@skrr-ai/cli 0.1.94 → 0.1.96

package/dist/commands/code/index.js

@@ -5,6 +5,7 @@ const core_1 = require("@oclif/core");
 const auth_core_1 = require("@skrr-ai/auth-core");
 const first_party_harness_1 = require("../../lib/first-party-harness");
 const first_party_harness_broker_1 = require("../../lib/first-party-harness-broker");
+const first_party_harness_startup_update_1 = require("../../lib/first-party-harness-startup-update");
 const first_party_harness_managed_1 = require("../../lib/first-party-harness-managed");
 const first_party_harness_project_trust_1 = require("../../lib/first-party-harness-project-trust");
 /**
@@ -93,6 +94,9 @@ async function forwardToEngine(cmd, subcommand, passthrough, options = {}) {
     // output on stdout, and one friendly sentence in the middle of it is a parse
     // error at the other end.
     const say = (line) => cmd.logToStderr(line);
+    if (subcommand === null && options.projectPolicy === 'tui') {
+        await (0, first_party_harness_startup_update_1.maybeOfferCodeUpdate)({ argv: engineArgv, say });
+    }
     if (agentRef && !options.managed) {
         say(`${first_party_harness_managed_1.SKRR_AGENT_FLAG} has no effect here — this command does not host a managed ` +
             'session. It was removed from the arguments passed to the engine.');

package/dist/commands/code/install.d.ts

@@ -1,71 +1,14 @@
-import { BaseCommand } from '../../base-command';
-/**
- * `skrr code install` — install the engine from the terminal.
- *
- * ── Why this command exists ────────────────────────────────────────────────
- *
- * `skrr code`'s not-installed message offered exactly two routes and neither
- * worked without a browser: "In the web app: the runtime menu … → Install", or
- * point the engine-path override at a build you already have — which is the thing
- * you are trying to obtain, and the route that gives up provenance. So the
- * ordinary case for a coding harness (a dev box over SSH, a CI runner, a cloud
- * VM) had no way in (dogfood OSK-276).
- *
- * Nothing underneath was missing. The daemon has performed the verified install
- * since 2026-08-08, and `POST /api/daemons/:id/cli-installers/:provider/install`
- * has fronted it since June. The install was API-exposed and CLI-unreachable —
- * the shape the root `CLAUDE.md` names under CLI ↔ API parity: "an endpoint the
- * API exposes must be reachable from `skrr`."
- *
- * So this adds a SURFACE and no mechanism. Same route the web app posts, same
- * daemon job, same signature verification. A second install path would be a
- * second thing to keep in step with the first, and the first is the one that
- * verifies the signed manifest.
- */
-export default class CodeInstall extends BaseCommand {
+import { Command } from '@oclif/core';
+/** Install through the shared signed pipeline without a cloud login or local daemon. */
+export default class CodeInstall extends Command {
     static description: string;
     static examples: string[];
     static flags: {
         daemon: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         wait: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'target-version': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'allow-downgrade': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
-    /** Which daemon the install targets, by the rule every daemon-picking command shares. */
-    private resolveTarget;
-    /**
-     * The daemon id to install through, or the refusal.
-     *
-     * Refuses rather than guessing when several are active. Picking one would mean
-     * installing a hundred megabytes onto a machine the user was not thinking
-     * about. The candidates are CONNECTED daemons by the id the installer routes
-     * take (`listConnectedDaemons`), so the error names values that work — the
-     * Daemon resource list `skrr list-daemons` prints is a different id space
-     * (OSK-9993).
-     *
-     * A Dedicated Runtime's own machine is refused here, before any request. The
-     * daemon and the API refuse it too; saying so locally is what keeps the answer
-     * the same whether or not this machine's daemon is reachable, and whether or
-     * not it has published its id. Another of the owner's machines, named with
-     * `--daemon`, is not this machine and goes to the API like anywhere else.
-     */
-    private installTarget;
-    /**
-     * What the daemon says about this provider, when it started no job.
-     *
-     * Read from the SAME list route the web app uses, so the CLI reports the
-     * daemon's own words rather than inventing an explanation for silence. Best
-     * effort: a failure here means falling back to the honest "does not say why",
-     * never to a guess.
-     */
-    private installerNote;
-    /**
-     * Poll the job until it settles, printing each new log line.
-     *
-     * The daemon already writes a progress log — "Fetching the signed release
-     * manifest", "Verified and installed …" — and it is the only account
-     * of a hundred-megabyte download the user is waiting on. Printing only the
-     * lines not yet seen keeps a poll loop from repeating the whole log.
-     */
-    private followJob;
 }

