@skrr-ai/cli 0.1.8 → 0.1.9

package/dist/lib/node-adapter.js

@@ -298,7 +298,7 @@ function createNodeAdapter(opts = {}) {
             else {
                 // Refresh-token rotation rejected (revoked / family burned /
                 // passwordChangedAt cutover). As a last resort, ask the local
-                // oversky daemon to broker a fresh cli-scope family — covers
+                // skrr runtime to broker a fresh cli-scope family — covers
                 // "user reset their account but daemon is still authed",
                 // "stale pre-broker keychain token", and similar drift cases.
                 const brokered = await tryDaemonBrokerRecovery();

package/dist/lib/oauthLogin.js

@@ -45,6 +45,7 @@ const node_child_process_1 = require("node:child_process");
 const auth_storage_1 = require("./auth-storage");
 const config_1 = require("./config");
 const device_id_1 = require("./device-id");
+const publicEndpoints_generated_1 = require("./publicEndpoints.generated");
 // ---------------------------------------------------------------------------
 // PKCE helpers
 // ---------------------------------------------------------------------------
@@ -64,17 +65,27 @@ function generateState() {
 // ---------------------------------------------------------------------------
 const CLIENT_ID = 'oversky-cli';
 const DEFAULT_SCOPES = Object.freeze(['cli']);
+// Both directions are DERIVED from config/public-endpoints.json via the
+// generated constant rather than hand-listed. The hand-listed pair predated the
+// domain cutover and knew only `oversky.*`, so the CURRENT prod apex
+// (`skrr.ai`) resolved to itself: a login against it would exchange tokens on
+// the app origin instead of the API one. Mirrors the same derivation in
+// `web-url.ts`, which needs the inverse map for exactly the same reason.
 const OAUTH_API_URL_FROM_WEB = {
+    ...Object.fromEntries(Object.values(publicEndpoints_generated_1.OVERSKY_ENVIRONMENT_ENDPOINTS).map((e) => [
+        e.appUrl.toLowerCase(),
+        e.realtimeUrl,
+    ])),
+    // Prod's retained previous origin, and the `www.` spelling of it.
     'https://oversky.ai': 'https://api.oversky.ai',
     'https://www.oversky.ai': 'https://api.oversky.ai',
-    // Dev split onto its own apex (oversky.dev) with an ALB-direct api. subdomain.
-    // Mirrors config/public-endpoints.json so `skrr login` against dev exchanges
-    // tokens on the same origin family prod uses.
-    'https://oversky.dev': 'https://api.oversky.dev',
 };
 const OAUTH_WEB_URL_FROM_API = {
+    ...Object.fromEntries(Object.values(publicEndpoints_generated_1.OVERSKY_ENVIRONMENT_ENDPOINTS).map((e) => [
+        e.realtimeUrl.toLowerCase(),
+        e.appUrl,
+    ])),
     'https://api.oversky.ai': 'https://oversky.ai',
-    'https://api.oversky.dev': 'https://oversky.dev',
 };
 function resolveOAuthEndpoints(serverUrl) {
     const normalized = serverUrl.replace(/\/+$/, '');
@@ -351,7 +362,7 @@ async function runOAuthLogin(opts) {
                     // refresh.ts:169 and :296. So the credential was rejected by its
                     // own issuer check the instant it was written:
                     //
-                    //   [sky] Ignoring stored credentials issued by
+                    //   [skrr] Ignoring stored credentials issued by
                     //         https://api.oversky.ai; skrr is configured for
                     //         https://oversky.ai.
                     //

package/dist/lib/sky-code-agent.d.ts

@@ -113,7 +113,7 @@ export interface SkyCodeAgentOptions {
      * May resolution CREATE the default agent when nothing else answers?
      *
      * Defaults to true, because a session that cannot name an agent cannot run.
-     * `skrr code oversky-agent` (with no `--create`) passes false: a command whose
+     * `skrr code skrr-agent` (with no `--create`) passes false: a command whose
      * job is to report what would happen must not make it happen.
      */
     createDefault?: boolean;

