@skrr-ai/cli 0.1.107 → 0.1.109

package/dist/lib/local-daemon-readiness.js

@@ -0,0 +1,143 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.confirmLocalDaemonSignedIn = confirmLocalDaemonSignedIn;
+exports.describeUnreadyLocalDaemon = describeUnreadyLocalDaemon;
+exports.reportLocalDaemonAfterHandoff = reportLocalDaemonAfterHandoff;
+const exec_runtime_binary_1 = require("./exec-runtime-binary");
+const managed_instruction_local_1 = require("./managed-instruction-local");
+const keychain_1 = require("./keychain");
+const config_1 = require("./config");
+const runtime_start_verification_1 = require("./runtime-start-verification");
+const daemon_command_hint_1 = require("./daemon-command-hint");
+/** Each probe reads its inputs when called, so an injected one never touches real state. */
+function defaultDeps() {
+    return {
+        inspect: () => (0, managed_instruction_local_1.inspectLocalInstructionDaemon)((0, keychain_1.getActiveProfile)(), (0, config_1.loadConfig)().baseURL),
+        status: async () => {
+            const profile = (0, keychain_1.getActiveProfile)();
+            const args = [
+                'status',
+                '--json',
+                ...(profile !== keychain_1.DEFAULT_PROFILE ? ['--profile', profile] : []),
+            ];
+            try {
+                const out = await (0, exec_runtime_binary_1.execRuntimeBinaryCapture)(args, { timeoutMs: 15_000 });
+                return { stdout: out.stdout, code: out.code };
+            }
+            catch {
+                return { stdout: '', code: 1 };
+            }
+        },
+        now: () => Date.now(),
+        sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+    };
+}
+async function confirmLocalDaemonSignedIn(options = {}) {
+    const deps = { ...defaultDeps(), ...options.deps };
+    const waitMs = options.waitMs ?? 20_000;
+    const pollMs = options.pollMs ?? 500;
+    const stoppedGraceMs = options.stoppedGraceMs ?? 6_000;
+    const profile = (0, keychain_1.getActiveProfile)();
+    const started = deps.now();
+    let announced = false;
+    let lastDiagnosisAt = -Infinity;
+    let verdict = { state: 'not_connected', profile };
+    for (;;) {
+        const daemonId = await deps.inspect();
+        if (daemonId)
+            return { state: 'connected', daemonId };
+        if (!announced) {
+            options.log?.('Waiting for the local daemon to connect...');
+            announced = true;
+        }
+        const elapsed = deps.now() - started;
+        // Ask WHY at a measured pace — each look spawns `skrrd` — and stop waiting
+        // the moment the answer is one no amount of waiting changes.
+        if (deps.now() - lastDiagnosisAt >= 2_000) {
+            lastDiagnosisAt = deps.now();
+            const status = await deps.status();
+            const verification = (0, runtime_start_verification_1.verifyRuntimeStart)(status.stdout, status.code, ['--profile', profile]);
+            if (verification.status === 'reauth_required') {
+                return {
+                    state: 'reauth_required',
+                    profile: verification.profile,
+                    reason: verification.reason,
+                    command: verification.recoveryCommand,
+                };
+            }
+            if (verification.status === 'not_running') {
+                verdict = {
+                    state: 'not_running',