package/dist/commands/code/install.js

@@ -1,310 +1,117 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
 const auth_core_1 = require("@skrr-ai/auth-core");
-const base_command_1 = require("../../base-command");
-const api_fetch_1 = require("../../lib/api-fetch");
-const daemon_target_1 = require("../../lib/daemon-target");
-const first_party_harness_1 = require("../../lib/first-party-harness");
-/**
- * `skrr code install` — install the engine from the terminal.
- *
- * ── Why this command exists ────────────────────────────────────────────────
- *
- * `skrr code`'s not-installed message offered exactly two routes and neither
- * worked without a browser: "In the web app: the runtime menu … → Install", or
- * point the engine-path override at a build you already have — which is the thing
- * you are trying to obtain, and the route that gives up provenance. So the
- * ordinary case for a coding harness (a dev box over SSH, a CI runner, a cloud
- * VM) had no way in (dogfood OSK-276).
- *
- * Nothing underneath was missing. The daemon has performed the verified install
- * since 2026-08-08, and `POST /api/daemons/:id/cli-installers/:provider/install`
- * has fronted it since June. The install was API-exposed and CLI-unreachable —
- * the shape the root `CLAUDE.md` names under CLI ↔ API parity: "an endpoint the
- * API exposes must be reachable from `skrr`."
- *
- * So this adds a SURFACE and no mechanism. Same route the web app posts, same
- * daemon job, same signature verification. A second install path would be a
- * second thing to keep in step with the first, and the first is the one that
- * verifies the signed manifest.
- */
-class CodeInstall extends base_command_1.BaseCommand {
-    static description = `Install the ${auth_core_1.FIRST_PARTY_HARNESS.displayName} engine on this machine, through the daemon`;
+const first_party_harness_update_1 = require("../../lib/first-party-harness-update");
+/** Install through the shared signed pipeline without a cloud login or local daemon. */
+class CodeInstall extends core_1.Command {
+    static description = `Install the local ${auth_core_1.FIRST_PARTY_HARNESS.displayName} signed release; use --daemon to install on another machine`;
     static examples = [
         '<%= config.bin %> code install',
         '<%= config.bin %> code install --daemon <daemon-id>',
         '<%= config.bin %> code install --json',
     ];
     static flags = {
-        daemon: core_1.Flags.string({
-            description: 'Which daemon installs it. Defaults to this machine on a Dedicated Runtime, otherwise to the only active one; required when you have several.',
-        }),
+        daemon: core_1.Flags.string({ description: 'Install on this daemon instead of this computer' }),
         wait: core_1.Flags.boolean({
             default: true,
             allowNo: true,
-            description: 'Follow the install job until it finishes. --no-wait returns the job id.',
+            description: 'Wait for completion. --no-wait returns the local process or remote job.',
         }),
         json: core_1.Flags.boolean({ description: 'Emit the result as JSON' }),
+        'target-version': core_1.Flags.string({ description: 'Install this exact signed release' }),
+        'allow-downgrade': core_1.Flags.boolean({
+            description: 'Allow an explicitly pinned older signed release',
+        }),
     };
     async run() {
-        const { flags } = await this.parse(CodeInstall);
-        const daemonId = this.installTarget(await this.resolveTarget(flags.daemon));
-        let started;
-        try {
-            started = await (0, api_fetch_1.apiFetch)(`/api/daemons/${encodeURIComponent(daemonId)}/cli-installers/${PROVIDER}/install`, { method: 'POST', body: {}, credential: this.resolvedCredential });
-        }
-        catch (err) {
-            this.handleApiError(err);
-        }
-        // The daemon distinguishes three refusals, and only one of them attaches a
-        // job worth following:
-        //
-        // - `alreadyInstalled` carries the LAST job the provider ran — context, not
-        //   this request's work. Following it replays a stale outcome as though it
-        //   had just happened: `code install` on an engine one release behind
-        //   reprinted the previous update's log tail verbatim and reported that job
-        //   as its result (OSK-10650). The right answer is the daemon's own
-        //   installDisabledReason plus where the update actually comes from.
-        // - `alreadyRunning` carries the LIVE job — following it attaches the user
-        //   to work that is really in flight, which is what they asked for.
-        // - `started` carries the job this request began.
-        if (started.alreadyInstalled) {
-            if (flags.json) {