package/dist/lib/sky-code-agent.js

@@ -96,7 +96,7 @@ exports.SkyCodeAgentError = SkyCodeAgentError;
  */
 async function resolveSkyCodeAgent(explicit, deps = {}, options = {}) {
     const configured = deps.configuredAgentId ?? (() => (0, config_1.loadConfig)().skyCodeAgentId);
-    const explicitLabel = options.explicitLabel ?? sky_code_managed_1.OVERSKY_AGENT_FLAG;
+    const explicitLabel = options.explicitLabel ?? sky_code_managed_1.SKRR_AGENT_FLAG;
     let cached = null;
     const roster = async () => {
         if (cached)
@@ -123,7 +123,7 @@ async function resolveSkyCodeAgent(explicit, deps = {}, options = {}) {
         }
         if (byName.length > 1) {
             throw new SkyCodeAgentError('agent-ambiguous', `${describeSource(source, ref, explicitLabel)} matches ${byName.length} agents. ` +
-                `Pass ${sky_code_managed_1.OVERSKY_AGENT_FLAG} with an id instead: ${candidates(byName)}`);
+                `Pass ${sky_code_managed_1.SKRR_AGENT_FLAG} with an id instead: ${candidates(byName)}`);
         }
         // Not in the bounded roster. It may still be a real id belonging to a user with
         // more agents than the roster shows, so ask directly before refusing.
@@ -186,7 +186,7 @@ async function resolveSkyCodeAgent(explicit, deps = {}, options = {}) {
     //    exactly this and belongs to nobody else.
     //    `createDefault: false` makes this a READ: the endpoint is get-or-create
     //    and has no read-only mode, so a caller that is only ASKING
-    //    (`skrr code oversky-agent`) recognises an existing default from the roster
+    //    (`skrr code skrr-agent`) recognises an existing default from the roster
     //    it has already fetched instead. `defaultForHarness` rides the same
     //    summary projection `author` does, so this costs no extra request.
     //
@@ -220,8 +220,8 @@ async function resolveSkyCodeAgent(explicit, deps = {}, options = {}) {
         if (isAbortError(err))
             throw err;
         throw new SkyCodeAgentError('agent-unset', `could not establish your default skrr Code agent — ${message(err)}. ` +
-            `Pass ${sky_code_managed_1.OVERSKY_AGENT_FLAG} <id-or-name>, or set one with ` +
-            '`skrr code oversky-agent --set <id>`' +
+            `Pass ${sky_code_managed_1.SKRR_AGENT_FLAG} <id-or-name>, or set one with ` +
+            '`skrr code skrr-agent --set <id>`' +
             (rows.length ? `. Yours: ${candidates(rows)}` : ''));
     }
     // Asked, not told: the caller opted out of creation, so "no default" is a fact
@@ -229,14 +229,14 @@ async function resolveSkyCodeAgent(explicit, deps = {}, options = {}) {
     if (options.createDefault === false) {
         throw new SkyCodeAgentError('agent-unset', 'nothing is configured and you have no skrr Code default agent yet. ' +
             'One is created automatically the first time you run a managed session — ' +
-            'or make it now with `skrr code oversky-agent --create`' +
+            'or make it now with `skrr code skrr-agent --create`' +
             (rows.length ? `. Yours: ${candidates(rows)}` : ''));
     }
     // The endpoint answered without an agent. Nothing here can repair that, but
     // the user still has every ordinary way to name one.
     throw new SkyCodeAgentError('agent-unset', rows.length
         ? `skrr Code has no default agent for you and will not pick one of your ${rows.length}. ` +
-            `Pass ${sky_code_managed_1.OVERSKY_AGENT_FLAG} <id-or-name>, or set "${sky_code_managed_1.AGENT_CONFIG_KEY}" in ` +
+            `Pass ${sky_code_managed_1.SKRR_AGENT_FLAG} <id-or-name>, or set "${sky_code_managed_1.AGENT_CONFIG_KEY}" in ` +
             `${configPathHint()}. Yours: ${candidates(rows)}`
         : 'you have no agents and no default could be created, yet a managed skrr Code session ' +
             'runs as one. Create an agent in the skrr app first');
@@ -278,7 +278,7 @@ async function setConfiguredAgentId(ref, deps = {}, options = {}) {
         // Name the thing the user actually typed. Without this a bad `--set` value
         // is refused with "--oversky-agent \"typo\" is not an agent you can run",
         // pointing at a flag that was never on the command line.
-        explicitLabel: 'skrr code oversky-agent --set',
+        explicitLabel: 'skrr code skrr-agent --set',
         ...options,
     });
     writeConfigKey(resolved.id);

