@skrr-ai/cli 0.1.23 → 0.1.25

package/dist/commands/tasks/expectations.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
+const data_provider_2 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 /**
  * `skrr tasks expectations <task>` — what this task owes, and how far each got.
@@ -23,16 +24,58 @@ const STATE_LABEL = {
     owed: 'not yet',
     unassessed: 'needs assessment',
 };
+/**
+ * The evidence gap, on the rows where a reader can act on it.
+ *
+ * `unverified` and `underway` BOTH mean "something was produced and pinned to
+ * this Expectation, and it is not enough yet" — they differ only in whether the
+ * thing has been observed as available. Printing the gap on the first and
+ * nothing on the second is what made the careful path unreadable: an operator
+ * who pinned a deliverable saw `on its way` and had no way to learn that the
+ * bar was `external_receipt` and their own report could never clear it.
+ *
+ * It stays off the rows where it is noise: a met or waived row has nothing
+ * outstanding, and an `owed`/`unassessed` row has no deliverable to compare
+ * against, so naming a required authority there describes a hypothetical.
+ */
+const PINNED_STATES = new Set(['unverified', 'underway']);
+function evidenceGap(expectation) {
+    /*
+     * A `met` row settled BELOW its declared bar says so.
+     *
+     * `@merged-to-main` asks for `external_receipt` and is satisfiable by a person
+     * typing "I checked git log". That is allowed on purpose — refusing it is the
+     * deadlock the ladder exists to prevent — but every surface then read as though
+     * a receipt had arrived: the row said `done`, the rollup said `met`, and the
+     * recorded gap was visible only to someone who dumped the assessment rows and
+     * already knew the field existed.
+     */
+    if (expectation.evidenceShortfall) {
+        const { provided, required } = expectation.evidenceShortfall;
+        return `  (vouched at ${provided}, asked for ${required})`;
+    }
+    if (!PINNED_STATES.has(expectation.state))
+        return '';
+    if (!expectation.evidenceLevel || !expectation.requiredEvidence)
+        return '';
+    if (expectation.evidenceLevel === expectation.requiredEvidence)
+        return '';
+    return `  (has ${expectation.evidenceLevel}, needs ${expectation.requiredEvidence})`;
+}
 function line(expectation) {
     const label = STATE_LABEL[expectation.state] || expectation.state;
     const from = expectation.source === 'space' ? '  [space default]' : '';
-    // Only shown when the work exists and the evidence is short — stating the
-    // required authority on every row would be noise on the rows where it is
-    // already satisfied or not yet relevant.
-    const evidence = expectation.state === 'unverified'
-        ? `  (has ${expectation.evidenceLevel}, needs ${expectation.requiredEvidence})`
-        : '';
-    return `  ${expectation.id.padEnd(18)} ${label.padEnd(18)} ${expectation.text}${evidence}${from}`;
+    /*
+     * `sentence` before `text`.
+     *
+     * The server resolves `sentence` through `describeExpectation`, which is what
+     * appends a preset's destination — so `@wiki-page-published:Engineering/Deploy`
+     * and the same preset at `Ops/Oncall` are distinguishable. Printing `text`
+     * rendered the preset's fixed copy and dropped the one part that says WHICH
+     * thing is owed. The fallback is for a row that predates the resolved field.
+     */
+    const sentence = expectation.sentence || expectation.text;
+    return `  ${expectation.id.padEnd(18)} ${label.padEnd(18)} ${sentence}${evidenceGap(expectation)}${from}`;
 }
 class TasksExpectations extends base_command_1.BaseCommand {
     static description = 'Show what must be true before the Task can close and the evidence-backed assessment state';
@@ -79,12 +122,36 @@ class TasksExpectations extends base_command_1.BaseCommand {
             this.log(line(expectation));
         }
         const gating = acceptance.expectations.filter((e) => e.gating);
-        const met = gating.filter((e) => e.met).length;
+        // `met: true` is the GATE's answer — a waiver unblocks closure exactly as a
+        // pass does — but it is the wrong REPORT. Counting them together printed
+        // "2 of 2 met" for a Task where one expectation was dropped, which is the
+        // one thing a reader checking this line needs to know.
+        const waived = gating.filter((e) => e.state === 'waived').length;
+        const met = gating.filter((e) => e.met).length - waived;
         this.log('');
-        this.log(`${met} of ${gating.length} met  ·  overall: ${acceptance.state}`);
