@skrr-ai/cli 0.1.8 → 0.1.10

package/dist/base-command.d.ts

@@ -1,4 +1,5 @@
 import { Command, Flags, type Interfaces } from '@oclif/core';
+export { resolveProfileFromArgv } from './lib/keychain';
 import { type AssigneeResolution, type MemberKind, type SpaceMember } from './lib/assignee-resolver';
 import { type CliConfig } from './lib/config';
 import { type OutboxMethod } from './lib/outbox';
@@ -56,6 +57,7 @@ export declare abstract class BaseCommand extends Command {
         bare: Interfaces.BooleanFlag<boolean>;
         token: Interfaces.OptionFlag<string | undefined, Interfaces.CustomOptions>;
         workspace: Interfaces.OptionFlag<string | undefined, Interfaces.CustomOptions>;
+        profile: Interfaces.OptionFlag<string | undefined, Interfaces.CustomOptions>;
     };
     protected cliConfig: CliConfig;
     /**
@@ -393,5 +395,30 @@ export declare function describeAssigneeNotInSpace(serverMessage: string | undef
  *
  * Exported for tests.
  */
+/**
+ * What a 403 means, given whether the server said anything.
+ *
+ * Exported and pure so the wording is testable without an oclif runtime — the
+ * convention `isRetryableFailure` follows below.
+ *
+ * A 403 WITH a body is the API deciding, and it says why; we relay it. A 403
+ * with NO body did not come from the API — every application 403 in this
+ * codebase carries a message — so it is the edge refusing the request before it
+ * arrived, and the two must not share a sentence.
+ *
+ * This used to assert "your account does not have access to this resource" for
+ * both. For an edge refusal that names a cause this process never observed, and
+ * it is the expensive kind of wrong: it sends the user to audit their
+ * membership, their role and their token, which is the one place the problem is
+ * not. Dogfooded as OSK-263 — `skrr tasks create` refused a task description
+ * containing a dotted AWS-credentials path, in a project the same session had
+ * created a minute earlier, as an ADMIN who owned the space, and finding the
+ * real cause took a line-by-line bisect of the description body.
+ *
+ * The 404 branch has always done the honest thing (`bodyMessage || 'Not
+ * found.'`, which claims nothing); this brings 403 into line and adds the one
+ * lead worth having.
+ */
+export declare function describeForbidden(bodyMessage?: string | null): string;
 export declare function isRetryableFailure(status: number | undefined, body: Record<string, unknown> | null): boolean;
 export { Flags };