package/dist/lib/sky-code-broker.js

@@ -239,7 +239,7 @@ async function acquireManagedSession(input = {}, deps = {}) {
         if (agent.createdNow) {
             input.log?.(`Created "${agent.name ?? agent.id}" as your default skrr Code agent — ` +
                 'this session, and future ones, are attributed to it. ' +
-                'Change it with `skrr code oversky-agent --set <id-or-name>`.');
+                'Change it with `skrr code skrr-agent --set <id-or-name>`.');
         }
         const minted = await mintSessionToken({ sessionId, processStartId, agentId: agent.id, actorId: newId() }, api, acquisition.signal);
         sessionToken = minted.token;
@@ -888,11 +888,27 @@ function describe(err) {
  *
  * The predicate is `hasProviderCredential`, the same one that decides what the
  * engine actually inherits (`sky-code.ts`), so the sentence and the spawn cannot
- * disagree.
+ * disagree. `strippedProviderCredentialNames` covers the third case that
+ * predicate cannot see: the machine HAS a provider credential and this run
+ * removes it, which reads as absence and is not.
  */
 function fallbackTail(env) {
     if ((0, sky_code_1.hasProviderCredential)(env))
         return 'Continuing with your own provider credentials.';
+    // Absence and removal are different problems, and the old sentence said the
+    // first when the second was true: on a machine whose only credential is an AWS
+    // profile the engine runs fine on its own and fails through `skrr code`,
+    // because `AWS_*` is stripped on the way in. Being told "no provider
+    // credential is set here" sends that user to buy a key they do not need.
+    const stripped = (0, sky_code_1.strippedProviderCredentialNames)(env);
+    if (stripped.length > 0) {
+        return (`${stripped.join(', ')} is set here, but this run does not pass it to the engine — ` +
+            'it is stripped so a model-driven process opening other people\u2019s repositories cannot ' +
+            'reuse a cloud credential. So the engine starts without one and its first request will ' +
+            'fail. Export a provider key the engine may inherit (any `*_API_KEY`, e.g. ' +
+            'OPENROUTER_API_KEY), resolve the reason above, or run the engine directly if you ' +
+            'intend to spend that credential (`skrr code doctor` shows where it is).');
+    }
     return ('No provider credential is set here either, so the engine will start without one and ' +
         'its first request will fail — set OPENROUTER_API_KEY, or resolve the reason above ' +
         '(`skrr code doctor`).');