-                this.log(JSON.stringify({ daemonId, ...started }, null, 2));
-                return;
-            }
-            const state = started.provider;
-            const reason = state?.installDisabledReason?.trim();
-            const version = state?.version?.trim();
-            this.log(`Nothing to do on ${daemonId} — ${reason || 'Already installed.'}${version ? ` (${version})` : ''}`);
-            if (state?.updatable === true) {
-                this.log(`To update it: ${this.config.bin} code update`);
-            }
-            else {
-                const why = state?.updateDisabledReason?.trim();
-                if (why)
-                    this.log(`Updating: ${why}`);
-            }
+        if (this.argv.some((arg) => arg === '--daemon' || arg.startsWith('--daemon='))) {
+            const { default: RemoteCodeInstall } = await Promise.resolve().then(() => __importStar(require('../../lib/first-party-harness-remote-install')));
+            await this.parse(RemoteCodeInstall);
+            await RemoteCodeInstall.run(this.argv, this.config);
             return;
         }
-        const jobId = started.job?.id;
-        // A 202 carrying NO job is not a queued install. It is the daemon
-        // acknowledging the call and returning nothing, and the route builds its
-        // body as `{ daemonId, ...result }` — so an empty result and a real one look
-        // identical from here. Dogfooded (OSK-287): this printed "Install requested"
-        // and exited 0 against a daemon that answered an unrelated RPC in 83ms and
-        // then installed nothing for 130 seconds. Reporting success for an empty
-        // acknowledgement is what let that reach a user as silence.
-        if (!jobId) {
-            if (flags.json) {
-                this.log(JSON.stringify({ daemonId, ...started }, null, 2));
+        const { flags } = await this.parse(CodeInstall);
+        if (flags['allow-downgrade'] && !flags['target-version'])
+            this.error('--allow-downgrade requires --target-version.');
+        try {
+            const current = (0, first_party_harness_update_1.getLocalCodeUpdateStatus)();
+            if (current.activePath && current.owner === 'managed' && !flags['target-version']) {
+                if (flags.json)
+                    this.log(JSON.stringify({ ...current, alreadyInstalled: true }, null, 2));
+                else
+                    this.log(`${auth_core_1.FIRST_PARTY_HARNESS.displayName} is already installed${current.installedVersion ? ` (${current.installedVersion})` : ''}. Run \`skrr code update\` to update it.`);
                 return;
             }
-            // A no-op is not a failure. The daemon says WHY it started nothing, and
-            // the commonest reason is the happy one — the engine is already there.
-            //
-            // This branch used to treat every job-less response as "nothing has been
-            // shown to start", which was right while the control-RPC relay dropped
-            // every reply (OSK-287) and wrong the moment it was fixed: with real
-            // payloads flowing, running `code install` twice would have reported a
-            // problem for the ordinary case of already having the engine. That is the
-            // same defect this dogfood run kept finding in other people's error copy —
-            // a message asserting a cause it has not observed — so it does not get to
-            // survive in mine.
-            const reason = await this.installerNote(daemonId);
-            if (reason) {
-                this.log(`Nothing to do on ${daemonId} — ${reason}`);
+            const options = {
+                version: flags['target-version'],
+                allowDowngrade: flags['allow-downgrade'],
+                install: true,
+            };
+            if (!flags.wait) {
+                const queued = await (0, first_party_harness_update_1.startLocalCodeUpdate)({ ...options, operation: 'install' });
+                if (flags.json)
+                    this.log(JSON.stringify(queued, null, 2));
+                else
+                    this.log(`${auth_core_1.FIRST_PARTY_HARNESS.displayName} install queued (process ${queued.pid}). Results: ${queued.logPath}; status: skrr code doctor.`);
                 return;
             }
-            this.failWithCliError({
-                message: `The daemon on ${daemonId} accepted the request and returned no ` +
-                    'install job, and does not say why. Nothing has been shown to start. ' +
-                    `Check what it offers with \`${this.config.bin} harnesses installers --daemon ${daemonId}\`, and ` +
-                    `\`${this.config.bin} code doctor\` here once you expect it to have landed.`,
-                code: 'INSTALL_NOT_TRACKED',
-                exit: 1,