+                    profile: verification.profile,
+                    runtimeStatus: verification.runtimeStatus,
+                };
+                // A service that was just started reads `stopped` for a moment between
+                // launchd accepting the request and the process existing; only believe
+                // it once it has had that long.
+                if (elapsed >= stoppedGraceMs)
+                    return verdict;
+            }
+            else if (verification.status === 'unreadable_status') {
+                verdict = { state: 'unreadable', profile: verification.profile };
+            }
+            else {
+                verdict = { state: 'not_connected', profile };
+            }
+        }
+        if (elapsed >= waitMs)
+            return verdict;
+        await deps.sleep(Math.min(pollMs, Math.max(0, waitMs - elapsed)));
+    }
+}
+/**
+ * What `skrr login` prints about a daemon that was handed a credential and did
+ * not come up with it: what happened, why, and the one command. Pure, so every
+ * state can be read without a daemon.
+ */
+function describeUnreadyLocalDaemon(readiness, commands) {
+    switch (readiness.state) {
+        case 'reauth_required':
+            return [
+                `The local daemon received its sign-in but cannot use it: ${readiness.reason === 'TOKEN_MISSING'
+                    ? 'it started without a credential'
+                    : `the server refused it (${readiness.reason ?? 'UNKNOWN'})`}.`,
+                `  Sign it in with: ${readiness.command}`,
+            ];
+        case 'not_running':
+            return [
+                `The local daemon received its sign-in but is not running (service status: ${readiness.runtimeStatus ?? 'unknown'}).`,
+                `  See why with \`${commands.logs}\`, then start it with \`${commands.start}\`.`,
+            ];
+        case 'not_connected':
+            return [
+                'The local daemon received its sign-in and is running, but has not connected yet.',
+                `  Check it with \`${commands.status}\`.`,
+            ];
+        case 'unreadable':
+            return [
+                'The local daemon received its sign-in, but its status could not be read to confirm it.',
+                `  Check it with \`${commands.status}\`.`,
+            ];
+    }
+}
+/**
+ * The end of `skrr login` for a daemon that was handed a credential: wait for it
+ * to connect, then say ONE true thing. "Signed in too" only for a daemon that
+ * verified connected as this account; otherwise what happened, why, and the one
+ * command — and never both, which is what the login used to do.
+ */
+async function reportLocalDaemonAfterHandoff(options) {
+    const readiness = await (options.confirm ?? confirmLocalDaemonSignedIn)({ log: options.log });
+    if (readiness.state === 'connected') {
+        options.log(`The local daemon was signed in too — ${options.deliveredDetail}.`);
+        return { daemonId: readiness.daemonId, notReady: false };
+    }
+    for (const line of describeUnreadyLocalDaemon(readiness, {
+        status: (0, daemon_command_hint_1.daemonCommandHint)('status', { bin: options.bin }),
+        logs: (0, daemon_command_hint_1.daemonCommandHint)('logs', { bin: options.bin }),
+        start: (0, daemon_command_hint_1.daemonCommandHint)('start', { bin: options.bin }),
+    })) {
+        options.log(line);
+    }
+    return { notReady: true };
+}

