@astrale-os/cli 0.8.1-alpha.6 → 0.8.1-alpha.7

package/dist/types/connection/auth.d.ts

@@ -1,5 +1,7 @@
 import type { AstraleConfig } from '../lib/config';
 import { type Identity } from '../identity/registry';
+import { IdpAudienceMismatchError } from '../lib/idp';
+import { IdpSessionNoRefreshTokenError } from '../lib/idp-session';
 export type KeyIdentityAuthOptions = {
     issuer: string;
     subject?: string;
@@ -23,6 +25,7 @@ export declare function resolveCredential(opts: {
     defaultIdentity?: string;
 }, config: AstraleConfig, audience?: string, registrationKey?: string): Promise<string>;
 export declare function resolveKeyIdentityAuthOptions(identity: Identity, config: AstraleConfig, audience?: string, registrationKey?: string): KeyIdentityAuthOptions;
+export declare function classifyNoRefreshTokenError(requestedAudience: string, sourceAudience: string | undefined, error: IdpSessionNoRefreshTokenError): IdpSessionNoRefreshTokenError | IdpAudienceMismatchError;
 /** A refresh attempt failed for a reason that re-login will NOT fix. */
 export declare class IdpRefreshTransientError extends Error {
     constructor(message: string);

package/dist/types/lib/instance.d.ts

@@ -136,6 +136,10 @@ export type ResolvedInstance = {
     mode?: RegistryMode;
     status?: string;
 };
+export type BookmarkTrustConflict = {
+    readonly name: string;
+    readonly caFile: string | null;
+};
 export declare function sanitizeStore(store: InstanceStore): {
     store: InstanceStore;
     changed: boolean;
@@ -152,6 +156,12 @@ export declare function readInstances(_config?: AstraleConfig, opts?: {
 export declare function writeInstances(store: InstanceStore): Promise<void>;
 export declare function assertNoCollision(store: InstanceStore, identifiers: string[], ignoreKey?: string): void;
 export declare function resolveInstanceKey(store: InstanceStore, identifier: string): string | null;
+/**
+ * Find other bookmarks for the same normalized Kernel URL whose TLS trust
+ * configuration differs. System trust (`undefined`) is a configuration too:
+ * mixing it with a custom CA is exactly as significant as mixing two CA files.
+ */
+export declare function findBookmarkTrustConflicts(store: InstanceStore, name: string, url: string, caFile?: string): BookmarkTrustConflict[];
 export declare function addInstance(key: string, opts?: AddInstanceOpts): Promise<InstanceEntry>;
 export declare function upsertInstance(key: string, opts?: AddInstanceOpts): Promise<{
     entry: InstanceEntry;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/cli",
-  "version": "0.8.1-alpha.6",
+  "version": "0.8.1-alpha.7",
   "description": "Astrale CLI — connect to existing Astrale kernels",
   "keywords": [
     "astrale",
@@ -62,10 +62,10 @@
     "zod": "^3.25.0"
   },
   "devDependencies": {
-    "@astrale-os/kernel-client": "0.6.0-beta.1",
+    "@astrale-os/kernel-client": "0.6.0-beta.3",
     "@astrale-os/ox": ">=0.1.0 <1.0.0",
-    "@astrale-os/sdk": "0.5.0-beta.1",
-    "@astrale-os/shell": "0.3.8-beta.1",
+    "@astrale-os/sdk": "0.5.0-beta.3",
+    "@astrale-os/shell": "0.3.8-beta.2",
     "@astrale/commitlint-config": "npm:@jsr/astrale__commitlint-config@~2.0.1",
     "@commitlint/cli": "~20.3.1",
     "@commitlint/config-conventional": "~20.3.1",
@@ -82,16 +82,16 @@
   "lint-staged": {
     "*.{js,cjs,mjs,ts,tsx}": [
       "oxlint --fix --no-error-on-unmatched-pattern",
-      "oxfmt --write"
+      "oxfmt --write --no-error-on-unmatched-pattern"
     ],
     "*.{json,yml,yaml}": [
-      "oxfmt --write"
+      "oxfmt --write --no-error-on-unmatched-pattern"
     ]
   },
   "devEngines": {
     "runtime": {
       "name": "node",
-      "version": ">=24 <25",
+      "version": ">=24 <25 || >=26 <27",
       "onFail": "error"
     }
   },
@@ -101,7 +101,7 @@
   "scripts": {
     "preinstall": "node .check-workspace.cjs",
     "build": "bun scripts/build.ts",
-    "package:check": "pnpm run typecheck && pnpm run test && pnpm run build && node scripts/verify-public-exports.mjs",
+    "package:check": "pnpm run typecheck && pnpm run test && pnpm run build && node scripts/verify-public-exports.mjs && node scripts/verify-private-ports-boundary.mjs",
     "typecheck": "tsgo --noEmit && tsgo --noEmit -p tsconfig.tests.json && tsgo --noEmit -p viewer && tsgo --noEmit -p studio",
     "lint": "oxlint .",
     "lint:fix": "oxlint --fix .",

