@skrr-ai/cli 0.1.10 → 0.1.11

package/dist/lib/command-miss.js

@@ -0,0 +1,128 @@
+"use strict";
+/**
+ * What to say when a command id does not resolve — ONE description, shared by
+ * every surface that can produce a miss.
+ *
+ * There are two such surfaces, and they used to disagree. `skrr daemon reload`
+ * goes through the `command_not_found` hook and gets a message naming the real
+ * command, the mistake, and the next step. `skrr daemon reload --help` goes
+ * through oclif's HELP command, which does its own lookup and never reaches
+ * that hook — so it answered `Command daemon:reload not found.`: raw
+ * boilerplate naming an internal colon-form id the user never typed and cannot
+ * type, with no route forward.
+ *
+ * The audience is what makes that the wrong way round. Someone exploring a
+ * service-manager CLI types `--help` on a guessed subcommand FIRST. So the
+ * readers most likely to hit a miss were exactly the readers the good message
+ * was written for, and they systematically got the bad one.
+ *
+ * Keeping the text here rather than in either caller is the point: a fix to one
+ * phrasing reaches both, and neither surface can quietly drift from the other.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.editDistance = editDistance;
+exports.nearestCommands = nearestCommands;
+exports.describeCommandMiss = describeCommandMiss;
+exports.lookupFromConfig = lookupFromConfig;
+/** A uuid-ish token, which is what a stray space id looks like. */
+const LOOKS_LIKE_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** Cheap edit distance, bounded — this runs only on a miss. */
+function editDistance(a, b) {
+    const rows = a.length + 1;
+    const cols = b.length + 1;
+    let prev = Array.from({ length: cols }, (_, j) => j);
+    for (let i = 1; i < rows; i += 1) {
+        const cur = [i, ...Array(cols - 1).fill(0)];
+        for (let j = 1; j < cols; j += 1) {
+            cur[j] = Math.min(prev[j] + 1, cur[j - 1] + 1, prev[j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1));
+        }
+        prev = cur;
+    }
+    return prev[cols - 1];
+}
+/**
+ * The closest real command ids, so a typo gets a route forward rather than
+ * only a verdict.
+ */
+function nearestCommands(id, all, limit = 3) {
+    // Deduped, because oclif registers a TOPIC for a command path as well as the
+    // command itself — `daemon:status` is in `commandIDs` and in `topics`, so the
+    // combined candidate list held it twice and a near-miss was answered with
+    // "Did you mean: `skrr daemon status`, `skrr daemon status`, …?", spending
+    // two of the three suggestion slots saying one thing.
+    return ([...new Set(all)]
+        .map((candidate) => ({ candidate, d: editDistance(id, candidate) }))
+        // A third of the length keeps this to genuine near-misses; without a bound
+        // every miss suggests three unrelated commands, which is noise wearing the
+        // shape of help.
+        .filter(({ d }) => d <= Math.max(2, Math.floor(id.length / 3)))
+        .sort((x, y) => x.d - y.d)
+        .slice(0, limit)
+        .map(({ candidate }) => candidate));
+}
+/**
+ * The message for a colon-joined id that did not resolve.
+ *
+ * Two shapes, in order:
+ *
+ *  1. A PREFIX of the id is a real command, so the extra tokens are arguments
+ *     it did not want. Longest prefix first, because `a:b:c` should report
+ *     `a b`, not `a`.
+ *  2. Nothing resolved, so the command genuinely is not there — say so, and
+ *     suggest the nearest siblings under the same topic before falling back to
+ *     the whole command list.
+ */
+function describeCommandMiss(config, id) {
+    const parts = String(id ?? '')
+        .split(':')
+        .filter(Boolean);
+    for (let take = parts.length - 1; take >= 1; take -= 1) {
+        const found = config.findCommand(parts.slice(0, take).join(':'));
+        if (!found)
+            continue;
+        const extras = parts.slice(take);
+        const spoken = `${config.bin} ${parts.slice(0, take).join(' ')}`;
+        // Suggest the flag only when the command actually has it, so the hint can
+        // never point at something that does not exist.
+        const flags = Object.keys(found.flags ?? {});
+        const hint = extras.some((e) => LOOKS_LIKE_ID.test(e)) && flags.includes('space')
+            ? ` Pass it as \`--space ${extras[0]}\`.`
+            : flags.includes('space')
+                ? ' It takes `--space <id>`.'
+                : '';
+        const plural = extras.length === 1 ? 'argument' : 'arguments';
+        return (`\`${spoken}\` exists, but does not take the positional ${plural} ` +
+            `${extras.map((e) => `\`${e}\``).join(' ')}.${hint}\n` +
+            `See \`${spoken} --help\`.`);
+    }
+    // Topic names are candidates too, so a near-miss on a bare topic gets routed
+    // to the topic rather than nothing (OSK-4869): `skrr harness` (singular) is
+    // one edit from the `harnesses` topic, but that topic owns no command whose
+    // id is close to `harness`, so a command-id-only search suggests nothing.
+    //
+    // Siblings first: `commitments:archive:<id>` is a long way from every real
+    // command id, so a whole-string comparison finds nothing and the reader is
+    // told only that they are wrong — when the useful answer is "that topic
+    // exists and here is what it does have".
+    const siblings = config.commandIDs.filter((c) => c.startsWith(`${parts[0]}:`));
+    const suggestions = siblings.length
+        ? nearestCommands(parts.slice(0, 2).join(':'), siblings)
+        : nearestCommands(parts.join(':'), [...config.commandIDs, ...config.topicNames]);
+    return (`\`${config.bin} ${parts.join(' ')}\` is not a command.` +
+        (suggestions.length
+            ? `\nDid you mean: ${suggestions
+                .map((s) => `\`${config.bin} ${s.split(':').join(' ')}\``)
+                .join(', ')}?`
+            : `\nRun \`${config.bin} --help\` to see the topics.`));
+}
+/** Adapt an oclif `Config` to the lookup shape above. */
+function lookupFromConfig(config) {
+    return {
+        bin: config.bin,
+        findCommand: (id) => config.findCommand(id),
+        commandIDs: config.commandIDs.map((c) => String(c)),
+        topicNames: Array.isArray(config.topics)
+            ? config.topics.map((t) => String(t?.name ?? '')).filter(Boolean)
+            : [],
+    };
+}

