The agent asks the resolver instead of guessing the package manager

The agent needs ffmpeg. On a laptop it would guess: apt, brew, pip, a Docker image, a Stack Overflow answer from 2019. In the container it asks: GET /api/v1/run/resolve?app=ffmpeg&kind=cli&pick=first.

The resolver searches every enabled source (nixpkgs, pkgx, AppImage, OCI, the manifest registries), ranks the candidates, and returns shell_command: one exact line, plus a candidate_id the agent can pin next time. With pick=ask it gets the ranked list instead, each candidate carrying its own href_path to select it. The service never runs anything; the agent sends the line to its terminal session and runs it there.

No hallucinated package names, no distro detection, no three-attempt install loop burning tokens. The wrong-guess loop is where agent runs go to die, and it is the loop the resolver removes.

Install is a lookup, and the lookup returns a command.