package/src/commands/__tests__/domain-uninstall.test.ts

@@ -0,0 +1,53 @@
+import { describe, expect, test } from 'bun:test'
+import { join } from 'node:path'
+
+import { uninstallCallInput } from '../domain/uninstall'
+
+const cliRoot = join(import.meta.dir, '../../..')
+
+describe('domain uninstall', () => {
+  test('sends the public Kernel uninstall request', () => {
+    expect(uninstallCallInput('grc.example', 'op-1')).toEqual({
+      operation: 'op-1',
+      origin: 'grc.example',
+    })
+  })
+
+  test('requires --yes outside a TTY before connecting to a Kernel', async () => {
+    const proc = Bun.spawn({
+      cmd: ['bun', join(cliRoot, 'bin/astrale.ts'), 'domain', 'uninstall', 'grc.example', '--json'],
+      stdout: 'pipe',
+      stderr: 'pipe',
+    })
+    const [stdout, stderr, exitCode] = await Promise.all([
+      new Response(proc.stdout).text(),
+      new Response(proc.stderr).text(),
+      proc.exited,
+    ])
+
+    expect(exitCode).toBe(1)
+    expect(stdout).toBe('')
+    expect(JSON.parse(stderr)).toMatchObject({
+      error: 'CONFIRMATION_REQUIRED',
+      message: 'Uninstalling Domain "grc.example" requires explicit confirmation.',
+    })
+  })
+
+  test('states that uninstall never deletes business data', async () => {
+    const proc = Bun.spawn({
+      cmd: ['bun', join(cliRoot, 'bin/astrale.ts'), 'domain', 'uninstall', '--help'],
+      stdout: 'pipe',
+      stderr: 'pipe',
+    })
+    const [stdout, stderr, exitCode] = await Promise.all([
+      new Response(proc.stdout).text(),
+      new Response(proc.stderr).text(),
+      proc.exited,
+    ])
+
+    expect(exitCode).toBe(0)
+    expect(stderr).toBe('')
+    expect(stdout).toContain('Uninstall never deletes business data.')
+    expect(stdout).toContain('business data still uses its schema')
+  })
+})

package/src/commands/__tests__/install-identity-override.test.ts

@@ -41,16 +41,27 @@ describe('declared-origin probe (/meta)', () => {
     return `http://localhost:${server.port}`
   }
 
-  test('reads domainName from a well-formed /meta', async () => {
+  test('reads origin from a well-formed /meta', async () => {
+    // The exact shape SDK workers serve (adapter-cloudflare worker `/meta`).
     const url = serveMeta((req) =>
       new URL(req.url).pathname === '/meta'
-        ? Response.json({ iss: 'https://x', domainName: 'crm.acme.dev' })
+        ? Response.json({
+            origin: 'crm.acme.dev',
+            issuer: 'https://crm.acme.dev',
+            schemaRevision: 'sha256:abc',
+            deploymentVersion: 'v1',
+          })
         : new Response('nope', { status: 404 }),
     )
     expect(await probeDeclaredOrigin(url)).toBe('crm.acme.dev')
   })
 
-  test('degrades to undefined on missing domainName, non-200, bad JSON, or dead host', async () => {
+  test('falls back to the pre-Kernel-V2 domainName field', async () => {
+    const legacy = serveMeta(() => Response.json({ iss: 'https://x', domainName: 'crm.acme.dev' }))
+    expect(await probeDeclaredOrigin(legacy)).toBe('crm.acme.dev')
+  })
+
+  test('degrades to undefined on missing origin, non-200, bad JSON, or dead host', async () => {
     const noName = serveMeta(() => Response.json({ iss: 'https://x' }))
     expect(await probeDeclaredOrigin(noName)).toBeUndefined()
 