package/dist/lib/commitment-analytics.d.ts

@@ -22,10 +22,18 @@ export declare const ANALYTICS_REPORTS: {
         readonly path: "/api/commitment-analytics/distribution";
         readonly summary: "How commitments are spread across agents, tiers and cadences";
     };
+    readonly 'distribution-tripwire': {
+        readonly path: "/api/commitment-analytics/distribution/tripwire";
+        readonly summary: "Persistent weekly confirmation of portfolio overload risk";
+    };
     readonly 'attention-budget': {
         readonly path: "/api/commitment-analytics/attention-budget";
         readonly summary: "How much user attention the fleet is actually spending";
     };
+    readonly 'decision-inbox': {
+        readonly path: "/api/commitment-analytics/decision-inbox";
+        readonly summary: "One ranked owner inbox across approvals, blockers, attention and held surfaces";
+    };
     readonly 'action-adapters-audit': {
         readonly path: "/api/commitment-analytics/action-adapters/audit";
         readonly summary: "Which action adapters are installed and what they are permitted to do";
@@ -54,7 +62,9 @@ export declare const commitmentAnalyticsApi: {
     operationsQueue: (query?: Query) => Promise<Record<string, unknown>>;
     governanceExceptions: (query?: Query) => Promise<Record<string, unknown>>;
     distribution: (query?: Query) => Promise<Record<string, unknown>>;
+    distributionTripwire: (query?: Query) => Promise<Record<string, unknown>>;
     attentionBudget: (query?: Query) => Promise<Record<string, unknown>>;
+    decisionInbox: () => Promise<Record<string, unknown>>;
     actionAdapterAudit: () => Promise<Record<string, unknown>>;
     recoveryMetrics: (query?: Query) => Promise<Record<string, unknown>>;
     recovery: (query?: Query) => Promise<Record<string, unknown>>;