package/dist/lib/sky-code-doctor.js

@@ -32,6 +32,7 @@ exports.formatReport = formatReport;
 const node_fs_1 = require("node:fs");
 const node_path_1 = __importDefault(require("node:path"));
 const sky_code_1 = require("./sky-code");
+const auth_core_1 = require("@skrr-ai/auth-core");
 const harness_tiers_1 = require("./harness-tiers");
 const config_1 = require("./config");
 const sky_code_managed_1 = require("./sky-code-managed");
@@ -39,10 +40,124 @@ const sky_code_managed_1 = require("./sky-code-managed");
 function projectStateDir(cwd) {
     return node_path_1.default.join(node_path_1.default.resolve(cwd), '.sky-code');
 }
+/**
+ * Which release channel this machine follows, and where its manifest lives.
+ *
+ * `notInstalledMessage()` has always ended by promising that this command names
+ * "which channel this machine follows and whether that channel has a published
+ * release", and nothing here knew what a channel was — the whole vocabulary sat
+ * in `daemon/src/sky-code/channels.ts`, whose only importer was the daemon's own
+ * installer. So the user with no engine, who is exactly the audience for that
+ * sentence, was sent to a command that could not answer (dogfood OSK-274).
+ *
+ * It reports the channel and the exact URL, and does NOT fetch it. The doctor is
+ * documented as safe to run in any context and reads only env, config and one
+ * `existsSync`; adding a network call to satisfy a sentence would trade a broken
+ * promise for a diagnostic that hangs on a captive portal. Printing the URL puts
+ * the answer one copy-paste away and keeps the property — and the promise is
+ * reworded to match what is delivered rather than the other way round.
+ *
+ * `warn` on an unrecognised channel, because `resolveSkyCodeChannel` falls back
+ * to the default rather than throwing: a typo must not brick updates, and a
+ * silent fallback must not look like agreement.
+ */
+function releaseChannelCheck(env) {
+    const { channel, invalid } = (0, auth_core_1.resolveSkyCodeChannel)(env);
+    const url = (0, auth_core_1.resolveChannelManifestUrl)({
+        base: (0, auth_core_1.skyCodeFeedBase)(env),
+        manifestFilename: auth_core_1.SKY_CODE_MANIFEST_FILE,
+        channel,
+    });
+    if (invalid) {
+        return {
+            name: 'release-channel',
+            status: 'warn',
+            detail: `${auth_core_1.SKY_CODE_CHANNEL_ENV}='${invalid}' is not a channel; following '${channel}' instead — ${url}`,
+            remedy: `Set ${auth_core_1.SKY_CODE_CHANNEL_ENV} to one of internal, canary, beta, stable, or unset it to follow the default.`,
+        };
+    }
+    return {
+        name: 'release-channel',
+        status: 'ok',
+        detail: `${channel} — ${url}`,
+        remedy: `Fetch that URL to see whether the channel has a published release, and which version.`,
+    };
+}
+/**
+ * What the pre-rename engine directory still holds, for a machine that has moved on.
+ *
+ * Round 1 gave both readers a fallback to `~/.oversky/sky-code/bin` so nothing
+ * BREAKS on a machine that installed before the rename. Nothing was given the job
+ * of finishing the move: no installer sweep, and — once the current root wins —
+ * no mention anywhere. This machine converged on two engine directories and
+ * reported one, the older holding 713 MB across six binaries (dogfood OSK-278).
+ *
+ * Flat, never recursive, and failures are swallowed: this is a footnote on a
+ * diagnostic, and a doctor that throws while counting bytes it was only going to
+ * mention has made things worse than the clutter it was reporting.
+ */
+function strandedLegacyEngine(env) {
+    const exeName = process.platform === 'win32' ? 'sky-code.exe' : 'sky-code';
+    const legacy = (0, sky_code_1.legacyManagedEnginePath)(exeName, env);
+    if (!legacy)
+        return null;
+    const dir = node_path_1.default.dirname(legacy);
+    try {
+        const entries = (0, node_fs_1.readdirSync)(dir);
+        let bytes = 0;
+        let files = 0;
+        for (const entry of entries) {
+            const stats = (0, node_fs_1.statSync)(node_path_1.default.join(dir, entry));
+            if (!stats.isFile())
+                continue;
+            files += 1;
+            bytes += stats.size;
+        }
+        return files > 0 ? { dir, files, bytes } : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Bytes as the size a human would say out loud. */
+function humanBytes(bytes) {
+    const mb = bytes / 1024 / 1024;
+    return mb >= 1024 ? `${(mb / 1024).toFixed(1)} GB` : `${Math.round(mb)} MB`;
+}
 function engineCheck(env) {
     const { path: bin, source } = (0, sky_code_1.resolveEngine)(env);
+    if (bin && source === 'legacy-managed') {
+        // `ok`, because it runs and this is the resolution the daemon has always
+        // made. The remedy is here because the resolution is SURPRISING: the path
+        // says `.oversky` on a CLI that says `skrr` everywhere else, and the next
+        // daemon-driven install will write to `~/.skrr` and leave two copies of a
+        // hundred-megabyte binary on disk with no hint which one is live.
+        return {
+            name: 'engine',
+            status: 'ok',
+            detail: `${bin} (resolved via ${source} — the pre-rename location)`,
+            remedy: 'It works, and nothing has to change today. Installing the engine again ' +
+                `through the daemon writes it to ${(0, sky_code_1.managedEnginePath)('sky-code', env)}; ` +
+                'the copy above can be deleted once it does.',
+        };
+    }
     if (bin) {
-        return { name: 'engine', status: 'ok', detail: `${bin} (resolved via ${source})` };
+        // The engine resolved from the current root — and the pre-rename directory
+        // may still be sitting there. Said here rather than in its own check because
+        // it is a footnote on a healthy answer, not a finding of its own.
+        const stranded = strandedLegacyEngine(env);
+        return {
+            name: 'engine',
+            status: 'ok',
+            detail: `${bin} (resolved via ${source})`,
+            ...(stranded
+                ? {
+                    remedy: `${stranded.dir} still holds ${stranded.files} file(s), ${humanBytes(stranded.bytes)}, ` +
+                        'from before the config root moved. Nothing reads it now that the engine above ' +
+                        'resolves, and nothing removes it either — delete it when you want the space back.',
+                }
+                : {}),
+        };
     }
     const override = env[sky_code_1.ENGINE_PATH_ENV];
     if (override && !node_path_1.default.isAbsolute(override)) {
@@ -461,7 +576,7 @@ function sessionAuthorityCheck(env) {
                 remedy: 'Intended for local use, and nothing to fix. Worth knowing because it is NOT the same ' +
                     'trust plane as a daemon-dispatched run — and neither plane is an OS-level sandbox ' +
                     '(no seccomp, container, or namespace). An untrusted autonomous workload needs a hosted ' +
-                    'or container profile; see the fork’s docs/sky-code/threat-model.md.',
+                    'or container profile; see sky-code/docs/sky-code/threat-model.md.',
             };
     }
 }
@@ -473,7 +588,7 @@ function sessionAuthorityCheck(env) {
  * a `/api/agents` read, and this module's whole contract is that it answers from
  * env, one config read and one `existsSync` — that is what lets `skrr code doctor`
  * run before the auth plane is configured, and on a machine with no network.
- * `skrr code oversky-agent` is the command that resolves for real.
+ * `skrr code skrr-agent` is the command that resolves for real.
  *
  * Never a `warn`. An unset value is the normal, supported state now that
  * resolution ends in a default agent rather than a refusal; flagging it would
@@ -507,12 +622,13 @@ function agentAttributionCheck() {
         name: 'agent',
         status: 'ok',
         detail: `no ${sky_code_managed_1.AGENT_CONFIG_KEY} set — sessions use your sole owned agent, else your default ${sky_code_managed_1.SKY_CODE_HARNESS} agent`,
-        remedy: 'Run `skrr code oversky-agent` to see which, or `skrr code oversky-agent --set <id>` to pin one.',
+        remedy: 'Run `skrr code skrr-agent` to see which, or `skrr code skrr-agent --set <id>` to pin one.',
     };
 }
 function runDoctor(cwd = process.cwd(), env = process.env) {
     const checks = [
         engineCheck(env),
+        releaseChannelCheck(env),
         stateDirCheck(cwd, env),
         compatCheck(cwd, env),
         opencodeCheck(cwd),