package/src/commands/__tests__/instance-bookmark.test.ts

@@ -72,6 +72,63 @@ describe('instance bookmark command', () => {
     expect(store.instances.testmarc.caFile).toBe('/tmp/ca.pem')
     expect(store.instances.testmarc.createdAt).toBe('2026-06-10T00:00:00.000Z')
   })
+
+  test('warns when another bookmark uses different TLS trust for the same URL', async () => {
+    await writeFile(
+      join(tmp, 'instances.json'),
+      JSON.stringify({
+        active: 'stable',
+        instances: {
+          stable: {
+            url: 'https://local.example/kernel',
+            caFile: '/certs/stable.pem',
+          },
+        },
+      }),
+    )
+
+    const result = await runBookmark(
+      'stale',
+      '--url',
+      'https://local.example/kernel/',
+      '--ca',
+      '/certs/old.pem',
+      '--skip-probe',
+    )
+
+    expect(result.exitCode).toBe(0)
+    expect(result.stderr).toContain('TLS trust differs for the same Kernel URL')
+    expect(result.stderr).toContain('"stable" uses CA /certs/stable.pem')
+  })
+
+  test('active --json exposes the TLS and identity configuration', async () => {
+    await writeFile(
+      join(tmp, 'instances.json'),
+      JSON.stringify({
+        active: 'stable',
+        instances: {
+          stable: {
+            url: 'https://local.example/kernel',
+            issuer: 'https://issuer.example',
+            defaultIdentity: 'marc',
+            caFile: '/certs/stable.pem',
+            createdAt: '2026-08-20T00:00:00.000Z',
+          },
+        },
+      }),
+    )
+
+    const result = await runCli('instance', 'active', '--json')
+    expect(result.exitCode).toBe(0)
+    expect(JSON.parse(result.stdout)).toEqual({
+      name: 'stable',
+      url: 'https://local.example/kernel',
+      issuer: 'https://issuer.example',
+      defaultIdentity: 'marc',
+      caFile: '/certs/stable.pem',
+      createdAt: '2026-08-20T00:00:00.000Z',
+    })
+  })
 })
 
 async function readInstances(): Promise<{
@@ -85,9 +142,17 @@ async function runBookmark(...args: string[]): Promise<{
   exitCode: number
   stdout: string
   stderr: string
+}> {
+  return runCli('instance', 'bookmark', ...args)
+}
+
+async function runCli(...args: string[]): Promise<{
+  exitCode: number
+  stdout: string
+  stderr: string
 }> {
   const proc = Bun.spawn({
-    cmd: ['bun', join(cliRoot, 'bin/astrale.ts'), 'instance', 'bookmark', ...args],
+    cmd: ['bun', join(cliRoot, 'bin/astrale.ts'), ...args],
     env: { ...process.env, ASTRALE_HOME: tmp },
     stdout: 'pipe',
     stderr: 'pipe',

package/src/commands/__tests__/instance-list-rows.test.ts

@@ -15,6 +15,7 @@ function bookmark(overrides: Partial<Bookmark> = {}): Bookmark {
     issuer: null,
     active: false,
     defaultIdentity: null,
+    caFile: null,
     createdAt: null,
     ...overrides,
   }

package/src/commands/__tests__/instance-use.test.ts

@@ -0,0 +1,67 @@
+import { describe, expect, test } from 'bun:test'
+
+import { IssuerUnreachableError } from '../../errors'
+import { InstanceStoreSchema, type ResolvedInstance } from '../../lib/instance'
+import { probeBookmark } from '../instance/use'
+
+const resolved: ResolvedInstance = {
+  name: 'stable',
+  kind: 'bookmark',
+  url: 'https://local.example/kernel',
+  issuer: 'https://issuer.example',
+  caFile: '/certs/stable.pem',
+}
+
+describe('instance use bookmark probe', () => {
+  test('uses the CA stored on the selected bookmark', async () => {
+    const scopedFetch = globalThis.fetch
+
+    await expect(
+      probeBookmark(resolved, {
+        readInstances: async () =>
+          InstanceStoreSchema.parse({
+            active: 'stable',
+            instances: {
+              stable: { url: resolved.url, caFile: resolved.caFile },
+            },
+          }),
+        fetchWithCaFile: (path) => {
+          expect(path).toBe('/certs/stable.pem')
+          return scopedFetch
+        },
+        checkIssuerReachability: async (url, issuer, fetchImpl) => {
+          expect(url).toBe(resolved.url)
+          expect(issuer).toBe(resolved.issuer)
+          expect(fetchImpl).toBe(scopedFetch)
+          return { issuer: resolved.issuer!, keys: [{ kid: 'key-1' }] }
+        },
+      }),
+    ).resolves.toBeUndefined()
+  })
+
+  test('names conflicting bookmark CAs in a failed TLS probe', async () => {
+    const failure = probeBookmark(resolved, {
+      readInstances: async () =>
+        InstanceStoreSchema.parse({
+          active: 'stable',
+          instances: {
+            stable: { url: resolved.url, caFile: resolved.caFile },
+            stale: { url: resolved.url, caFile: '/certs/old.pem' },
+          },
+        }),
+      fetchWithCaFile: () => fetch,
+      checkIssuerReachability: async () => {
+        throw new IssuerUnreachableError(resolved.url, 'certificate verify failed')
+      },
+    })
+
+    await expect(failure).rejects.toMatchObject({
+      code: 'ISSUER_UNREACHABLE',
+      message: `Issuer/JWKS probe failed for bookmark "stable" at ${resolved.url}.`,
+    })
+    await expect(failure).rejects.toHaveProperty(
+      'hint',
+      expect.stringContaining('"stale" (CA /certs/old.pem)'),
+    )
+  })
+})