package/dist/lib/commitment-analytics.js

@@ -41,10 +41,18 @@ exports.ANALYTICS_REPORTS = {
         path: `${MOUNT}/distribution`,
         summary: 'How commitments are spread across agents, tiers and cadences',
     },
+    'distribution-tripwire': {
+        path: `${MOUNT}/distribution/tripwire`,
+        summary: 'Persistent weekly confirmation of portfolio overload risk',
+    },
     'attention-budget': {
         path: `${MOUNT}/attention-budget`,
         summary: 'How much user attention the fleet is actually spending',
     },
+    'decision-inbox': {
+        path: `${MOUNT}/decision-inbox`,
+        summary: 'One ranked owner inbox across approvals, blockers, attention and held surfaces',
+    },
     'action-adapters-audit': {
         path: `${MOUNT}/action-adapters/audit`,
         summary: 'Which action adapters are installed and what they are permitted to do',
@@ -72,7 +80,9 @@ exports.commitmentAnalyticsApi = {
     operationsQueue: (query = {}) => data_provider_1.request.get((0, triggers_1.withQuery)(`${MOUNT}/operations/queue`, query)),
     governanceExceptions: (query = {}) => data_provider_1.request.get((0, triggers_1.withQuery)(`${MOUNT}/governance/exceptions`, query)),
     distribution: (query = {}) => data_provider_1.request.get((0, triggers_1.withQuery)(`${MOUNT}/distribution`, query)),
+    distributionTripwire: (query = {}) => data_provider_1.request.get((0, triggers_1.withQuery)(`${MOUNT}/distribution/tripwire`, query)),
     attentionBudget: (query = {}) => data_provider_1.request.get((0, triggers_1.withQuery)(`${MOUNT}/attention-budget`, query)),
+    decisionInbox: () => data_provider_1.request.get(`${MOUNT}/decision-inbox`),
     actionAdapterAudit: () => data_provider_1.request.get(`${MOUNT}/action-adapters/audit`),
     recoveryMetrics: (query = {}) => data_provider_1.request.get((0, triggers_1.withQuery)(`${MOUNT}/recovery-metrics`, query)),
     recovery: (query = {}) => data_provider_1.request.get((0, triggers_1.withQuery)(`${MOUNT}/recovery`, query)),

package/dist/lib/config.js

@@ -51,6 +51,7 @@ const fs = __importStar(require("node:fs"));
 const os = __importStar(require("node:os"));
 const path = __importStar(require("node:path"));
 const keychain_1 = require("./keychain");
+const auth_core_1 = require("@skrr-ai/auth-core");
 const publicEndpoints_generated_1 = require("./publicEndpoints.generated");
 // Both from config/public-endpoints.json, the one domain contract, rather than a
 // fourth hand-copied pair. The CLI previously knew only about dev — there was no
@@ -256,8 +257,11 @@ function isEnvAuthOverride() {
  * resolver and every existing install read it.
  */
 function configRoot(env = process.env) {
-    const root = (env.SKRR_CONFIG_DIR || env.OVERSKY_CONFIG_DIR)?.trim();
-    return root || path.join(os.homedir(), '.skrr');
+    // Delegates. The variable list lives in ONE place (`@skrr-ai/auth-core`)
+    // because every copy of it became a place `skrr` and `skrrd` could disagree —
+    // twice in one day, each time as a correct local fix that created the next
+    // defect. `scripts/config-root-single-source.spec` fails if this is re-derived.
+    return (0, auth_core_1.resolveConfigRoot)(env);
 }
 function newConfigDir() {
     return configRoot();

package/dist/lib/daemonBroker.d.ts

@@ -80,6 +80,12 @@ export interface DaemonBrokerResult {
     cliId: string;
     userId: string;
     email: string | null;
+    /**
+     * The refresh family this credential belongs to, named so the caller can
+     * retire its predecessors AFTER persisting it. Absent on servers that predate
+     * the mint/confirm split, where the mint still revoked eagerly.
+     */
+    familyId?: string;
 }
 /**
  * Explicit reasons the broker path could fail. These exist to keep the
@@ -87,7 +93,7 @@ export interface DaemonBrokerResult {
  * fall through to PKCE; `ci_token_refused` is the one we surface
  * because re-driving it via PKCE would not change the outcome.
  */
-export type DaemonBrokerErrorReason = 'no_bootstrap' | 'stale_bootstrap' | 'bootstrap_parse' | 'base_url_mismatch' | 'daemon_not_authed' | 'ci_token_refused' | 'server_error' | 'network' | 'timeout' | 'unknown';
+export type DaemonBrokerErrorReason = 'no_bootstrap' | 'stale_bootstrap' | 'bootstrap_parse' | 'base_url_mismatch' | 'daemon_not_authed' | 'ci_token_refused' | 'rate_limited' | 'server_error' | 'network' | 'timeout' | 'unknown';
 export interface DaemonBrokerFailure {
     ok: false;
     reason: DaemonBrokerErrorReason;