package/dist/base-command.js

@@ -1,14 +1,21 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Flags = exports.BaseCommand = void 0;
+exports.Flags = exports.BaseCommand = exports.resolveProfileFromArgv = void 0;
 exports.assigneePayloadNeedsResolution = assigneePayloadNeedsResolution;
 exports.parseGlobalFlags = parseGlobalFlags;
 exports.withSubject = withSubject;
 exports.describeHarnessUnavailable = describeHarnessUnavailable;
 exports.describeAssigneeNotInSpace = describeAssigneeNotInSpace;
+exports.describeForbidden = describeForbidden;
 exports.isRetryableFailure = isRetryableFailure;
 const core_1 = require("@oclif/core");
 Object.defineProperty(exports, "Flags", { enumerable: true, get: function () { return core_1.Flags; } });
+// Re-exported from its home in `lib/keychain`, beside the other profile
+// functions. It lived here while `init()` was its only caller; a lib module
+// needing it would otherwise have to import the command base class, and with
+// it the whole auth stack, to read two strings out of argv.
+var keychain_1 = require("./lib/keychain");
+Object.defineProperty(exports, "resolveProfileFromArgv", { enumerable: true, get: function () { return keychain_1.resolveProfileFromArgv; } });
 const data_provider_1 = require("@skrr-ai/data-provider");
 const auth_core_1 = require("@skrr-ai/auth-core");
 const assignee_resolver_1 = require("./lib/assignee-resolver");
@@ -16,7 +23,7 @@ const task_ref_resolver_1 = require("./lib/task-ref-resolver");
 const space_resolver_1 = require("./lib/space-resolver");
 const projects_1 = require("./lib/projects");
 const config_1 = require("./lib/config");
-const keychain_1 = require("./lib/keychain");
+const keychain_2 = require("./lib/keychain");
 const outbox_1 = require("./lib/outbox");
 const node_adapter_1 = require("./lib/node-adapter");
 const migrate_1 = require("./lib/migrate");
@@ -96,6 +103,10 @@ class BaseCommand extends core_1.Command {
         workspace: core_1.Flags.string({
             description: 'Workspace ID for workspace-scoped requests (also sets X-Workspace-Id).',
         }),
+        profile: core_1.Flags.string({
+            description: 'Which stored session to use. Each profile keeps its own credential and deployment, ' +
+                'so signing into one does not sign you out of another. Also OVERSKY_PROFILE.',
+        }),
     };
     cliConfig;
     /**
@@ -108,6 +119,19 @@ class BaseCommand extends core_1.Command {
     bareMode = false;
     async init() {
         await super.init();
+        // The profile is resolved from raw argv, BEFORE oclif parses anything.
+        //
+        // It has to be. `parseBaseFlags()` runs far below, after migration and
+        // after the credential machinery has already read the keychain — and the
+        // profile decides WHICH keychain service and WHICH config file all of that
+        // touches. Waiting for the parser would mean choosing a profile after
+        // having already read the wrong one's credential.
+        //
+        // The daemon has the same constraint and solves it with commander's
+        // `preAction` hook; oclif has no equivalent that beats `init()`, so this
+        // scans argv itself. The flag is still declared in `baseFlags` above, which
+        // is what puts it in `--help` and keeps oclif from rejecting it.
+        (0, keychain_2.setActiveProfile)((0, keychain_2.resolveProfileFromArgv)(this.argv) ?? process.env.OVERSKY_PROFILE ?? '');
         // A daemon-stamped autonomous process is a separate principal, not a
         // convenient place to inherit the user's CLI login. Resolve this before
         // touching migration, Keychain/file auth, refresh, or daemon auto-broker
@@ -119,7 +143,7 @@ class BaseCommand extends core_1.Command {
                 const delegatedCredential = await (0, delegated_cli_1.fetchDelegatedCliCredential)();
                 if (!delegatedCredential) {
                     this.failWithCliError({
-                        message: 'Daemon delegated Sky credential is unavailable.',
+                        message: 'Daemon delegated skrr credential is unavailable.',
                         code: 'DELEGATED_CLI_CREDENTIAL_UNAVAILABLE',
                         exit: 75,
                         retryable: true,
@@ -130,7 +154,7 @@ class BaseCommand extends core_1.Command {
             }
             catch (err) {
                 this.failWithCliError({
-                    message: `Daemon delegated Sky credential is unavailable: ${err.message}`,
+                    message: `Daemon delegated skrr credential is unavailable: ${err.message}`,
                     code: 'DELEGATED_CLI_CREDENTIAL_UNAVAILABLE',
                     exit: 75,
                     retryable: true,
@@ -269,7 +293,7 @@ class BaseCommand extends core_1.Command {
                     // The user is about to see "Not signed in" — give them the
                     // exact fix. One stderr line so it doesn't pollute --json
                     // consumers on stdout.
-                    process.stderr.write(`[sky] Local oversky daemon is logged in to ${autoResult.outcome.daemonServerUrl}, ` +
+                    process.stderr.write(`[skrr] Local skrr runtime is logged in to ${autoResult.outcome.daemonServerUrl}, ` +
                         `but skrr is configured for ${this.cliConfig.baseURL}. ` +
                         `Run \`skrr login --base-url ${autoResult.outcome.daemonServerUrl}\` to use the daemon.\n`);
                 }
@@ -277,12 +301,12 @@ class BaseCommand extends core_1.Command {
         }
         if (!this.resolvedCredential.token && ignoredStoredCredential) {
             if (ignoredStoredCredential.originStatus === 'mismatch') {
-                process.stderr.write(`[sky] Ignoring stored credentials issued by ${ignoredStoredCredential.storedServerOrigin}; ` +
+                process.stderr.write(`[skrr] Ignoring stored credentials issued by ${ignoredStoredCredential.storedServerOrigin}; ` +