package/src/commands/__tests__/view-build.test.ts

@@ -0,0 +1,58 @@
+import { afterEach, describe, expect, test } from 'bun:test'
+import { mkdir, mkdtemp, rm, utimes, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+import { devDistIsStale } from '../view'
+
+const temporaryDirectories: string[] = []
+
+afterEach(async () => {
+  await Promise.all(
+    temporaryDirectories.splice(0).map((path) => rm(path, { recursive: true, force: true })),
+  )
+})
+
+describe('view development runtime build', () => {
+  test('reuses a current official build and detects every runtime build input', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'astrale-view-build-'))
+    temporaryDirectories.push(root)
+    const entry = join(root, 'bin', 'astrale.ts')
+    const source = join(root, 'src', 'command.ts')
+    const vendor = join(root, 'vendor', 'dependency.tgz')
+    const buildScript = join(root, 'scripts', 'build.ts')
+    const packageJson = join(root, 'package.json')
+    const lockfile = join(root, 'pnpm-lock.yaml')
+    const dist = join(root, 'dist', 'astrale.js')
+
+    await Promise.all(
+      ['bin', 'src', 'vendor', 'scripts', 'dist'].map((directory) =>
+        mkdir(join(root, directory), { recursive: true }),
+      ),
+    )
+    const inputs = [entry, source, vendor, buildScript, packageJson, lockfile]
+    await Promise.all(inputs.map((file) => writeFile(file, 'input')))
+    await writeFile(dist, 'built')
+    const past = new Date(Date.now() - 2_000)
+    const present = new Date()
+    await Promise.all(inputs.map((file) => utimes(file, past, past)))
+    await utimes(dist, present, present)
+
+    expect(await devDistIsStale(entry, dist)).toBe(false)
+
+    for (const input of inputs) {
+      await utimes(input, new Date(Date.now() + 2_000), new Date(Date.now() + 2_000))
+      expect(await devDistIsStale(entry, dist)).toBe(true)
+      await utimes(input, past, past)
+    }
+  })
+
+  test('requires a build when dist/astrale.js is missing', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'astrale-view-build-missing-'))
+    temporaryDirectories.push(root)
+
+    expect(
+      await devDistIsStale(join(root, 'bin', 'astrale.ts'), join(root, 'dist', 'astrale.js')),
+    ).toBe(true)
+  })
+})

package/src/commands/domain/install.ts

@@ -415,7 +415,7 @@ export function isIdentityOverride(origin: string, host: string): boolean {
  * Claiming an origin that differs from the serving host is an explicit actAs
  * and needs typed consent (or `--allow-identity-override` in scripts).
  *
- * The pre-install check reads the worker's self-reported `/meta.domainName`,
+ * The pre-install check reads the worker's self-reported `/meta.origin`,
  * so it is consent UX, not enforcement — a hostile worker can lie here, and
  * the kernel anchors the cryptographic identity (`iss`) on the real URL
  * regardless. When `/meta` is unreachable or silent on the origin, the gate
@@ -476,10 +476,11 @@ export async function probeDeclaredOrigin(url: string): Promise<string | undefin
   try {
     const res = await fetch(new URL('/meta', url), { signal: AbortSignal.timeout(10_000) })
     if (!res.ok) return undefined
-    const body = (await res.json()) as { domainName?: unknown }
-    return typeof body.domainName === 'string' && body.domainName.length > 0
-      ? body.domainName
-      : undefined
+    // SDK workers serve `origin`; `domainName` is the pre-Kernel-V2 name, kept
+    // as a fallback for workers deployed before the rename.
+    const body = (await res.json()) as { origin?: unknown; domainName?: unknown }
+    const declared = body.origin ?? body.domainName
+    return typeof declared === 'string' && declared.length > 0 ? declared : undefined
   } catch {
     // Unreachable /meta is not fatal here: the caller warns and the install
     // itself will surface a dead worker with its own error.