package/dist/lib/daemonBroker.js

@@ -351,6 +351,22 @@ async function attemptDaemonBrokerLogin(opts) {
         if (response.status === 503 && code === 'DAEMON_NOT_AUTHED') {
             return { ok: false, reason: 'daemon_not_authed', detail: message, status: 503, code };
         }
+        // 429 is TRANSIENT and its remedy is time, which makes it the one failure
+        // here that a fall-through cannot substitute for. Left in the `unknown`
+        // bucket it fell silently through to PKCE, and in a non-interactive shell
+        // that surfaced as "skrr login requires an interactive terminal" — a
+        // sentence about the wrong thing entirely. Reachable in the ordinary way: a
+        // cold machine running several skrr commands at once has every process
+        // brokering, because none of them has a token yet.
+        if (response.status === 429) {
+            return {
+                ok: false,
+                reason: 'rate_limited',
+                detail: message,
+                status: 429,
+                ...(code ? { code } : {}),
+            };
+        }
         if (response.status === 400 && code === 'BASE_URL_MISMATCH') {
             // Older daemon binary that lacked the bootstrap.serverUrl field
             // ended up here despite the CLI sending baseURL. Treat as the
@@ -397,8 +413,52 @@ async function attemptDaemonBrokerLogin(opts) {
         cliId: parsedBody.cliId,
         userId: parsedBody.userId,
         email: parsedBody.email ?? null,
+        ...(typeof parsedBody.familyId === 'string' ? { familyId: parsedBody.familyId } : {}),
     };
 }
+/** Bound the confirm so a slow server cannot stall a login that already worked. */
+const CONFIRM_TIMEOUT_MS = 10_000;
+/**
+ * Retire the cli credentials this one replaces — after it is on disk, never
+ * before.
+ *
+ * The mint deliberately no longer does this. Between the server's response and
+ * the credential being usable there are two more hops (the daemon's loopback
+ * broker forwarding the body, this process writing it to the keychain), and a
+ * failure at either one used to leave the user with no working cli credential at
+ * all, recoverable only by a full browser login.
+ *
+ * Called with the NEW access token explicitly rather than through the shared
+ * client. That is the point rather than a detail: the route refuses unless the
+ * bearer's own `did` claim is the cliId being swept, so this call is not a claim
+ * that the delivery happened — it is a demonstration that it did.
+ *
+ * Best-effort and silent. The credential is already persisted and working by the
+ * time this runs; a failure leaves one extra live family, which the server's
+ * session cap bounds and the next confirm sweeps.
+ */
+async function confirmCliHandoff(opts) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), CONFIRM_TIMEOUT_MS);
+    try {
+        await fetch(`${opts.serverOrigin}/api/daemons/cli-handoff/confirm`, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${opts.accessToken}`,
+                'Content-Type': 'application/json',
+                Accept: 'application/json',
+            },
+            body: JSON.stringify({ cliId: opts.cliId, familyId: opts.familyId }),
+            signal: controller.signal,
+        });
+    }
+    catch {
+        /* bookkeeping — the credential is already delivered */
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
 /**
  * Helper: coerce an ISO-string or numeric expiry to epoch ms for
  * `writeToBackend`. Returns undefined on missing / unparseable input.
@@ -436,6 +496,17 @@ async function attemptDaemonBrokerLoginAndPersist(opts) {
             ? { refreshExpiresAt: expiryToEpochMs(outcome.refreshExpiresAt) }
             : {}),
     }, { serverOrigin, clearReauth: true });
+    // Only now: the credential is on disk, so "the predecessor dies iff the
+    // replacement is in place" holds. A server that predates the split ships no
+    // `familyId` and has already revoked eagerly — nothing to do there.
+    if (outcome.familyId) {
+        await confirmCliHandoff({
+            serverOrigin,
+            accessToken: outcome.accessToken,
+            cliId: outcome.cliId,
+            familyId: outcome.familyId,
+        });
+    }
     return outcome;
 }
 // ---------------------------------------------------------------------