package/dist/lib/machines.d.ts

@@ -53,6 +53,35 @@ export interface MachineHarnessRow {
      * them.
      */
     superseded?: boolean;
+    /**
+     * Recorded `online`, but no heartbeat for longer than the server's stale
+     * threshold (`MachineContact.staleAfterMs`). Present only when true. The server
+     * decides this once; a row's own `status` stays what was recorded
+     * (OSK-16442).
+     */
+    stale?: boolean;
+    /** How long that row has been silent, in ms. Present with `stale`. */
+    staleForMs?: number;
+}
+/**
+ * What a machine's heartbeats say, apart from what its rows are recorded as
+ * (OSK-16442). A daemon that was stopped or frozen stays recorded `online` for a
+ * minute or more before the server gives up on it, so `status` alone said
+ * `online` for a process that had not been heard from in a minute.
+ *
+ * - `live`: a row is online and heard from recently.
+ * - `stale`: rows are recorded online, but none has been heard from for
+ *   `staleAfterMs`. The machine's `status` is `degraded` meanwhile.
+ * - `offline`: nothing is recorded online.
+ *
+ * The thresholds are the server's, sent so this CLI never restates them. Absent
+ * on a server older than this field and on a lease-backed machine.
+ */
+export interface MachineContact {
+    state: 'live' | 'stale' | 'offline';
+    staleForMs: number | null;
+    staleAfterMs: number;
+    offlineAfterMs: number;
 }
 export interface Machine {
     id: string;
@@ -69,6 +98,7 @@ export interface Machine {
      * none will ever arrive.
      */
     statusReason?: string | null;
+    contact?: MachineContact | null;
     machineUuid: string | null;
     stableDaemonId: string | null;
     daemonId: string | null;
@@ -120,6 +150,93 @@ export declare function machineStateLabel(machine: Machine): string;
 export declare function hiddenMachinesSummary(hidden: readonly Machine[]): string;
 /** Is this a machine a user could still use, or bring back? */
 export declare function isReachableMachine(machine: Machine): boolean;
+/**
+ * A computer somebody installed a daemon on, as opposed to a hosted sandbox.
+ *
+ * A daemon launched on a person's own computer registers as
+ * `daemon_<hash>_<source>[_<profile>]` (`parseDaemonId`); a hosted or cloud
+ * machine's daemon carries an id minted by the control plane
+ * (`hosted-machine-…`, `cloud-coding-…`) that names no launch source. A lease
+ * decides a managed machine's own state, so it is never one of these.
+ */
+export declare function isOwnComputer(machine: Machine): boolean;
+/**
+ * What the default `machines list` keeps: everything reachable, and every one of
+ * the person's own computers while it is offline (OSK-16442).
+ *
+ * The default hides offline machines because hosted sandboxes accumulate by the
+ * hundreds and buried the one that was usable (OSK-7639). Applied to a computer
+ * it did something else: the moment its last daemon stopped, the whole row left
+ * the list, in text and in `--json`, so "my computer is offline" and "my computer
+ * is gone" read the same. A computer is a handful of rows however long it is
+ * kept, and `offline` with its last-seen time is the answer a person asks the
+ * list for, so it stays; only what can no longer be used is left behind `--all`.
+ */
+export declare function isListedByDefault(machine: Machine): boolean;
+/**
+ * One daemon registration on a machine, as its own record (OSK-16440).
+ *
+ * A machine row aggregates every harness registration ever made under one
+ * hardware identity. The daemon that made each is only a string on a harness
+ * row, and the profile it ran as is a suffix of that string — so a script that
+ * wanted "the daemon that just registered" had to take the first unfamiliar
+ * `daemonId` out of a flat list that, depending on whether anything on the
+ * computer happened to be online, held 4 rows or 98 of them.
+ */
+export interface MachineDaemonSummary {
+    daemonId: string;
+    /** The profile the daemon ran as, read from its id; null for an id that names none (a hosted box). */
+    profile: string | null;
+    /** How it was launched (`cli`, `launchd`, …); null when the id does not say. */
+    source: string | null;
+    /**
+     * `online` when any registration is online and heard from recently, `stale`
+     * when some are recorded online but none has been heard from lately, `offline`
+     * otherwise.
+     */
+    status: 'online' | 'stale' | 'offline';
+    lastSeenAt: string | null;
+    harnessCount: number;
+    /** Of those, how many a newer registration of the same provider replaced. */
+    supersededCount: number;
+    /** The profile this CLI is running as. */
+    activeProfile: boolean;
+}
+export declare function parseDaemonId(daemonId: string): {
+    source: string;
+    profile: string;
+} | null;
+export declare function summarizeDaemons(harnesses: readonly MachineHarnessRow[], activeProfile: string): MachineDaemonSummary[];
+/** Whether the machine's identity is THIS computer's (the default profile's, or a profile qualified from it). */
+export declare function isThisComputer(machine: Machine, hardwareMachineUuid: string): boolean;
+export interface MachineListView extends Machine {
+    /** This machine is the computer the CLI is running on. */
+    thisComputer: boolean;
+    /** One record per daemon registration; see {@link MachineDaemonSummary}. */
+    daemons: MachineDaemonSummary[];
+    /**
+     * Harness rows left out of `harnesses` because a newer registration replaced
+     * them (default view only). `supersededHarnessCount` still reports the
+     * server's own total, so nothing is silently subtracted.
+     */
+    hiddenHarnessCount?: number;
+}
+/**
+ * What `machines list` shows of one machine (OSK-16440).
+ *
+ * The default list is "what is reachable now", and a machine's own history is
+ * not part of that. A machine row carries every harness registration it ever
+ * had; one of them being online made the whole 98-row history appear in a list
+ * that, a minute earlier, had held four rows — the same command, a different
+ * answer, for no reason a reader could see. So the default view keeps the
+ * registrations that still stand and says how many it left out; `--all` keeps
+ * everything.
+ */
+export declare function machineListView(machine: Machine, options: {
+    all: boolean;
+    hardwareMachineUuid: string;
+    activeProfile: string;
+}): MachineListView;
 /** The user-editable slice. Identities, capabilities and lifecycle are not. */
 export interface MachinePreferencesPatch {
     name?: string;