package/src/commands/domain/uninstall.ts

@@ -0,0 +1,128 @@
+import { Path } from '@astrale-os/sdk/graph/path'
+import { syscalls } from '@astrale-os/sdk/schema/kernel'
+import chalk from 'chalk'
+
+import type { KernelCommandOpts } from '../../connection'
+import type { CommandDefinition } from '../../program/index'
+
+import { createPathCall, runKernelCommand } from '../../connection'
+import { AstraleError } from '../../errors'
+import { fatal, log } from '../../lib/log'
+import { output } from '../../lib/output'
+import { confirmWithInput } from '../../lib/prompt'
+
+type UninstallOpts = KernelCommandOpts & {
+  readonly yes?: boolean
+  readonly ci?: boolean
+  readonly noPrompt?: boolean
+}
+
+type UninstallResult = {
+  readonly operation: string
+  readonly transition: {
+    readonly intent: {
+      readonly origin: string
+    }
+  }
+}
+
+/** Public Kernel uninstall syscall input for one installed Domain origin. */
+export function uninstallCallInput(
+  origin: string,
+  operation: string = crypto.randomUUID(),
+): Readonly<{ operation: string; origin: string }> {
+  return Object.freeze({ operation, origin })
+}
+
+export default {
+  name: 'uninstall',
+  description: 'Uninstall a domain from an instance through the public Kernel syscall',
+  afterHelpText: `
+Behavior:
+  Removes one installed Domain origin from the target instance. The Kernel
+  refuses the operation while another installed Domain depends on it or while
+  business data still uses its schema. Uninstall never deletes business data.
+  Type the exact origin to confirm, or pass --yes in automation.
+
+  Use this before reinstalling only when an immutable Domain property (such as
+  its issuer) intentionally changed. Ordinary compatible upgrades should use
+  domain install directly and preserve the existing Domain identity.
+
+Examples:
+  $ astrale domain uninstall grc.example -i staging
+  $ astrale domain uninstall grc.example -i staging --yes --json
+`,
+  arguments: [
+    {
+      name: 'origin',
+      description: 'Installed Domain origin to remove',
+      required: true,
+    },
+  ],
+  options: [
+    {
+      flags: '--yes',
+      description: 'Confirm Domain uninstall without prompting',
+    },
+  ],
+  action: async (origin: string, opts: UninstallOpts) => {
+    try {
+      await confirmUninstall(origin, opts)
+    } catch (error) {
+      fatal(error, opts)
+    }
+
+    await runKernelCommand<UninstallResult>({
+      opts,
+      label: `Uninstalling domain ${origin}`,
+      fn: async ({ session }) =>
+        (await session.call(
+          createPathCall(Path.project(syscalls.uninstall.ref).raw, uninstallCallInput(origin)),
+        )) as UninstallResult,
+      format: (result, formatOpts, machine) => {
+        if (machine) {
+          output(result, formatOpts)
+          return
+        }
+        log.success(`Domain uninstalled: ${result.transition.intent.origin}`)
+        log.dim(`  operation: ${result.operation}`)
+      },
+    })
+  },
+} satisfies CommandDefinition
+
+async function confirmUninstall(origin: string, opts: UninstallOpts): Promise<void> {
+  if (opts.yes) return
+
+  const nonInteractive =
+    opts.ci ||
+    opts.noPrompt ||
+    process.env.CI ||
+    process.argv.includes('--ci') ||
+    process.argv.includes('--no-prompt') ||
+    !process.stdin.isTTY
+  if (nonInteractive) {
+    throw new AstraleError(
+      'CONFIRMATION_REQUIRED',
+      `Uninstalling Domain "${origin}" requires explicit confirmation.`,
+      `Re-run with --yes: astrale domain uninstall ${origin} --yes`,
+    )
+  }
+
+  const warning =
+    chalk.red.bold('⚠  DANGER — DOMAIN UNINSTALL') +
+    '\n' +
+    chalk.dim('│') +
+    `  origin     ${chalk.bold(origin)}\n` +
+    chalk.dim('│') +
+    '\n' +
+    chalk.dim('│') +
+    '  This removes the installed Domain from the target instance.\n' +
+    chalk.dim('│') +
+    '  This command never deletes business data.\n' +
+    chalk.dim('│') +
+    '  The Kernel refuses removal while dependents or business data remain.'
+  if (!(await confirmWithInput(warning, origin))) {
+    throw new AstraleError('UNINSTALL_CANCELLED', `Domain uninstall cancelled for "${origin}".`)
+  }
+}