-                // Retryable: the daemon is reachable and the call was accepted, so the
-                // same command may well work once whatever swallowed it is understood.
-                retryable: true,
+            const result = await (0, first_party_harness_update_1.updateLocalCode)({
+                ...options,
+                onProgress: flags.json ? undefined : (line) => this.logToStderr(line),
             });
+            if (flags.json)
+                this.log(JSON.stringify(result, null, 2));
+            else
+                this.log((0, first_party_harness_update_1.formatLocalCodeUpdate)(result));
+            if (result.state === 'failed')
+                process.exitCode = 1;
         }
-        if (!flags.wait) {
+        catch (error) {
             if (flags.json) {
-                this.log(JSON.stringify({ daemonId, ...started }, null, 2));
-                return;
-            }
-            this.log(`Install started on ${daemonId} — job ${jobId}.`);
-            return;
-        }
-        const job = await this.followJob(daemonId, jobId, flags.json === true);
-        if (flags.json) {
-            this.log(JSON.stringify({ daemonId, job }, null, 2));
-        }
-        if (job.status === 'failed') {
-            // The daemon's own message, verbatim. It carries the failure CODE
-            // (`runSignedInstall` puts it there deliberately) because "the feed is
-            // down" and "the signature did not verify" need very different responses.
-            this.failWithCliError({
-                message: job.error || 'The install failed and the daemon gave no reason.',
-                code: 'INSTALL_FAILED',
-                exit: 1,
-                retryable: false,
-            });
-        }
-        if (!flags.json) {
-            this.log(`${auth_core_1.FIRST_PARTY_HARNESS.displayName} installed. Run \`${this.config.bin} code\` to start it.`);
-        }
-    }
-    /** Which daemon the install targets, by the rule every daemon-picking command shares. */
-    async resolveTarget(explicit) {
-        try {
-            return await (0, daemon_target_1.resolveDaemonTarget)({
-                explicit,
-                local: (0, daemon_target_1.localMachine)({ baseURL: this.cliConfig?.baseURL }),
-                listActiveDaemons: () => (0, daemon_target_1.listConnectedDaemons)(this.resolvedCredential),
-            });
-        }
-        catch (err) {
-            this.handleApiError(err);
-        }
-    }
-    /**
-     * The daemon id to install through, or the refusal.
-     *
-     * Refuses rather than guessing when several are active. Picking one would mean
-     * installing a hundred megabytes onto a machine the user was not thinking
-     * about. The candidates are CONNECTED daemons by the id the installer routes
-     * take (`listConnectedDaemons`), so the error names values that work — the
-     * Daemon resource list `skrr list-daemons` prints is a different id space
-     * (OSK-9993).
-     *
-     * A Dedicated Runtime's own machine is refused here, before any request. The
-     * daemon and the API refuse it too; saying so locally is what keeps the answer
-     * the same whether or not this machine's daemon is reachable, and whether or
-     * not it has published its id. Another of the owner's machines, named with
-     * `--daemon`, is not this machine and goes to the API like anywhere else.
-     */
-    installTarget(target) {
-        if (target.kind === 'daemon')
-            return target.daemonId;
-        if (target.kind === 'this-machine') {
-            this.failWithCliError({
-                message: target.explicit
-                    ? first_party_harness_1.DEDICATED_RUNTIME_ENGINE_MESSAGE
-                    : `${first_party_harness_1.DEDICATED_RUNTIME_ENGINE_MESSAGE} This command installs on the machine it runs on; ` +
-                        'to install on another of your machines, name it with --daemon.',
-                code: 'DEDICATED_RUNTIME_ENGINE_SHIPS_WITH_IMAGE',
-                exit: 1,
-                retryable: false,
-            });
-        }
-        if (target.kind === 'none') {
-            this.failWithCliError({
-                message: 'No daemon is connected for this account, so nothing can perform the install. ' +
-                    `Start the background service on this computer with \`${this.config.bin} daemon start\`, then run this again.`,
-                code: 'NO_DAEMON',
-                exit: 1,
-                retryable: false,
-            });
-        }
-        const { daemons } = target;
-        const choices = daemons
-            .slice(0, 10)
-            .map((d) => `  ${d.id}  ${d.name || '—'}`)
-            .join('\n');
-        this.failWithCliError({