package/dist/lib/machines.js

@@ -3,6 +3,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.machineStateLabel = machineStateLabel;
 exports.hiddenMachinesSummary = hiddenMachinesSummary;
 exports.isReachableMachine = isReachableMachine;
+exports.isOwnComputer = isOwnComputer;
+exports.isListedByDefault = isListedByDefault;
+exports.parseDaemonId = parseDaemonId;
+exports.summarizeDaemons = summarizeDaemons;
+exports.isThisComputer = isThisComputer;
+exports.machineListView = machineListView;
 exports.liveHarnessCount = liveHarnessCount;
 exports.listMachines = listMachines;
 exports.getMachine = getMachine;
@@ -25,8 +31,20 @@ const api_fetch_1 = require("./api-fetch");
  * could come back says so, and a destroyed one cannot.
  */
 function machineStateLabel(machine) {
+    // `degraded` is the machine's status while a daemon is silent, and it reads the
+    // same as a sign-in problem or one provider being down. The server says which
+    // it is; the word a person reads is that one (OSK-16442).
+    if (machine.status === 'degraded' && machine.contact?.state === 'stale')
+        return 'stale';
     if (machine.status !== 'offline')
         return machine.status;
+    // A computer somebody installed a daemon on has no lease to resume and nothing
+    // to terminate, which is also exactly what a destroyed sandbox looks like, so
+    // the check below read every switched-off computer as `terminated`: the one
+    // word for "this can never come back", beside a machine that comes back the
+    // moment its daemon starts (OSK-16442).
+    if (isOwnComputer(machine))
+        return 'offline';
     const controls = machine.controls;
     if (controls && controls.canResume === false && controls.canTerminate === false) {
         return 'terminated';
@@ -65,6 +83,127 @@ function hiddenMachinesSummary(hidden) {
 function isReachableMachine(machine) {
     return machineStateLabel(machine) !== 'terminated' && machine.status !== 'offline';
 }
+/**
+ * A computer somebody installed a daemon on, as opposed to a hosted sandbox.
+ *
+ * A daemon launched on a person's own computer registers as
+ * `daemon_<hash>_<source>[_<profile>]` (`parseDaemonId`); a hosted or cloud
+ * machine's daemon carries an id minted by the control plane
+ * (`hosted-machine-…`, `cloud-coding-…`) that names no launch source. A lease
+ * decides a managed machine's own state, so it is never one of these.
+ */
+function isOwnComputer(machine) {
+    if (machine.lease)
+        return false;
+    return (machine.harnesses ?? []).some((row) => typeof row.daemonId === 'string' && parseDaemonId(row.daemonId) !== null);
+}
+/**
+ * What the default `machines list` keeps: everything reachable, and every one of
+ * the person's own computers while it is offline (OSK-16442).
+ *
+ * The default hides offline machines because hosted sandboxes accumulate by the
+ * hundreds and buried the one that was usable (OSK-7639). Applied to a computer
+ * it did something else: the moment its last daemon stopped, the whole row left
+ * the list, in text and in `--json`, so "my computer is offline" and "my computer
+ * is gone" read the same. A computer is a handful of rows however long it is
+ * kept, and `offline` with its last-seen time is the answer a person asks the
+ * list for, so it stays; only what can no longer be used is left behind `--all`.
+ */
+function isListedByDefault(machine) {
+    if (isReachableMachine(machine))
+        return true;
+    return isOwnComputer(machine) && machineStateLabel(machine) === 'offline';
+}
+/**
+ * `daemon_<hash>_<source>_<profile>` — the closed set of launch sources is what
+ * makes the profile recoverable, since a profile name may itself contain an
+ * underscore and a source never does (`HarnessService`'s runtime key parses the