package/dist/lib/sky-code-managed.d.ts

@@ -46,7 +46,19 @@ export declare const MANAGED_ENV_FLAG = "OVERSKY_SKY_CODE_MANAGED";
  * `skrr code --agent reviewer` is the engine's flag and is pinned as such by
  * `sky-code-passthrough.spec.ts`. A bare `--agent` here would steal it.
  */
+export declare const SKRR_AGENT_FLAG = "--skrr-agent";
+/**
+ * The pre-rename spelling, still accepted.
+ *
+ * It is in muscle memory and in scripts, and `skrr code` forwards argv verbatim
+ * — so a flag this CLI stops recognising is not an error, it is silently handed
+ * to the engine, which rejects it with a message about a flag the user did not
+ * think they were passing. Accepting both is the only version of this rename
+ * that fails safely.
+ */
 export declare const OVERSKY_AGENT_FLAG = "--oversky-agent";
+/** Every spelling the argv scanner honours, primary first. */
+export declare const AGENT_FLAG_SPELLINGS: readonly ["--skrr-agent", "--oversky-agent"];
 /** The config key `skrr code` reads when the flag is absent. */
 export declare const AGENT_CONFIG_KEY = "skyCodeAgentId";
 /**

package/dist/lib/sky-code-managed.js

@@ -32,7 +32,7 @@
  * reason: the user is about to spend their own key and must know it.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.BROKER_SOCKET_ENV = exports.MANAGED_SESSION_ENV = exports.SKY_CODE_HARNESS = exports.AGENT_CONFIG_KEY = exports.OVERSKY_AGENT_FLAG = exports.MANAGED_ENV_FLAG = void 0;
+exports.BROKER_SOCKET_ENV = exports.MANAGED_SESSION_ENV = exports.SKY_CODE_HARNESS = exports.AGENT_CONFIG_KEY = exports.AGENT_FLAG_SPELLINGS = exports.OVERSKY_AGENT_FLAG = exports.SKRR_AGENT_FLAG = exports.MANAGED_ENV_FLAG = void 0;
 exports.resolveTrustPlane = resolveTrustPlane;
 exports.skyCodeServerUrl = skyCodeServerUrl;
 exports.managedSkipReason = managedSkipReason;
@@ -59,7 +59,19 @@ exports.MANAGED_ENV_FLAG = 'OVERSKY_SKY_CODE_MANAGED';
  * `skrr code --agent reviewer` is the engine's flag and is pinned as such by
  * `sky-code-passthrough.spec.ts`. A bare `--agent` here would steal it.
  */
+exports.SKRR_AGENT_FLAG = '--skrr-agent';
+/**
+ * The pre-rename spelling, still accepted.
+ *
+ * It is in muscle memory and in scripts, and `skrr code` forwards argv verbatim
+ * — so a flag this CLI stops recognising is not an error, it is silently handed
+ * to the engine, which rejects it with a message about a flag the user did not
+ * think they were passing. Accepting both is the only version of this rename
+ * that fails safely.
+ */
 exports.OVERSKY_AGENT_FLAG = '--oversky-agent';
+/** Every spelling the argv scanner honours, primary first. */
+exports.AGENT_FLAG_SPELLINGS = [exports.SKRR_AGENT_FLAG, exports.OVERSKY_AGENT_FLAG];
 /** The config key `skrr code` reads when the flag is absent. */
 exports.AGENT_CONFIG_KEY = 'skyCodeAgentId';
 /**
@@ -238,19 +250,21 @@ function takeOverskyAgentFlag(passthrough) {
     let agentRef;
     for (let i = 0; i < passthrough.length; i += 1) {
         const token = passthrough[i];
-        if (token === exports.OVERSKY_AGENT_FLAG) {
-            // Last one wins, matching how every argv parser treats a repeated flag.
+        if (exports.AGENT_FLAG_SPELLINGS.includes(token)) {
+            // Last one wins, matching how every argv parser treats a repeated flag —
+            // and across spellings too, so `--oversky-agent a --skrr-agent b` is `b`.
             const value = passthrough[i + 1];
-            // A trailing `--oversky-agent` with no value must not swallow the next
-            // token (there is none) nor leave the flag in the argv.
+            // A trailing flag with no value must not swallow the next token (there is
+            // none) nor leave the flag in the argv.
             if (value !== undefined && !value.startsWith('-')) {
                 agentRef = value;
                 i += 1;
             }
             continue;
         }
-        if (token.startsWith(`${exports.OVERSKY_AGENT_FLAG}=`)) {
-            agentRef = token.slice(exports.OVERSKY_AGENT_FLAG.length + 1);
+        const inline = exports.AGENT_FLAG_SPELLINGS.find((f) => token.startsWith(`${f}=`));
+        if (inline) {
+            agentRef = token.slice(inline.length + 1);
             continue;
         }
         engineArgv.push(token);

