COMMAND', maxWidth: 24 },
             { key: 'summary', header: 'SUMMARY', maxWidth: 40 },
+            { key: 'why', header: 'WHY', maxWidth: 24 },
             { key: 'attempts', header: 'TRIES' },
         ], (line) => this.log(line));
         const exhausted = entries.filter((e) => e.attempts >= outbox_1.MAX_REPLAY_ATTEMPTS);
@@ -77,6 +99,13 @@ class OutboxList extends base_command_1.BaseCommand {
             this.log(`${exhausted.length} entry(ies) hit the ${outbox_1.MAX_REPLAY_ATTEMPTS}-attempt cap and will not be ` +
                 'retried automatically. Inspect the failure, then retry or drop them explicitly.');
         }
+        const authQueued = entries.filter((e) => queuedBecause(e).kind === 'auth').length;
+        if (authQueued > 0) {
+            this.log('');
+            this.log(`${authQueued} entry(ies) were queued because the server refused this sign-in, not because ` +
+                `it was down. Sign in with \`${this.config.bin} login\` first; a replay before that is ` +
+                'refused the same way.');
+        }
         this.log('');
         this.log(`Replay:  ${this.config.bin} outbox retry`);
         this.log(`Discard: ${this.config.bin} outbox drop <id>`);

package/dist/commands/revoke-daemon.js

@@ -67,6 +67,8 @@ class RevokeDaemon extends base_command_1.BaseCommand {
             const host = resolvedDaemon?.machineUuid
                 ? resolvedDaemon.machineUuid.slice(0, 12)
                 : (resolvedDaemon?.os ?? 'unknown host');
+            this.log('Revoking a daemon also revokes every CLI sign-in it brokered — on its machine, ' +
+                `\`${this.config.bin} login\` without a browser signs in through the daemon.`);
             const confirmed = await this.confirm(`Revoke daemon "${name}" on ${host}? [y/N] `);
             if (!confirmed) {
                 this.log('Aborted.');
@@ -99,6 +101,13 @@ class RevokeDaemon extends base_command_1.BaseCommand {
         const daemonId = (res.daemon?.id ?? resolvedId).slice(0, 12);
         if (res.revoked) {
             this.log(`Revoked daemon ${daemonName} (${daemonId}).`);
+            if (res.callerSessionRevoked === true) {
+                // Said now, not discovered later as a refresh failure: the sign-in this
+                // command used was brokered by that daemon and died with it.
+                this.warn(`This also signed out ${this.config.bin} on this machine: its sign-in was brokered ` +
+                    `by that daemon and was revoked with it. Run \`${this.config.bin} daemon login\` to ` +
+                    `re-enroll the daemon, then \`${this.config.bin} login\` to sign the CLI in again.`);
+            }
             // exit 0 (default)
         }
         else if (res.alreadyRevoked) {