+ * same id the same way). An id that predates profiles ends at the source.
+ */
+const DAEMON_ID_PATTERN = /^daemon_[0-9a-f]+_(cli|launchd|systemd|schtasks|electron)(?:_(.+))?$/;
+function parseDaemonId(daemonId) {
+    const match = DAEMON_ID_PATTERN.exec(daemonId);
+    return match ? { source: match[1], profile: match[2] ?? 'default' } : null;
+}
+function newerStamp(a, b) {
+    if (!a)
+        return b;
+    if (!b)
+        return a;
+    return new Date(b).getTime() > new Date(a).getTime() ? b : a;
+}
+function summarizeDaemons(harnesses, activeProfile) {
+    const byDaemon = new Map();
+    for (const row of harnesses) {
+        if (!row.daemonId)
+            continue;
+        const parsed = parseDaemonId(row.daemonId);
+        const existing = byDaemon.get(row.daemonId);
+        const entry = existing ?? {
+            daemonId: row.daemonId,
+            profile: parsed?.profile ?? null,
+            source: parsed?.source ?? null,
+            status: 'offline',
+            lastSeenAt: null,
+            harnessCount: 0,
+            supersededCount: 0,
+            activeProfile: parsed !== null && parsed.profile === activeProfile,
+        };
+        entry.harnessCount += 1;
+        if (row.superseded === true)
+            entry.supersededCount += 1;
+        if (row.status === 'online') {
+            if (row.stale !== true)
+                entry.status = 'online';
+            else if (entry.status === 'offline')
+                entry.status = 'stale';
+        }
+        entry.lastSeenAt = newerStamp(entry.lastSeenAt, row.lastSeenAt);
+        byDaemon.set(row.daemonId, entry);
+    }
+    // Connected first, then silent, then gone, each by most recently seen: the one a
+    // person is looking for is on top.
+    const rank = { online: 0, stale: 1, offline: 2 };
+    return [...byDaemon.values()].sort((a, b) => {
+        if (a.status !== b.status)
+            return rank[a.status] - rank[b.status];
+        return new Date(b.lastSeenAt ?? 0).getTime() - new Date(a.lastSeenAt ?? 0).getTime();
+    });
+}
+/** Whether the machine's identity is THIS computer's (the default profile's, or a profile qualified from it). */
+function isThisComputer(machine, hardwareMachineUuid) {
+    const uuid = machine.machineUuid;
+    if (!uuid || !hardwareMachineUuid)
+        return false;
+    return uuid === hardwareMachineUuid || uuid.startsWith(`${hardwareMachineUuid}:p-`);
+}
+/**
+ * What `machines list` shows of one machine (OSK-16440).
+ *
+ * The default list is "what is reachable now", and a machine's own history is
+ * not part of that. A machine row carries every harness registration it ever
+ * had; one of them being online made the whole 98-row history appear in a list
+ * that, a minute earlier, had held four rows — the same command, a different
+ * answer, for no reason a reader could see. So the default view keeps the
+ * registrations that still stand and says how many it left out; `--all` keeps
+ * everything.
+ */
+function machineListView(machine, options) {
+    const rows = machine.harnesses ?? [];
+    const daemons = summarizeDaemons(rows, options.activeProfile);
+    const visibleRows = options.all ? rows : rows.filter((row) => row.superseded !== true);
+    const visibleDaemons = options.all
+        ? daemons
+        : daemons.filter((daemon) => daemon.harnessCount > daemon.supersededCount);
+    const hidden = rows.length - visibleRows.length;
+    return {
+        ...machine,
+        thisComputer: isThisComputer(machine, options.hardwareMachineUuid),
+        daemons: visibleDaemons,
+        harnesses: visibleRows,
+        ...(hidden > 0 ? { hiddenHarnessCount: hidden } : {}),
+    };
+}
 /**
  * How many of a machine's harnesses still represent a capability it has.
  *