+        this.log(`${met} of ${gating.length} met${waived > 0 ? ` · ${waived} waived` : ''}  ·  overall: ${acceptance.state}`);
         // Space defaults are copied into the Task at creation. `source=space`
         // remains useful provenance, but these are Task-owned Expectations now and
         // are assessed exactly like explicitly declared ones.
+        /*
+         * A typed check nothing evaluates behaves exactly like `manual`.
+         *
+         * `EXPECTATION_CHECK_METHODS` declares six methods and the judge evaluates
+         * one: a `deliverable` check is compared against the ledger, and
+         * `task_state`, `goal_state`, `metric` and `llm_review` return `unassessed`
+         * forever. Verified against production — a `metric` check naming measureId,
+         * operator and target stores fine and is never looked at. The row read
+         * identically to a hand-written sentence, so somebody who chose
+         * `metric: cycle_time lt 2` had no way to learn the platform was not
+         * measuring it (OSK-8488).
+         */
+        const unevaluated = acceptance.expectations.filter((e) => (0, data_provider_2.declaresUnevaluatedCheck)(e));
+        if (unevaluated.length > 0) {
+            const methods = [...new Set(unevaluated.map((e) => e.check?.method).filter(Boolean))].join(', ');
+            this.log(`${unevaluated.length} declare${unevaluated.length === 1 ? 's' : ''} a typed check nothing ` +
+                `evaluates yet (${methods}) — a person settles ${unevaluated.length === 1 ? 'it' : 'them'} ` +
+                'exactly as if the check said `manual`.');
+        }
         const settleable = acceptance.expectations.filter((e) => e.state === 'unassessed').length;
         if (settleable > 0) {
             this.log(`${settleable} awaiting assessment — use \`${this.config.bin} tasks expectations assess\`.`);
@@ -98,7 +165,40 @@ class TasksExpectations extends base_command_1.BaseCommand {
                 `\`${this.config.bin} tasks deliverable confirm\`, or lower the bar with ` +
                 `\`${this.config.bin} tasks trust\`.`);
         }
-        if (gating.length > met) {
+        // `underway` had no trailer at all, which is why pinning a deliverable read
+        // as no progress: the row said `on its way` and nothing named the lever.
+        // A Deliverable is recorded `local` by default, so this is the state the
+        // ORDINARY `tasks deliverable add` lands in — the common case, not an edge.
+        const underway = acceptance.expectations.filter((e) => e.state === 'underway').length;
+        if (underway > 0) {
+            this.log(`${underway} recorded but not yet observed as available — say it arrived with ` +
+                `\`${this.config.bin} tasks deliverable confirm\`, or re-record it with ` +
+                `\`--status available\`.`);
+        }
+        // Counted separately from the unmet ones: these no longer block anything, and
+        // the reader's question about them is not "what do I do" but "how good is this
+        // record". Saying it once beats repeating the rungs on every row.
+        const shortfalls = acceptance.expectations.filter((e) => e.evidenceShortfall).length;
+        if (shortfalls > 0) {
+            this.log(`${shortfalls} settled below the evidence ${shortfalls === 1 ? 'bar it' : 'bars they'} ` +
+                `declared — allowed, and recorded as such on the assessment.`);
+        }
+        // Said once, for the whole task: `external_receipt` is the one bar no CLI
+        // command can clear. The only receipt producer in the platform is PR
+        // integration, so an operator staring at a row that needs one would
+        // otherwise keep looking for the command that supplies it.
+        const receiptBarred = acceptance.expectations.filter((e) => !e.met && e.requiredEvidence === 'external_receipt').length;
+        if (receiptBarred > 0) {
+            this.log(`${receiptBarred} ask${receiptBarred === 1 ? 's' : ''} for an external provider receipt, ` +
+                `which only an integration can supply — settle by hand with ` +
+                `\`${this.config.bin} tasks expectations assess\` (the gap is recorded), or lower the ` +
+                `bar with \`${this.config.bin} tasks trust\`.`);
+        }
+        // Settled, not "met" — a waiver settles an Expectation as surely as a pass,
+        // and splitting the two in the count above must not make this trailer fire
+        // on a Task where nothing is actually outstanding.
+        const settled = gating.filter((e) => e.met).length;
+        if (gating.length > settled) {
             this.log('');
             this.log('The current Result cannot be accepted while these Expectations remain unmet.');
         }