package/src/commands/instance/active.ts

@@ -19,13 +19,19 @@ export default {
       const { name } = active
       const url = active.url ?? null
       const createdAt = active.createdAt ?? null
+      const issuer = active.issuer ?? null
+      const defaultIdentity = active.defaultIdentity ?? null
+      const caFile = active.caFile ?? null
 
       if (isRaw) {
-        output({ name, url, createdAt }, opts)
+        output({ name, url, issuer, defaultIdentity, caFile, createdAt }, opts)
         return
       }
 
       console.log(`${chalk.bold(name)} (${url ?? 'local'})`)
+      if (issuer && issuer !== url) log.dim(`  issuer:   ${issuer}`)
+      if (defaultIdentity) log.dim(`  identity: ${defaultIdentity}`)
+      if (caFile) log.dim(`  ca:       ${caFile}`)
     } catch (e) {
       log.error(e instanceof Error ? e.message : String(e))
       process.exit(1)
@@ -36,6 +42,9 @@ export default {
 async function resolveActiveForDisplay(): Promise<{
   name: string
   url?: string
+  issuer?: string
+  defaultIdentity?: string
+  caFile?: string
   createdAt?: string
 }> {
   const active = await getActive()
@@ -43,6 +52,9 @@ async function resolveActiveForDisplay(): Promise<{
     return {
       name: active.name,
       url: active.url,
+      issuer: active.issuer,
+      defaultIdentity: active.defaultIdentity,
+      caFile: active.caFile,
       createdAt: active.createdAt,
     }
   }

package/src/commands/instance/bookmark.ts

@@ -1,7 +1,13 @@
 import type { CommandDefinition } from '../../program/index'
 
 import { fetchWithCaFile } from '../../lib/ca-fetch'
-import { normalizeInstanceKernelUrl, setActive, upsertInstance } from '../../lib/instance'
+import {
+  findBookmarkTrustConflicts,
+  normalizeInstanceKernelUrl,
+  readInstances,
+  setActive,
+  upsertInstance,
+} from '../../lib/instance'
 import { fatal, log } from '../../lib/log'
 import { checkIssuerReachability } from '../../lib/meta'
 
@@ -39,14 +45,27 @@ export default {
     try {
       if (!opts.url) fatal(new Error('Missing required flag: --url <url>'))
       const url = normalizeInstanceKernelUrl(opts.url)
-      const expectedIssuer = opts.issuer ? normalizeInstanceKernelUrl(opts.issuer) : undefined
+      const store = await readInstances()
+      const expectedIssuer = opts.issuer
+        ? normalizeInstanceKernelUrl(opts.issuer)
+        : store.instances[name]?.issuer
+      const effectiveCa = opts.ca ?? store.instances[name]?.caFile
+      const trustConflicts = findBookmarkTrustConflicts(store, name, url, effectiveCa)
+      if (trustConflicts.length > 0) {
+        log.warn(
+          `TLS trust differs for the same Kernel URL ${url}: ` +
+            `"${name}" uses ${describeCa(effectiveCa)}, while ${trustConflicts
+              .map((conflict) => `"${conflict.name}" uses ${describeCa(conflict.caFile)}`)
+              .join(', ')}. Remove or update stale bookmarks to avoid certificate surprises.`,
+        )
+      }
 
       if (!opts.skipProbe) {
         try {
           const { issuer, keys } = await checkIssuerReachability(
             url,
             expectedIssuer,
-            opts.ca ? fetchWithCaFile(opts.ca) : undefined,
+            effectiveCa ? fetchWithCaFile(effectiveCa) : undefined,
           )
           log.dim(`  iss=${issuer} keys=${keys.length}`)
         } catch (e) {
@@ -76,3 +95,7 @@ export default {
     }
   },
 } satisfies CommandDefinition
+
+function describeCa(caFile: string | null | undefined): string {
+  return caFile ? `CA ${caFile}` : 'the system trust store'
+}