-            message: `${daemons.length} connected daemons — say which machine should install the engine:\n${choices}\n` +
-                `Pass one with --daemon, or see each daemon id in the DAEMON ID column of \`${this.config.bin} harnesses list\`.`,
-            code: 'AMBIGUOUS_DAEMON',
-            exit: 1,
-            retryable: false,
-        });
-    }
-    /**
-     * What the daemon says about this provider, when it started no job.
-     *
-     * Read from the SAME list route the web app uses, so the CLI reports the
-     * daemon's own words rather than inventing an explanation for silence. Best
-     * effort: a failure here means falling back to the honest "does not say why",
-     * never to a guess.
-     */
-    async installerNote(daemonId) {
-        try {
-            const res = await (0, api_fetch_1.apiFetch)(`/api/daemons/${encodeURIComponent(daemonId)}/cli-installers`, { credential: this.resolvedCredential });
-            // Any accepted spelling: a daemon lists the provider the way it registered it,
-            // and during a rename's alias window one that predates or postdates the flip
-            // spells it differently.
-            const row = (res.providers ?? []).find((p) => (0, auth_core_1.isFirstPartyHarnessProvider)(p.provider));
-            const reason = row?.installDisabledReason?.trim();
-            if (!reason)
-                return null;
-            // The version is what turns "Already installed." into something a reader
-            // can act on — it is the difference between reassurance and a shrug.
-            return row?.version ? `${reason} (${row.version})` : reason;
-        }
-        catch {
-            return null;
-        }
-    }
-    /**
-     * Poll the job until it settles, printing each new log line.
-     *
-     * The daemon already writes a progress log — "Fetching the signed release
-     * manifest", "Verified and installed …" — and it is the only account
-     * of a hundred-megabyte download the user is waiting on. Printing only the
-     * lines not yet seen keeps a poll loop from repeating the whole log.
-     */
-    async followJob(daemonId, jobId, quiet) {
-        const deadline = Date.now() + MAX_WAIT_MS;
-        let printed = 0;
-        for (;;) {
-            let res;
-            try {
-                res = await (0, api_fetch_1.apiFetch)(`/api/daemons/${encodeURIComponent(daemonId)}/cli-installers/jobs/${encodeURIComponent(jobId)}`, { credential: this.resolvedCredential });
-            }
-            catch (err) {
-                this.handleApiError(err);
-            }
-            const job = res.job;
-            if (!job) {
-                this.failWithCliError({
-                    message: `The daemon no longer has install job ${jobId}.`,
-                    code: 'JOB_MISSING',
-                    exit: 1,
-                    retryable: false,
-                });
-            }
-            if (!quiet) {
-                for (const line of (job.log ?? []).slice(printed))
-                    this.logToStderr(`  ${line}`);
-                printed = (job.log ?? []).length;
-            }
-            if (job.status === 'succeeded' || job.status === 'failed')
-                return job;
-            if (Date.now() > deadline) {
-                // NOT a failure: the daemon is still working, and saying "install
-                // failed" because this process ran out of patience would be a lie that
-                // sends someone to debug a download that is going fine.
-                this.failWithCliError({
-                    message: `Still installing after ${Math.round(MAX_WAIT_MS / 60000)} minutes — the daemon is ` +
-                        `still working on job ${jobId}. Check \`${this.config.bin} code doctor\` in a while.`,
-                    code: 'INSTALL_PENDING',
-                    exit: 1,
-                    retryable: true,
-                });
+                this.log(JSON.stringify({
+                    component: 'code',
+                    state: 'failed',
+                    error: error instanceof Error ? error.message : String(error),
+                }));
+                process.exitCode = 1;
             }
-            await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
+            else
+                this.error(error instanceof Error ? error : String(error));
         }
     }
 }
 exports.default = CodeInstall;
-/**
- * The daemon's id for skrr's own engine — the CANONICAL spelling, read from the
- * identity module rather than written here. The install route accepts every
- * spelling; canonical is what the platform stores and returns.
- */
-const PROVIDER = auth_core_1.FIRST_PARTY_HARNESS.provider;
-/** A 100 MB download over a hotel connection is the case this has to survive. */
-const MAX_WAIT_MS = 10 * 60_000;
-const POLL_INTERVAL_MS = 2_000;