                     `skrr is configured for ${this.cliConfig.baseURL}. Run \`skrr login --base-url ${this.cliConfig.baseURL}\` ` +
                     `or switch back to the issuing server.\n`);
             }
             else if (ignoredStoredCredential.originStatus === 'unbound') {
-                process.stderr.write(`[sky] Ignoring legacy credentials that are not bound to a server. ` +
+                process.stderr.write(`[skrr] Ignoring legacy credentials that are not bound to a server. ` +
                     `Run \`skrr login --base-url ${this.cliConfig.baseURL}\` once to bind a fresh session.\n`);
             }
         }
@@ -809,7 +833,7 @@ class BaseCommand extends core_1.Command {
                 this.failWithCliError({
                     message: say(presentedCiToken
                         ? `Authentication failed: this is an \`osk_ci_*\` token, which only bootstraps a ` +
-                            `daemon (\`OVERSKY_TOKEN=<token> oversky start\`). ${this.config.bin} commands do ` +
+                            `daemon (\`OVERSKY_TOKEN=<token> skrrd start\`). ${this.config.bin} commands do ` +
                             `not accept it — sign in with \`${this.config.bin} login\` instead.`
                         : `Authentication failed. Run \`${this.config.bin} login\` to sign in again.`),
                     code: bodyCode || 'AUTHENTICATION_FAILED',
@@ -819,8 +843,24 @@ class BaseCommand extends core_1.Command {
                 });
             }
             else if (e.status === 403) {
+                // A 403 WITH a body is the API deciding; it says why, and we relay it.
+                //
+                // A 403 with NO body did not come from the API — every application 403
+                // here carries a message — so it is the edge refusing the request before
+                // it arrived. Asserting "your account does not have access" for that case
+                // is a cause this process never observed, and it is the expensive kind of
+                // wrong: it sends the user to audit their membership, their role and
+                // their token, which is the one place the problem is not.
+                //
+                // Dogfooded (OSK-263): `skrr tasks create` refused a task description
+                // containing a dotted AWS-credentials path, in a project the same
+                // session had created a minute earlier, as an ADMIN who owned the space.
+                // Finding it took a line-by-line bisect of the body, because the message
+                // named a cause and the cause was fiction. The 404 branch below has
+                // always done the honest thing — `bodyMessage || 'Not found.'`, which
+                // claims nothing.
                 this.failWithCliError({
-                    message: say(bodyMessage || 'Forbidden: your account does not have access to this resource.'),
+                    message: say(describeForbidden(bodyMessage)),
                     code: bodyCode || 'FORBIDDEN',
                     status: e.status,
                     exit: 3,
@@ -931,7 +971,7 @@ class BaseCommand extends core_1.Command {
      */
     noteControlPlaneOutage(status) {
         try {
-            (0, outbox_1.recordIncident)({ baseURL: this.cliConfig.baseURL, status }, (0, keychain_1.getActiveProfile)());
+            (0, outbox_1.recordIncident)({ baseURL: this.cliConfig.baseURL, status }, (0, keychain_2.getActiveProfile)());
         }
         catch {
             /* the surface is a convenience; never let it mask the real error */
@@ -987,7 +1027,7 @@ class BaseCommand extends core_1.Command {
                     ...(e.code ? { code: e.code } : {}),
                     message: e.message || 'control plane unavailable',
                 },
-            }, (0, keychain_1.getActiveProfile)());
+            }, (0, keychain_2.getActiveProfile)());
             queuedId = entry.id;
         }
         catch {
@@ -1216,6 +1256,38 @@ const TERMINAL_ERROR_CODES = new Set(['task_output_required', 'task_output_not_a
  *
  * Exported for tests.
  */
+/**
+ * What a 403 means, given whether the server said anything.
+ *
+ * Exported and pure so the wording is testable without an oclif runtime — the
+ * convention `isRetryableFailure` follows below.
+ *
+ * A 403 WITH a body is the API deciding, and it says why; we relay it. A 403
+ * with NO body did not come from the API — every application 403 in this
+ * codebase carries a message — so it is the edge refusing the request before it
+ * arrived, and the two must not share a sentence.
+ *
+ * This used to assert "your account does not have access to this resource" for
+ * both. For an edge refusal that names a cause this process never observed, and
+ * it is the expensive kind of wrong: it sends the user to audit their
+ * membership, their role and their token, which is the one place the problem is
+ * not. Dogfooded as OSK-263 — `skrr tasks create` refused a task description
+ * containing a dotted AWS-credentials path, in a project the same session had
+ * created a minute earlier, as an ADMIN who owned the space, and finding the
+ * real cause took a line-by-line bisect of the description body.
+ *
+ * The 404 branch has always done the honest thing (`bodyMessage || 'Not
+ * found.'`, which claims nothing); this brings 403 into line and adds the one
+ * lead worth having.
+ */
+function describeForbidden(bodyMessage) {
+    if (bodyMessage)
+        return bodyMessage;
+    return ('Forbidden: the server refused this request and gave no reason. That usually means an ' +
+        'edge rule rejected it before it reached the API rather than a permission you lack — if ' +
+        'you can read this resource elsewhere, try again with less of the request body (a path ' +
+        'or token-shaped string in your text is enough to trigger one).');
+}
 function isRetryableFailure(status, body) {
     const declared = body?.retryable;
     if (typeof declared === 'boolean')