package/dist/lib/sky-code.d.ts

@@ -31,9 +31,23 @@ export declare function skyCodeInstructionHome(env?: NodeJS.ProcessEnv): string;
  * `scripts/sky-code/build.mjs --install` all put the engine.
  */
 export declare function managedEnginePath(exeName: string, env?: NodeJS.ProcessEnv): string;
+/**
+ * The same managed location under the PREVIOUS config root.
+ *
+ * The root moved `~/.oversky` → `~/.skrr` in the skrr rename, and an engine
+ * installed before that is still on disk under the old one. `daemon/src/
+ * binary-resolver.ts` was given this fallback and this module was not, so on
+ * the same machine the daemon found the engine and `skrr code` reported that no
+ * engine was installed — the same product, the same 106 MB binary, two answers.
+ *
+ * Returns null when an explicit `OVERSKY_CONFIG_DIR` is set, matching the
+ * daemon: that override names one root deliberately, and reaching past it to a
+ * hard-coded home would defeat the pinning {@link engineHome} relies on.
+ */
+export declare function legacyManagedEnginePath(exeName: string, env?: NodeJS.ProcessEnv): string | null;
 export interface EngineResolution {
     path: string | null;
-    source: 'env' | 'path' | 'managed' | 'fallback' | 'unresolved';
+    source: 'env' | 'path' | 'managed' | 'legacy-managed' | 'fallback' | 'unresolved';
 }
 /**
  * Resolve the engine binary, reporting WHERE it came from.
@@ -185,6 +199,7 @@ export interface EngineSpawnOptions {
 export declare function inheritedProviderCredentials(env: NodeJS.ProcessEnv): Record<string, string>;
 /** Whether an unmanaged run has anything to authenticate with. */
 export declare function hasProviderCredential(env?: NodeJS.ProcessEnv): boolean;
+export declare function strippedProviderCredentialNames(env?: NodeJS.ProcessEnv): string[];
 /**
  * The environment the engine actually receives.
  *