package/dist/commands/tasks/output.d.ts

@@ -1,5 +1,4 @@
 import { BaseCommand } from '../../base-command';
-/** Compatibility command name. The authoritative object is Result, not output. */
 export default class TasksOutput extends BaseCommand {
     static hidden: boolean;
     static description: string;

package/dist/commands/tasks/output.js

@@ -7,6 +7,19 @@ const task_resolver_1 = require("../../lib/task-resolver");
 const web_url_1 = require("../../lib/web-url");
 const task_transcript_1 = require("../../lib/task-transcript");
 /** Compatibility command name. The authoritative object is Result, not output. */
+/**
+ * "awaiting review" is only true while a review can still be recorded.
+ *
+ * A closed Task refuses one outright (`TASK_REOPEN_REQUIRED`), so printing
+ * "awaiting" described a state that could never be left — and the reader has no
+ * way to tell that from a review that is genuinely pending.
+ */
+function reviewLine(review, task) {
+    if (review?.decision)
+        return review.decision;
+    const terminal = ['completed', 'cancelled'].includes(String(task?.statusType ?? ''));
+    return terminal ? 'none recorded — the Task is closed' : 'awaiting review';
+}
 class TasksOutput extends base_command_1.BaseCommand {
     static hidden = true;
     static description = 'Show the current Result, Review, Deliverables, and final Run reply';
@@ -93,10 +106,17 @@ class TasksOutput extends base_command_1.BaseCommand {
             if (result.conclusion) {
                 this.log(`  conclusion (${result.conclusion.type}): ${JSON.stringify(result.conclusion.value)}`);
             }
-            this.log(`Review:  ${review?.decision || 'awaiting review'}`);
+            this.log(`Review:  ${reviewLine(review, task)}`);
             if (review?.rationale)
                 this.log(`  ${review.rationale}`);
         }
+        else if (task.specVersion === undefined) {
+            // A Task predating the canonical model has no TaskResult row and never
+            // will. "none submitted" reads as "the work was never reported", which
+            // for a completed legacy Task is the opposite of the truth.
+            this.log('Result:  not recorded under the canonical model (this Task predates it)');
+            this.log('         its closeout is in `skrr tasks comments list` / `tasks transcript`');
+        }
         else {
             this.log('Result:  none submitted');
         }

package/dist/commands/tasks/report.js

@@ -14,7 +14,9 @@ const web_url_1 = require("../../lib/web-url");
  */
 class TasksReport extends base_command_1.BaseCommand {
     static hidden = true;
-    static description = 'Submit a versioned Result with findings, evidence, and next actions';
+    static description = 'DEPRECATED compatibility spelling for `tasks result submit`. Every call submits a ' +
+        'versioned Result; `--kind` is ignored. Use `tasks result submit` (submit only) or ' +
+        '`tasks complete` (submit and close).';
     static examples = [
         '<%= config.bin %> tasks report <task-id> --outcome "Adopt the event ledger" --finding "The task page omits work-event details" --evidence "Task detail reads only legacy activity" --next "Add a Result section"',
         '<%= config.bin %> tasks report <task-id> --kind handoff --outcome "Ready for review" --finding "All expectations are met" --deliverable "file:src/task.ts" --json',