package/dist/commands/agent/message/send.js

@@ -527,7 +527,7 @@ function messageSegmentationAdvisory({ destination, text, followingParts, }) {
         return undefined;
     if (text.length <= exports.OWNER_DM_SEGMENTATION_SOFT_LIMIT)
         return undefined;
-    return (`[sky] Owner-DM message is ${text.length} characters. It may read better as 2–4 short thoughts: ` +
+    return (`[skrr] Owner-DM message is ${text.length} characters. It may read better as 2–4 short thoughts: ` +
         'use --part with one explicit --idempotency-key. This is only an advisory; ' +
         'use --no-message-lint to suppress it.');
 }

package/dist/commands/agents/chat.d.ts

@@ -59,7 +59,7 @@ export default class AgentsChat extends BaseCommand {
     /**
      * OSK-2946 — a task reference sitting in the prompt with no binding.
      *
-     * Both reported Codex sessions named an skrr task UUID in the prompt, but
+     * Both reported Codex sessions named a skrr task UUID in the prompt, but
      * the daemon environment exposed `OVERSKY_SESSION_TASK_CONTEXT=main_chat` with
      * no `OVERSKY_SESSION_TASK_ID`, so `skrr tasks show` (no id) answered
      * `TASK_CONTEXT_MISSING`. Both agents then spent large context on registry /

package/dist/commands/agents/chat.js

@@ -114,7 +114,7 @@ class AgentsChat extends base_command_1.BaseCommand {
     /**
      * OSK-2946 — a task reference sitting in the prompt with no binding.
      *
-     * Both reported Codex sessions named an skrr task UUID in the prompt, but
+     * Both reported Codex sessions named a skrr task UUID in the prompt, but
      * the daemon environment exposed `OVERSKY_SESSION_TASK_CONTEXT=main_chat` with
      * no `OVERSKY_SESSION_TASK_ID`, so `skrr tasks show` (no id) answered
      * `TASK_CONTEXT_MISSING`. Both agents then spent large context on registry /

package/dist/commands/browser/install.d.ts

@@ -2,7 +2,7 @@ import { Command } from '@oclif/core';
 export default class BrowserInstall extends Command {
     static description: string;
     static flags: {
-        harness: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        harness: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
         config: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'dry-run': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;

package/dist/commands/browser/install.js

@@ -3,9 +3,17 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
 const browser_1 = require("../browser");
 class BrowserInstall extends core_1.Command {
-    static description = 'Add a sentinel-owned Sky Browser MCP entry without overwriting user configuration';
+    static description = 'Add a sentinel-owned skrr Browser MCP entry without overwriting user configuration';
     static flags = {
-        harness: core_1.Flags.string({ description: 'all, claude, codex, generic, or sky-code' }),
+        harness: core_1.Flags.string({
+            // The default and the --config exclusion are both enforced by the
+            // runtime this forwards to. Stating them only there meant a bare
+            // `skrr browser install` edited every detected harness config with
+            // nothing in this help to say so.
+            description: 'all, claude, codex, generic, or sky-code. `all` touches every detected ' +
+                'harness config and cannot be combined with --config.',
+            default: 'all',
+        }),
         config: core_1.Flags.string({ description: 'Explicit config file for a generic harness' }),
         'dry-run': core_1.Flags.boolean({ description: 'Show the intended edit without writing it' }),
         json: core_1.Flags.boolean({ description: 'Output JSON' }),

package/dist/commands/browser/mcp-config.js

@@ -3,7 +3,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
 const browser_1 = require("../browser");
 class BrowserMcpConfig extends core_1.Command {
-    static description = 'Print the copyable stdio MCP configuration for a generic harness';
+    static description = 'Print the copyable stdio MCP configuration for a generic harness. Paste it into that ' +
+        "harness's own MCP config; `skrr browser install` does this for the harnesses that " +
+        'have an adapter.';
     async run() {
         await this.parse(BrowserMcpConfig);
         await (0, browser_1.forwardBrowserCommand)(this, ['mcp-config']);