package/dist/lib/managed-instruction-local.d.ts

@@ -10,3 +10,5 @@ export declare function resolveLocalInstructionDaemon(options?: {
     waitMs?: number;
     log?: (message: string) => void;
 }): Promise<string | null>;
+/** One look at this profile's loopback identity endpoint: the daemon id when it is connected as this account. */
+export declare function inspectLocalInstructionDaemon(profile: string, serverUrl: string): Promise<string | null>;

package/dist/lib/managed-instruction-local.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveLocalInstructionDaemon = resolveLocalInstructionDaemon;
+exports.inspectLocalInstructionDaemon = inspectLocalInstructionDaemon;
 const loopback_http_1 = require("@skrr-ai/auth-core/loopback-http");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const config_1 = require("./config");
@@ -25,6 +26,7 @@ async function resolveLocalInstructionDaemon(options = {}) {
         await new Promise((resolve) => setTimeout(resolve, Math.min(300, deadline - Date.now())));
     }
 }
+/** One look at this profile's loopback identity endpoint: the daemon id when it is connected as this account. */
 async function inspectLocalInstructionDaemon(profile, serverUrl) {
     for (const candidate of (0, daemonBroker_1.resolveExactProfileBootstrapPaths)(profile)) {
         const bootstrap = (0, daemonBroker_1.readBootstrap)(candidate);

package/dist/lib/profile-machine-identity-guard.d.ts

@@ -1,2 +1,20 @@
 /** An old profile may still share the default machine row and its device pin. */
 export declare function legacyProfileSharesDefaultMachine(): boolean;
+/**
+ * Why a sign-in on this profile stopped, and what to do instead (OSK-16436).
+ *
+ * This said the profile "was created before profiles had separate machine
+ * identities". For someone whose `skrr login --profile work` ran minutes ago,
+ * under a CLI that then updated itself, that is false in time and unhelpful in
+ * substance: the profile is new to them and old to the program. What is true is
+ * a fact about the VERSION that set it up — the older one gave every profile the
+ * computer's machine identity, and this profile still holds a credential bound
+ * to it — and a consequence: signing in again re-pins the default profile's
+ * device key and signs its daemon out.
+ *
+ * The one command is the CLI's own (`skrr login --profile NAME`), which signs
+ * the background service in as well; `skrrd --profile NAME login` is the
+ * daemon-only spelling and is named second. The suggested name is concrete so
+ * the line can be pasted.
+ */
+export declare function describeLegacySharedProfile(profile: string): string[];

package/dist/lib/profile-machine-identity-guard.js

@@ -1,7 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.legacyProfileSharesDefaultMachine = legacyProfileSharesDefaultMachine;
+exports.describeLegacySharedProfile = describeLegacySharedProfile;
 const machine_uuid_1 = require("@skrr-ai/auth-core/machine-uuid");
+const data_provider_1 = require("@skrr-ai/data-provider");
 const keychain_1 = require("./keychain");
 /** An old profile may still share the default machine row and its device pin. */
 function legacyProfileSharesDefaultMachine() {
@@ -11,3 +13,30 @@ function legacyProfileSharesDefaultMachine() {
         !(0, machine_uuid_1.hostedRuntimeIdOverride)('OVERSKY_MACHINE_UUID') &&
         (0, machine_uuid_1.getMachineUuid)() === (0, machine_uuid_1.getHardwareMachineUuid)());
 }
+/**
+ * Why a sign-in on this profile stopped, and what to do instead (OSK-16436).
+ *
+ * This said the profile "was created before profiles had separate machine
+ * identities". For someone whose `skrr login --profile work` ran minutes ago,
+ * under a CLI that then updated itself, that is false in time and unhelpful in
+ * substance: the profile is new to them and old to the program. What is true is
+ * a fact about the VERSION that set it up — the older one gave every profile the
+ * computer's machine identity, and this profile still holds a credential bound
+ * to it — and a consequence: signing in again re-pins the default profile's
+ * device key and signs its daemon out.
+ *
+ * The one command is the CLI's own (`skrr login --profile NAME`), which signs
+ * the background service in as well; `skrrd --profile NAME login` is the
+ * daemon-only spelling and is named second. The suggested name is concrete so
+ * the line can be pasted.
+ */
+function describeLegacySharedProfile(profile) {
+    const next = `${profile}-2`;
+    return [
+        `Profile '${profile}' was set up by an older ${data_provider_1.BRAND.displayName} version that gave every profile on this ` +
+            'computer the same machine identity, and it still has it. Signing in here would replace the default ' +
+            "profile's device-key pin and sign the default daemon out. Nothing was changed.",
+        `Use a new profile name instead: skrr login --profile ${next}`,
+        `(For the background service alone: skrrd --profile ${next} login)`,
+    ];
+}