package/dist/lib/daemonHandoff.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Hand the local daemon a credential of its own, right after `skrr login`.
+ *
+ * The inverse of the daemon-as-broker path that already ships. That one lets an
+ * authenticated DAEMON mint a cli-scope credential so the CLI can skip the
+ * browser; this lets an authenticated HUMAN mint a daemon-scope one so the
+ * machine is logged in by the same act. The direction added here is the safer of
+ * the two: daemon scope is deliberately lower-privileged than cli scope
+ * (`requireHumanScope` refuses it from billing, account management, password
+ * change and deletion), so this is a de-escalation, while the shipping direction
+ * is an escalation.
+ *
+ * Design record: docs/architecture/machine-login-broker-inversion-2026-09-03.md
+ *
+ * Three properties are deliberate:
+ *
+ *   - **Best-effort, never fatal.** `skrr login` has already SUCCEEDED by the time
+ *     this runs. A failure here must not fail the login or discard the credential
+ *     the user just earned — it degrades to exactly the old behaviour, with a hint.
+ *   - **Skipped when no daemon service is installed.** There is nothing to hand a
+ *     credential to, and minting one anyway leaves an orphaned daemon-scope family
+ *     on the account. A binary on PATH is not a service, so this is decided by the
+ *     daemon's own answer about where its id came from — not by whether `skrrd`
+ *     exists.
+ *   - **The bundle goes over STDIN**, never a file. It is a live credential; a temp
+ *     file would put it at rest with a lifetime nobody owns.
+ *   - **The predecessor is retired only after the new credential is written.** The
+ *     mint no longer revokes anything; `confirmDaemonHandoff` does, once the daemon
+ *     has accepted. So a handoff that fails leaves the machine exactly as it was,
+ *     rather than signed out.
+ */
+export interface DaemonHandoffOutcome {
+    status: 'delivered' | 'skipped' | 'failed';
+    detail: string;
+}
+export declare function handOffToLocalDaemon(env?: NodeJS.ProcessEnv, opts?: {
+    loginFlow?: string;
+}): Promise<DaemonHandoffOutcome>;