package/dist/commands/browser/skill/show.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
 const browser_1 = require("../../browser");
 class BrowserSkillShow extends core_1.Command {
-    static description = 'Print the version-matched Sky Browser agent skill';
+    static description = 'Print the version-matched skrr Browser agent skill';
     static args = {
         name: core_1.Args.string({ description: 'Skill name (core)' }),
     };

package/dist/commands/browser/status.js

@@ -3,7 +3,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
 const browser_1 = require("../browser");
 class BrowserStatus extends core_1.Command {
-    static description = 'Show attached, managed, E2B, and broker-bridge browser availability';
+    static description = 
+    // E2B is not a row of its own: it is the managed runtime's LOCATION, and
+    // listing it alongside the others promised a line the output never has.
+    'Show attached, managed (including its E2B location), and broker-bridge browser availability';
     static flags = {
         json: core_1.Flags.boolean({ description: 'Output JSON' }),
     };

package/dist/commands/browser/uninstall.d.ts

@@ -2,7 +2,7 @@ import { Command } from '@oclif/core';
 export default class BrowserUninstall extends Command {
     static description: string;
     static flags: {
-        harness: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        harness: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
         config: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'dry-run': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;

package/dist/commands/browser/uninstall.js

@@ -3,9 +3,17 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
 const browser_1 = require("../browser");
 class BrowserUninstall extends core_1.Command {
-    static description = 'Remove only the Sky Browser MCP entries owned by this installation';
+    static description = 'Remove only the skrr Browser MCP entries owned by this installation';
     static flags = {
-        harness: core_1.Flags.string({ description: 'all, claude, codex, generic, or sky-code' }),
+        harness: core_1.Flags.string({
+            // The default and the --config exclusion are both enforced by the
+            // runtime this forwards to. Stating them only there meant a bare
+            // `skrr browser uninstall` edited every detected harness config with
+            // nothing in this help to say so.
+            description: 'all, claude, codex, generic, or sky-code. `all` touches every detected ' +
+                'harness config and cannot be combined with --config.',
+            default: 'all',
+        }),
         config: core_1.Flags.string({ description: 'Explicit config file for a generic harness' }),
         'dry-run': core_1.Flags.boolean({ description: 'Show the intended removal without writing it' }),
         json: core_1.Flags.boolean({ description: 'Output JSON' }),

package/dist/commands/browser.d.ts

@@ -1,7 +1,7 @@
 import { Command } from '@oclif/core';
 export declare function buildBrowserArgs(passthrough: readonly string[]): string[];
 /**
- * Forward one concrete Sky Browser command to the daemon. Browser operations
+ * Forward one concrete skrr Browser command to the daemon. Browser operations
  * are implemented by the local daemon, not by the REST CLI, so every oclif
  * leaf uses this one bridge and preserves the capability boundary.
  */

package/dist/commands/browser.js

@@ -8,7 +8,7 @@ function buildBrowserArgs(passthrough) {
     return ['browser', ...passthrough];
 }
 /**
- * Forward one concrete Sky Browser command to the daemon. Browser operations
+ * Forward one concrete skrr Browser command to the daemon. Browser operations
  * are implemented by the local daemon, not by the REST CLI, so every oclif
  * leaf uses this one bridge and preserves the capability boundary.
  */
@@ -18,7 +18,7 @@ async function forwardBrowserCommand(command, passthrough) {
         // releases. Probe the command list before forwarding so an install command
         // cannot turn into a surprising service mutation.
         if ((await (0, exec_oversky_1.overskySupportsSubcommand)('browser')) === false) {
-            command.error('The local `oversky` daemon does not support Sky Browser yet. Update or reinstall the daemon, then retry `skrr browser`.', { exit: 2 });
+            command.error('The local `oversky` daemon does not support skrr Browser yet. Update or reinstall the daemon, then retry `skrr browser`.', { exit: 2 });
         }
         command.exit(await (0, exec_oversky_1.execOversky)(buildBrowserArgs(passthrough)));
     }
@@ -36,7 +36,7 @@ async function forwardBrowserCommand(command, passthrough) {
  * Chrome/profile handling or a second, divergent MCP implementation.
  */
 class Browser extends core_1.Command {
-    static description = 'Install, diagnose, and configure capability-scoped Sky Browser access for local and hosted harnesses';
+    static description = 'Install, diagnose, and configure capability-scoped skrr Browser access for local and hosted harnesses';
     static strict = false;
     static examples = [
         '<%= config.bin %> browser status',