package/dist/commands/code/jobs/show.js

@@ -52,7 +52,19 @@ class CodeJobsShow extends base_command_1.BaseCommand {
         if (typeof task.costUsd === 'number')
             line('Cost:', `$${task.costUsd.toFixed(2)}`);
         line('PR:', task.prUrl);
+        line('Parent Task:', task.lineage?.taskId);
+        line('Task run:', task.lineage?.taskExecutionRunId);
+        line('Commitment:', task.lineage?.commitmentId);
+        line('Parent run:', task.lineage?.autonomousRunId);
         line('Preview:', task.previewUrl);
+        // Same sentence `machines hosted start` prints, from the snapshot the job
+        // started with, so a declared network is visible on the job it governed.
+        if (task.egressPolicy) {
+            line('Network:', `${task.egressPolicy} (${task.egressSource || 'source unknown'}; ${task.egressAllowHosts?.length || 0} hosts)`);
+        }
+        if (task.egressDroppedHosts?.length) {
+            line('Policy dropped:', task.egressDroppedHosts.join(', '));
+        }
         line('Created:', (0, format_1.localStamp)(task.createdAt));
         const error = task.error;
         if (error?.code || error?.message) {

package/dist/commands/code/rollback.d.ts

@@ -0,0 +1,8 @@
+import { Command } from '@oclif/core';
+export default class CodeRollback extends Command {
+    static description: string;
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/code/rollback.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const auth_core_1 = require("@skrr-ai/auth-core");
+const first_party_harness_update_1 = require("../../lib/first-party-harness-update");
+class CodeRollback extends core_1.Command {
+    static description = `Restore the previous verified local ${auth_core_1.FIRST_PARTY_HARNESS.displayName} release`;
+    static flags = { json: core_1.Flags.boolean({ description: 'Emit the result as JSON' }) };
+    async run() {
+        const { flags } = await this.parse(CodeRollback);
+        const result = (0, first_party_harness_update_1.rollbackLocalCode)();
+        if (flags.json)
+            this.log(JSON.stringify(result, null, 2));
+        else
+            this.log((0, first_party_harness_update_1.formatLocalCodeUpdate)(result));
+        if (result.state === 'failed')
+            process.exitCode = 1;
+    }
+}
+exports.default = CodeRollback;

package/dist/commands/code/update.d.ts

@@ -1,46 +1,17 @@
-import { BaseCommand } from '../../base-command';
-/**
- * `skrr code update` — pull the engine's signed release down through the daemon.
- *
- * ── Why this command exists ────────────────────────────────────────────────
- *
- * The update verb has been API-exposed and daemon-implemented since OSK-10096 —
- * `POST /api/daemons/:id/cli-installers/:provider/update` re-fetches the signed
- * manifest and installs whatever the channel points at. But the only CLI that
- * reached it was `skrr harnesses install <provider> --update`: a flag on a
- * command a `code` user has no reason to read. On stable that left no
- * discoverable path at all — `code install` answered "Already installed." with
- * no next step, and the channel moving past the installed build was invisible
- * from the surface that owns the engine (OSK-10650).
- *
- * So this adds a SURFACE and no mechanism. Same route `harnesses install
- * --update` posts, same inventory pre-check, same 504 recovery — one update
- * path, spelled where the engine's users look.
- */
-export default class CodeUpdate extends BaseCommand {
+import { Command } from '@oclif/core';
+/** The default target is this computer; an explicit daemon keeps the remote API path. */
+export default class CodeUpdate extends Command {
     static description: string;
     static examples: string[];
     static flags: {
         daemon: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         wait: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        check: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'target-version': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'allow-downgrade': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        rollback: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'startup-checks': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
-    /** Which daemon the update targets, by the rule every daemon-picking command shares. */
-    private resolveTarget;
-    /**
-     * The daemon id to update through, or the refusal — identical rules to
-     * `code install`: a Dedicated Runtime's own machine is image-managed, several
-     * connected daemons get named rather than guessed.
-     */
-    private updateTarget;
-    /**
-     * Start the update, and survive a gateway that cut the request off — the same
-     * 504 recovery `harnesses install --update` uses: the relay can drop the
-     * answer while the daemon runs the job it started, so on a server-side
-     * failure we ask the daemon and follow the job it reports.
-     */
-    private start;
-    /** Follow a job to its end, or report why it could not be followed (and return nothing). */
-    private follow;
 }