package/dist/lib/sky-code.js

@@ -21,11 +21,13 @@ exports.ENGINE_PATH_ENV = void 0;
 exports.engineHome = engineHome;
 exports.skyCodeInstructionHome = skyCodeInstructionHome;
 exports.managedEnginePath = managedEnginePath;
+exports.legacyManagedEnginePath = legacyManagedEnginePath;
 exports.resolveEngine = resolveEngine;
 exports.buildEngineArgs = buildEngineArgs;
 exports.notInstalledMessage = notInstalledMessage;
 exports.inheritedProviderCredentials = inheritedProviderCredentials;
 exports.hasProviderCredential = hasProviderCredential;
+exports.strippedProviderCredentialNames = strippedProviderCredentialNames;
 exports.engineSpawnEnv = engineSpawnEnv;
 exports.execEngine = execEngine;
 const node_child_process_1 = require("node:child_process");
@@ -70,6 +72,24 @@ function skyCodeInstructionHome(env = process.env) {
 function managedEnginePath(exeName, env = process.env) {
     return node_path_1.default.join(engineHome(env), 'bin', exeName);
 }
+/**
+ * The same managed location under the PREVIOUS config root.
+ *
+ * The root moved `~/.oversky` → `~/.skrr` in the skrr rename, and an engine
+ * installed before that is still on disk under the old one. `daemon/src/
+ * binary-resolver.ts` was given this fallback and this module was not, so on
+ * the same machine the daemon found the engine and `skrr code` reported that no
+ * engine was installed — the same product, the same 106 MB binary, two answers.
+ *
+ * Returns null when an explicit `OVERSKY_CONFIG_DIR` is set, matching the
+ * daemon: that override names one root deliberately, and reaching past it to a
+ * hard-coded home would defeat the pinning {@link engineHome} relies on.
+ */
+function legacyManagedEnginePath(exeName, env = process.env) {
+    if (env.OVERSKY_CONFIG_DIR?.trim())
+        return null;
+    return node_path_1.default.join((0, node_os_1.homedir)(), '.oversky', 'sky-code', 'bin', exeName);
+}
 /**
  * Unmanaged well-known locations, checked after PATH.
  *
@@ -139,6 +159,15 @@ function resolveEngine(env = process.env) {
     const managed = managedEnginePath(exeName, env);
     if (isExecutable(managed))
         return { path: managed, source: 'managed' };
+    // The pre-rename managed location, SECOND. After the current one, so a fresh
+    // install always wins; before PATH, for the same WL-6.2 reason the current one
+    // beats PATH — a binary skrr installed outranks whatever happens to sit on the
+    // user's PATH, and which config root it was installed under does not change
+    // that. Reported as its own `source` so `skrr code doctor` can say where it
+    // came from rather than quietly resolving something surprising.
+    const legacy = legacyManagedEnginePath(exeName, env);
+    if (legacy && isExecutable(legacy))
+        return { path: legacy, source: 'legacy-managed' };
     const PATH = env.PATH ?? '';
     const sep = process.platform === 'win32' ? ';' : ':';
     const exeNames = process.platform === 'win32' ? ['sky-code.exe', 'sky-code.cmd'] : ['sky-code'];
@@ -198,15 +227,17 @@ function notInstalledMessage() {
         'The skrr Code engine (`sky-code`) is not installed on this machine.',
         '',
         'Install it through the daemon, which verifies the signed release:',
-        '  • In the web app: the runtime menu beside the chat input → skrr Code → Install',
-        '  • Make sure a daemon is running here first: `oversky status`',
+        '  • `skrr code install`  — from here, no browser needed',
+        '  • Or in the web app: the runtime menu beside the chat input → skrr Code → Install',
+        '  • Either way a daemon must be running here: `skrr daemon status`',
         '',
         `Or point the CLI at an existing build:  export ${exports.ENGINE_PATH_ENV}=/absolute/path/to/sky-code`,
         '  (an unsigned build runs, and since 2026-08-11 at the same trust tier as a',
         '   signed one — see `skrr code doctor` under trust-tier)',
         '',
-        'Run `skrr code doctor` for a full diagnosis, including which channel this',
-        'machine follows and whether that channel has a published release.',
+        'Run `skrr code doctor` for a full diagnosis. Its `release-channel` line',
+        'names the channel this machine follows and the exact manifest URL to check',
+        'for a published release.',
     ].join('\n');
 }
 /**
@@ -220,6 +251,37 @@ function notInstalledMessage() {
  */
 const BYOK_CREDENTIAL_SUFFIXES = ['_API_KEY', '_AUTH_TOKEN'];
 const BYOK_CREDENTIAL_NAMES = new Set(['HUGGINGFACE_HUB_TOKEN']);
+/**
+ * `AWS_*` names that are not credentials, and that Bedrock cannot run without.
+ *
+ * The `AWS_` prefix rule below exists for STS/IAM material — `AWS_ACCESS_KEY_ID`,
+ * `AWS_SECRET_ACCESS_KEY`, `AWS_SESSION_TOKEN`, `AWS_BEARER_TOKEN_BEDROCK` — and
+ * every one of those stays stripped. These three carry no secret: two are a
+ * region and one is the NAME of a profile whose credentials live in the AWS
+ * shared config, a file the engine can read anyway. Stripping them therefore
+ * protected nothing and cost an entire provider.
+ *
+ * Dogfooded as OSK-262, where `sky-code run "say hi"` answered on a Bedrock
+ * model and the identical run through `skrr code` died in the engine's generic
+ * error handler — because `AWS_PROFILE` did not survive the sanitizer.
+ * `env -u AWS_PROFILE` on the bare engine reproduced the failure exactly.
+ *
+ * An enumerated carve-out rather than a narrower prefix, so every future
+ * addition is a reviewable line that has to argue "this one is not a secret".
+ * The failure mode of the alternative is an exemption list that grows until the
+ * prefix rule means nothing.
+ *
+ * BYOK ONLY, and that is why it lives here rather than in `sanitizeSpawnEnv`.
+ * {@link engineSpawnEnv} re-admits nothing on a managed run, so a session
+ * spending a budgeted relay credential still cannot reach Bedrock directly and
+ * bill around its own budget. Putting the exemption in the shared sanitizer
+ * would hand it to the daemon's managed ACP path too, and lose that.
+ */
+const BYOK_AWS_NON_SECRETS = new Set([
+    'AWS_PROFILE',
+    'AWS_REGION',
+    'AWS_DEFAULT_REGION',
+]);
 /**
  * …and these are never inherited, whatever they look like.
  *
@@ -256,6 +318,11 @@ function inheritedProviderCredentials(env) {
             continue;
         if (ENGINE_NEVER_INHERITS.has(key))
             continue;
+        // Before the prefix rule, which would otherwise take these with the family.
+        if (BYOK_AWS_NON_SECRETS.has(key)) {
+            out[key] = value;
+            continue;
+        }
         if (ENGINE_NEVER_INHERITS_PREFIXES.some((prefix) => key.startsWith(prefix)))
             continue;
         if (BYOK_CREDENTIAL_NAMES.has(key) || BYOK_CREDENTIAL_SUFFIXES.some((s) => key.endsWith(s))) {
@@ -268,6 +335,37 @@ function inheritedProviderCredentials(env) {
 function hasProviderCredential(env = process.env) {
     return Object.keys(inheritedProviderCredentials(env)).length > 0;
 }
+/**
+ * Provider-capable credentials this environment HAS and the engine will not get.
+ *
+ * `hasProviderCredential` answers "will the engine have a key", which is the
+ * right question for what to spawn and the wrong one for what to SAY. On a
+ * machine whose only credential is an AWS profile the two answers differ: the
+ * engine defaults to a Bedrock model and runs fine when launched directly, and
+ * `skrr code` — which strips `AWS_*` — reported "no provider credential is set
+ * here", sent the user to buy an OpenRouter key, and then died in the engine's
+ * generic error handler. The user had a working credential; this run removed it.
+ *
+ * "You have none" and "you have one and this run does not pass it on" are
+ * different problems with different fixes, so they must not share a sentence.
+ *
+ * Only the deny-listed names a PROVIDER could actually authenticate with are
+ * reported. `GH_TOKEN` and `NPM_TOKEN` are stripped too and are not model
+ * credentials, so naming them here would turn a precise sentence into noise.
+ */
+const STRIPPED_PROVIDER_CREDENTIALS = [
+    // Bedrock's SECRET material only. `AWS_PROFILE` and the region variables are
+    // exempt ({@link BYOK_AWS_NON_SECRETS}) and now reach the engine, so naming
+    // them here would make this sentence contradict the spawn — which is the exact
+    // defect this reporter was added to end.
+    'AWS_ACCESS_KEY_ID',
+    'AWS_BEARER_TOKEN_BEDROCK',
+    // Anthropic OAuth, deny-listed by name in ENGINE_NEVER_INHERITS.
+    'CLAUDE_CODE_OAUTH_TOKEN',
+];
+function strippedProviderCredentialNames(env = process.env) {
+    return STRIPPED_PROVIDER_CREDENTIALS.filter((name) => (env[name] ?? '').trim() !== '');
+}
 /**
  * The environment the engine actually receives.
  *