package/dist/commands/code/index.js

@@ -17,12 +17,15 @@ const sky_code_managed_1 = require("../../lib/sky-code-managed");
  * that parses successfully and is then silently dropped.
  */
 class Code extends core_1.Command {
-    static description = 'Start the skrr Code interactive coding agent in this directory';
+    static description = 'Start the skrr Code interactive coding agent in this directory. Everything after ' +
+        `\`code\` is forwarded to the engine unchanged, so engine flags are not listed here — ` +
+        `run \`skrr code run --help\` for this wrapper, or the engine's own help for its ` +
+        `flags. ${sky_code_managed_1.SKRR_AGENT_FLAG} is the one flag this wrapper consumes itself.`;
     static strict = false;
     static examples = [
         '<%= config.bin %> code',
         '<%= config.bin %> code --model claude-opus-5',
-        `<%= config.bin %> code ${sky_code_managed_1.OVERSKY_AGENT_FLAG} Engineer`,
+        `<%= config.bin %> code ${sky_code_managed_1.SKRR_AGENT_FLAG} Engineer`,
         '<%= config.bin %> code run "fix the failing test"',
         '<%= config.bin %> code doctor',
     ];
@@ -69,7 +72,7 @@ async function forwardToEngine(cmd, subcommand, passthrough, options = {}) {
     // error at the other end.
     const say = (line) => cmd.logToStderr(line);
     if (agentRef && !options.managed) {
-        say(`${sky_code_managed_1.OVERSKY_AGENT_FLAG} has no effect here — this command does not host a managed ` +
+        say(`${sky_code_managed_1.SKRR_AGENT_FLAG} has no effect here — this command does not host a managed ` +
             'session. It was removed from the arguments passed to the engine.');
     }
     const managed = options.managed

package/dist/commands/code/install.d.ts

@@ -0,0 +1,61 @@
+import { BaseCommand } from '../../base-command';
+/**
+ * `skrr code install` — install the engine from the terminal.
+ *
+ * ── Why this command exists ────────────────────────────────────────────────
+ *
+ * `skrr code`'s not-installed message offered exactly two routes and neither
+ * worked without a browser: "In the web app: the runtime menu … → Install", or
+ * point `OVERSKY_SKY_CODE_PATH` at a build you already have — which is the thing
+ * you are trying to obtain, and the route that gives up provenance. So the
+ * ordinary case for a coding harness (a dev box over SSH, a CI runner, a cloud
+ * VM) had no way in (dogfood OSK-276).
+ *
+ * Nothing underneath was missing. The daemon has performed the verified install
+ * since 2026-08-08, and `POST /api/daemons/:id/cli-installers/:provider/install`
+ * has fronted it since June. The install was API-exposed and CLI-unreachable —
+ * the shape the root `CLAUDE.md` names under CLI ↔ API parity: "an endpoint the
+ * API exposes must be reachable from `skrr`."
+ *
+ * So this adds a SURFACE and no mechanism. Same route the web app posts, same
+ * daemon job, same signature verification. A second install path would be a
+ * second thing to keep in step with the first, and the first is the one that
+ * verifies the signed manifest.
+ */
+export default class CodeInstall extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        daemon: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        wait: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+    /**
+     * Which daemon does the install.
+     *
+     * Refuses rather than guessing when several are active. Picking one would mean
+     * installing a hundred megabytes onto a machine the user was not thinking
+     * about, and the list this reads is the same one `skrr list-daemons` prints —
+     * so the error can name the exact values that work.
+     */
+    private resolveDaemon;
+    /**
+     * What the daemon says about this provider, when it started no job.
+     *
+     * Read from the SAME list route the web app uses, so the CLI reports the
+     * daemon's own words rather than inventing an explanation for silence. Best
+     * effort: a failure here means falling back to the honest "does not say why",
+     * never to a guess.
+     */
+    private installerNote;
+    /**
+     * Poll the job until it settles, printing each new log line.
+     *
+     * The daemon already writes a progress log — "Fetching the signed skrr Code
+     * release manifest", "Verified and installed …" — and it is the only account
+     * of a hundred-megabyte download the user is waiting on. Printing only the
+     * lines not yet seen keeps a poll loop from repeating the whole log.
+     */
+    private followJob;
+}