package/dist/lib/daemonHandoff.js

@@ -0,0 +1,297 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handOffToLocalDaemon = handOffToLocalDaemon;
+const node_child_process_1 = require("node:child_process");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const config_1 = require("./config");
+const exec_oversky_1 = require("./exec-oversky");
+const keychain_1 = require("./keychain");
+/**
+ * Ceilings, not expectations. Both calls finish in milliseconds when anything is
+ * working; these exist so that when something is NOT working the login ends.
+ *
+ * The failure this prevents is the worst one available here: `skrr login` has
+ * already printed "Login successful", and an unbounded wait on a child process
+ * leaves the user staring at a terminal that will never return, with no way to
+ * tell a hung handoff from a slow one. A blocked keychain prompt, a daemon
+ * binary wedged on a lock, an NFS home directory — none of them are exotic, and
+ * all of them used to hang the command.
+ *
+ * The accept side gets the longer budget because it may have to unlock a
+ * keychain. Killing it mid-write is the cost, and it is the lesser one: the
+ * credential write is a few milliseconds at the end of that window, so a timeout
+ * overwhelmingly lands BEFORE it rather than during it, and `skrr daemon login`
+ * recovers either way.
+ */
+const PROBE_TIMEOUT_MS = 15_000;
+const ACCEPT_TIMEOUT_MS = 60_000;
+function runOversky(binary, args, opts) {
+    const { input, timeoutMs } = opts;
+    return new Promise((resolve) => {
+        // A Windows npm-global install ships a `.cmd` shim, which `spawn` cannot
+        // execute without a shell — Node fires ENOENT instead. `execOversky` has
+        // handled this since it was written; this function did not, so the handoff
+        // failed on EVERY Windows login and reported it as the daemon refusing the
+        // bundle. Restricted to the shim case so real binaries keep the argv-array
+        // exec path, which needs no quoting rules to be right.
+        const isWinShim = process.platform === 'win32' && /\.(cmd|bat)$/i.test(binary);
+        const child = (0, node_child_process_1.spawn)(binary, args, {
+            // stderr is CAPTURED, not discarded. Discarding it cost a debugging cycle
+            // on the first real run: the daemon exited non-zero with
+            // `OVERSKY_KEK_REQUIRED`, and all the user saw was "the daemon refused the
+            // handoff" — an outcome with its reason thrown away. A wrapper that hides
+            // the wrapped program's error is worse than one that does not wrap.
+            stdio: [input === undefined ? 'ignore' : 'pipe', 'pipe', 'pipe'],
+            ...(isWinShim ? { shell: true } : {}),
+        });
+        let stdout = '';
+        let stderr = '';
+        let settled = false;
+        const settle = (value) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            resolve(value);
+        };
+        const timer = setTimeout(() => {
+            child.kill('SIGKILL');
+            settle({
+                ok: false,
+                stdout,
+                stderr: `timed out after ${Math.round(timeoutMs / 1000)}s`,
+            });
+        }, timeoutMs);
+        // Never hold the event loop open on the timer alone.
+        if (typeof timer.unref === 'function')
+            timer.unref();
+        child.stdout?.on('data', (c) => (stdout += String(c)));
+        child.stderr?.on('data', (c) => (stderr += String(c)));
+        child.on('error', (err) => settle({ ok: false, stdout, stderr: err.message }));
+        child.on('close', (code) => settle({ ok: code === 0, stdout, stderr }));
+        if (input !== undefined) {
+            // An EPIPE here is the child having already exited — its own exit code and
+            // stderr are the real diagnosis, and an unhandled stream error would
+            // instead crash the CLI one line after a successful login.
+            child.stdin?.on('error', () => {
+                /* reported by the close handler */
+            });
+            child.stdin?.end(input);
+        }
+    });
+}
+/**
+ * The profile flags to pass to `skrrd`, so both spawns land in the same tenancy
+ * the CLI is signed in to.
+ *
+ * A profile is the daemon's tenancy boundary — separate config, state, keychain
+ * namespace and service label. The CLI resolves its own; the daemon resolves its
+ * own, from `--profile` → `OVERSKY_PROFILE` → its `profile.lock` → `default`.
+ * Passing nothing let those two answers differ, and the failure was silent in the
+ * damaging direction: `skrr --profile work login` would mint against the id
+ * printed by whichever profile the daemon's lock happened to name, then write a
+ * work-profile credential over THAT profile's store.
+ *
+ * `skrr daemon login` already binds the profile this way (`bindToCliSession`);
+ * this is the same rule for the path that runs without being asked.
+ */
+function profileArgs() {