package/dist/lib/task-execution.js

@@ -27,6 +27,7 @@ exports.sleep = sleep;
 exports.compactSnapshotSignature = compactSnapshotSignature;
 const data_provider_1 = require("@skrr-ai/data-provider");
 const tasks_1 = require("./tasks");
+const html_text_1 = require("./html-text");
 /**
  * Statuses at which an execution is OVER — nothing further will move the task
  * without new input.
@@ -304,17 +305,9 @@ function compactSnapshotSignature(snapshot) {
         .sort()
         .join('|');
 }
-function stripHtml(value) {
-    return value
-        .replace(/<br\s*\/?>/gi, '\n')
-        .replace(/<\/p>/gi, '\n')
-        .replace(/<[^>]+>/g, ' ')
-        .replace(/&nbsp;/g, ' ')
-        .replace(/&#39;/g, "'")
-        .replace(/&quot;/g, '"')
-        .replace(/&amp;/g, '&')
-        .replace(/[ \t]+/g, ' ');
-}
+// Was a private copy here; it is the same job `tasks show` needs, and two
+// slightly different HTML strippers is how the two surfaces drift.
+const stripHtml = html_text_1.htmlToDisplayText;
 function stringValue(value) {
     return typeof value === 'string' && value.trim() ? value.trim() : undefined;
 }

package/dist/lib/tasks.d.ts

@@ -1,3 +1,4 @@
+export declare const TASK_PRIORITIES: readonly ["low", "medium", "high", "critical"];
 /**
  * The kinds `tasks events append --kind` will accept.
  *