package/dist/lib/request-field-flags.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Read a server refusal back in the words the person typed.
+ *
+ * The API validates the request BODY, so its messages name body paths:
+ * `execution.workflowSignal is required for mode "workflow_signal"`. A person who built that body
+ * from flags never typed `execution.workflowSignal`, and there is no flag of that name, so the
+ * message pointed at nothing they could change (OSK-15313). A command that builds its body from
+ * flags declares which flag writes which path, and `handleApiError` rewrites any path it finds in
+ * the server's message to that flag. The server keeps speaking its own contract; the CLI, which
+ * is the only party that knows how the body was built, does the translation.
+ *
+ * A command that sent a body the person wrote themselves (`--from-json`) declares nothing: then
+ * the path IS what they typed.
+ */
+/**
+ * Replace every declared body path in `message` with its flag. Longest path first, so
+ * `execution.workflowSignal.eventKey` is not half-rewritten by `execution.workflowSignal`; a
+ * path is only replaced as a whole token (not when followed by more of a longer path).
+ */
+export declare function translateRequestFieldPaths(message: string | undefined, fieldFlags: Readonly<Record<string, string>> | undefined): string | undefined;

package/dist/lib/request-field-flags.js

@@ -0,0 +1,34 @@
+"use strict";
+/**
+ * Read a server refusal back in the words the person typed.
+ *
+ * The API validates the request BODY, so its messages name body paths:
+ * `execution.workflowSignal is required for mode "workflow_signal"`. A person who built that body
+ * from flags never typed `execution.workflowSignal`, and there is no flag of that name, so the
+ * message pointed at nothing they could change (OSK-15313). A command that builds its body from
+ * flags declares which flag writes which path, and `handleApiError` rewrites any path it finds in
+ * the server's message to that flag. The server keeps speaking its own contract; the CLI, which
+ * is the only party that knows how the body was built, does the translation.
+ *
+ * A command that sent a body the person wrote themselves (`--from-json`) declares nothing: then
+ * the path IS what they typed.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.translateRequestFieldPaths = translateRequestFieldPaths;
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/**
+ * Replace every declared body path in `message` with its flag. Longest path first, so
+ * `execution.workflowSignal.eventKey` is not half-rewritten by `execution.workflowSignal`; a
+ * path is only replaced as a whole token (not when followed by more of a longer path).
+ */
+function translateRequestFieldPaths(message, fieldFlags) {
+    if (!message || !fieldFlags)
+        return message;
+    const paths = Object.keys(fieldFlags).sort((a, b) => b.length - a.length);
+    if (paths.length === 0)
+        return message;
+    const pattern = new RegExp(`(?<![\\w.])(${paths.map(escapeRegExp).join('|')})(?![\\w.]*\\w)`, 'g');
+    return message.replace(pattern, (path) => fieldFlags[path] ?? path);
+}

package/dist/lib/stewardship-output.d.ts

@@ -1,4 +1,4 @@
 import type { WorkspaceGrantReport, WorkspaceStewardshipReport } from './workspaces';
 export declare function printStewardshipCoverage(report: WorkspaceGrantReport, log: (line: string) => void): void;
-export declare function printWorkspaceGrants(report: WorkspaceGrantReport, log: (line: string) => void): void;
+export declare function printWorkspaceGrants(report: WorkspaceGrantReport, log: (line: string) => void, members?: ReadonlyMap<string, string>): void;
 export declare function printWorkspaceStewardship(report: WorkspaceStewardshipReport, log: (line: string) => void): void;