+    const profile = (0, keychain_1.getActiveProfile)();
+    return profile && profile !== keychain_1.DEFAULT_PROFILE ? ['--profile', profile] : [];
+}
+/**
+ * Parse the machine-readable line `accept-handoff --print-id` writes to stderr.
+ *
+ * Absent on a daemon that predates it, which is a normal state during a rollout
+ * and not an error — the caller degrades to the older, less careful behaviour
+ * rather than refusing.
+ */
+function parseIdProvenance(stderr) {
+    const line = stderr.split('\n').find((l) => l.includes('skrrd:accept-handoff'));
+    if (!line)
+        return {};
+    const idSource = /id-source=([A-Za-z0-9._:-]+)/.exec(line)?.[1];
+    const machineUuid = /machine-uuid=([A-Za-z0-9._:-]+)/.exec(line)?.[1];
+    // Any non-space run: this one is a URL, and a URL contains characters the
+    // other two never do.
+    const daemonServer = /server=(\S+)/.exec(line)?.[1];
+    return { idSource, machineUuid, daemonServer };
+}
+/**
+ * What actually changed on this machine, said out loud.
+ *
+ * A handoff can re-point the machine to a different ACCOUNT (you signed in as
+ * someone else) or a different DEPLOYMENT (your daemon was on dev, your CLI is
+ * on prod). Both are the feature working — the machine follows the human, and
+ * moving a dev-bound daemon to prod is the exact story this path was written for
+ * — and both are state changes an operator should watch happen rather than
+ * discover later, when a daemon they thought was on dev answers from prod.
+ *
+ * Degrades cleanly: an older server sends no account, an older daemon reports no
+ * server, and the sentence simply says less rather than guessing.
+ */
+function describeDelivery(opts) {
+    const parts = [];
+    parts.push(opts.accountLabel
+        ? `now signed in as ${opts.accountLabel} on ${(0, config_1.describeDeployment)(opts.cliBaseURL)}`
+        : 'the local daemon now has its own credential');
+    if (opts.daemonServer &&
+        canonicalServer(opts.daemonServer) !== canonicalServer(opts.cliBaseURL)) {
+        parts.push(`moved from ${(0, config_1.describeDeployment)(opts.daemonServer)}`);
+    }
+    return parts.join(', ');
+}
+/**
+ * Compare deployments, not spellings.
+ *
+ * `https://oversky.ai` and `https://skrr.ai` are one deployment under two names,
+ * and the first is still what every daemon installed before the cutover carries.
+ * Trimming and lowercasing alone would report a move on every login from every
+ * one of those machines — a warning that is wrong for the largest group of users
+ * who would see it, which is how a signal becomes noise. `canonicalizeKnownBaseURL`
+ * is the fold the rest of the CLI already compares through.
+ */
+function canonicalServer(url) {
+    return (0, config_1.canonicalizeKnownBaseURL)(url).trim().replace(/\/+$/, '').toLowerCase();
+}
+/** The most useful line of a failure, so a remedy can name the cause. */
+function firstMeaningfulLine(text) {
+    const line = text
+        .split('\n')
+        .map((l) => l.trim())
+        .find((l) => l &&
+        !l.startsWith('at ') &&
+        !/^[{}]/.test(l) &&
+        // The provenance line is a protocol between these two programs, not a
+        // diagnosis. Reporting it as one would answer "why did this fail?" with
+        // a machine's own bookkeeping.
+        !l.includes('skrrd:accept-handoff'));
+    return line ? line.slice(0, 160) : 'no output';
+}
+async function handOffToLocalDaemon(env = process.env, opts = {}) {
+    // Mirrors `OVERSKY_SKIP_DAEMON_BROKER` on the other direction. An operator
+    // deliberately running a daemon against a different deployment than their CLI is
+    // doing a legitimate thing, and this must not overrule it.
+    if (env.OVERSKY_SKIP_DAEMON_HANDOFF === '1' || env.SKRR_SKIP_DAEMON_HANDOFF === '1') {
+        return { status: 'skipped', detail: 'skipped by OVERSKY_SKIP_DAEMON_HANDOFF' };
+    }
+    // The daemon brokered this login, which means it just used its OWN credential
+    // against this server and that credential works. There is nothing to fix.
+    //
+    // Running anyway is not merely redundant, it is destructive: it mints a
+    // replacement, writes it over the working one, revokes the family the daemon is
+    // authenticated with, and restarts the process — killing whatever sessions it
+    // was running. `skrr login` on a healthy machine is the path where the least
+    // should happen, and it was the path where the most did.
+    if (opts.loginFlow === 'daemon-broker') {
+        return {
+            status: 'skipped',
+            detail: 'the local daemon brokered this login, so it already has a working credential',
+        };
+    }
+    const binary = (0, exec_oversky_1.findOverskyBinary)();
+    if (!binary) {
+        return { status: 'skipped', detail: 'no local daemon installed' };
+    }
+    // An older daemon has no `accept-handoff`, and spawning it would fail with
+    // commander's "unknown command" rather than anything a reader could act on. A
+    // CLI that outruns the daemon on the machine is the normal case during a
+    // staged rollout, not an error.
+    const supported = await (0, exec_oversky_1.overskySupportsSubcommand)('accept-handoff');
+    if (supported === false) {
+        return {
+            status: 'skipped',
+            detail: 'the installed daemon predates `accept-handoff`; run `skrr daemon login` once',
+        };
+    }
+    // Ask the daemon which id it will bind, rather than deriving it here. The id
+    // comes from cwd + profile, and a second copy of that derivation in the CLI
+    // would drift — producing a credential minted for a daemon that does not exist,
+    // which is indistinguishable from a login that simply did not work.
+    const printed = await runOversky(binary, ['accept-handoff', '--print-id', ...profileArgs()], {
+        timeoutMs: PROBE_TIMEOUT_MS,
+    });
+    const daemonId = printed.ok ? printed.stdout.trim() : '';
+    if (!daemonId) {
+        return {
+            status: 'failed',
+            detail: `could not read the local daemon id — ${firstMeaningfulLine(printed.stderr)}`,
+        };
+    }
+    const { idSource, machineUuid, daemonServer } = parseIdProvenance(printed.stderr);
+    // A well-formed id is not the same as a real daemon. With no service installed
+    // the daemon derives one from whatever directory this process is in, so the id
+    // above names a daemon that does not exist and will not exist under that id if
+    // one is ever installed from a different directory. Minting for it leaves an
+    // orphaned daemon-scope family on the account and hands the credential to
+    // nothing — which is the case the design record says to skip, and which the
+    // binary-presence check alone never detected because a binary on PATH is not a
+    // service.
+    //
+    // Only a daemon that reports its provenance can be skipped this way. An older
+    // one says nothing, and is left on the previous behaviour rather than refused.
+    if (idSource === 'cwd') {
+        return {
+            status: 'skipped',
+            detail: 'no daemon service is installed on this machine',
+        };
+    }
+    let bundle;
+    try {
+        bundle = (await data_provider_1.dataService.mintDaemonHandoff({
+            daemonId,
+            ...(machineUuid ? { machineUuid } : {}),
+        }));
+    }
+    catch (err) {
+        return { status: 'failed', detail: err.message };
+    }
+    const payload = JSON.stringify({
+        refreshToken: bundle.refreshToken,
+        refreshExpiresAt: bundle.refreshExpiresAt,
+        serverUrl: (0, config_1.loadConfig)().baseURL,
+        daemonId,
+    });
+    // No restart from here. `accept-handoff` runs the runtime's own
+    // `restartDisconnectedServiceAfterLogin` after it writes the credential — the
+    // same reconcile every other credential-write path in the daemon uses — and it
+    // is the better of the two: it checks that a service is installed and running,
+    // refuses to yank a daemon another profile owns, and gives the in-process
+    // watcher a window to converge before reaching for the heavy hammer.
+    //
+    // A second restart out here does not add a guarantee, it adds an outage. Each
+    // one kills in-flight Claude/Codex sessions and browser CDP attachments, and
+    // the second would land on a process that is seconds into starting up.
+    const accepted = await runOversky(binary, ['accept-handoff', ...profileArgs()], {
+        input: payload,
+        timeoutMs: ACCEPT_TIMEOUT_MS,
+    });
+    if (!accepted.ok) {
+        // Deliberately NOT confirming. The machine still holds the credential it had
+        // before this ran, and it still works — the mint no longer revokes anything,
+        // so the cost of a refused handoff is one unused family that the next
+        // successful login sweeps, rather than a signed-out machine.
+        return { status: 'failed', detail: firstMeaningfulLine(accepted.stderr) };
+    }
+    // Only now is the predecessor retired: the daemon has written the new
+    // credential to its own store, so "the old one dies iff the new one is in
+    // place" holds. Best-effort — a confirm that does not land leaves one extra
+    // live family, bounded by the server's concurrent-session cap and swept by the
+    // next confirm, which is a far cheaper failure than the one it replaces.
+    if (bundle.familyId) {
+        try {
+            await data_provider_1.dataService.confirmDaemonHandoff({ daemonId, familyId: bundle.familyId });
+        }
+        catch {
+            /* the credential is delivered; the sweep is bookkeeping */
+        }
+    }
+    return {
+        status: 'delivered',
+        detail: describeDelivery({
+            accountLabel: bundle.accountLabel,
+            daemonServer,
+            cliBaseURL: (0, config_1.loadConfig)().baseURL,
+        }),
+    };
+}