package/dist/commands/tasks/result/show.js

@@ -4,6 +4,7 @@ const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../../base-command");
 const task_resolver_1 = require("../../../lib/task-resolver");
+const task_legacy_1 = require("../../../lib/task-legacy");
 class TasksResultShow extends base_command_1.BaseCommand {
     static description = 'Show the current Task Result and its exact Review';
     static args = {
@@ -29,12 +30,29 @@ class TasksResultShow extends base_command_1.BaseCommand {
             return this.log(JSON.stringify(result, null, 2));
         const current = result.results.find((row) => row.id === result.currentResultId);
         if (!current)
-            return this.log('No Result submitted.');
+            return this.log(await (0, task_legacy_1.emptyCanonicalView)(task.id, 'Result'));
         const review = result.reviews.find((row) => row.resultId === current.id);
         this.log(`Result v${current.version}\n${current.summary}`);
         if (current.conclusion)
             this.log(`Conclusion (${current.conclusion.type}): ${JSON.stringify(current.conclusion.value)}`);
-        this.log(`Review: ${review ? review.decision : 'awaiting review'}`);
+        // Only "awaiting" while a review can still be recorded. A closed Task
+        // refuses one outright (`TASK_REOPEN_REQUIRED`), so the old wording named a
+        // state nothing could ever leave — and a reader could not tell it from a
+        // review that is genuinely pending. The extra read happens only on the
+        // no-review path, where the distinction is the whole point.
+        let reviewLine = 'awaiting review';
+        if (review) {
+            reviewLine = review.decision;
+        }
+        else {
+            const full = (await data_provider_1.dataService
+                .getTask(task.id, { enrich: false })
+                .catch(() => undefined));
+            if (['completed', 'cancelled'].includes(String(full?.statusType ?? ''))) {
+                reviewLine = 'none recorded — the Task is closed';
+            }
+        }
+        this.log(`Review: ${reviewLine}`);
         if (flags.history && result.results.length > 1) {
             this.log(`Superseded versions: ${result.results
                 .slice(1)

package/dist/commands/tasks/resume/save.js

@@ -15,7 +15,17 @@ class TasksResumeSave extends base_command_1.BaseCommand {
     static flags = {
         task: core_1.Flags.string({ description: 'Task id; overrides runtime context' }),
         'run-id': core_1.Flags.string({ required: true, description: 'Canonical Task Run' }),
-        snapshot: core_1.Flags.string({ required: true, description: 'Resume Point JSON snapshot' }),
+        snapshot: core_1.Flags.string({
+            required: true,
+            description: 'Resume Point JSON snapshot. ' +
+                'Every field is optional. `completed`, `nextActions` and `currentFocus` accept either a ' +
+                'plain sentence or {summary,sourceRefs} — the object form is canonical and a bare string ' +
+                'is lifted into it, so the same sentence you put in an Update’s nextActions works here ' +
+                'unchanged. Shape: {completed:[], currentFocus, nextActions:[], ' +
+                'openQuestions:[{question,sourceRef?}], relevantUpdateIds:[], evidenceRefs:[], ' +
+                'deliverableRefs:[], childHeads:[{runId,resumePointId,status}], workspaceStateRef}. ' +
+                'Never put a credential, token or lease in a snapshot — the server refuses one.',
+        }),
         'spec-version': core_1.Flags.integer({ description: 'Task specification version' }),
         'idempotency-key': core_1.Flags.string({ description: 'Stable retry key' }),
         json: core_1.Flags.boolean({ description: 'Output JSON' }),

package/dist/commands/tasks/self-schedule.js

@@ -31,10 +31,13 @@ class TasksSelfSchedule extends base_command_1.BaseCommand {
         at: core_1.Flags.string({ description: 'Absolute return time (ISO-8601 UTC)' }),
         in: core_1.Flags.string({ description: 'Relative return time such as 90m, 2h, 3d' }),
         note: core_1.Flags.string({
-            // Was "handed to the agent as the return prompt", which is not true:
-            // `task_execute` builds the run's prompt from the Task, so this string is
-            // recorded and never read by the run. See `TaskScheduler/selfSchedule.js`.
-            description: 'Why you are coming back — recorded on the return for you to read back',
+            // This DOES reach the run now. It is read by `buildTaskExecutionPrompt`,
+            // the one place every dispatch path assembles a task prompt, and rendered
+            // as `### Why You Parked This Task` alongside the instant it was parked
+            // for. For a while it was recorded and never delivered, and the help said
+            // so; both halves are fixed rather than only the sentence.
+            description: 'Why you are coming back. Delivered to the agent on the return as its own ' +
+                'prompt section, and readable any time with --show',
         }),
         'max-per-day': core_1.Flags.integer({
             description: 'Cap on self-initiated returns per day (1-24, default 4)',

package/dist/commands/tasks/show.js

@@ -262,6 +262,25 @@ class TasksShow extends base_command_1.BaseCommand {
             this.log(`Created:     ${formatTime(t.createdAt)}`);
         if (t.updatedAt)
             this.log(`Updated:     ${formatTime(t.updatedAt)}`);
+        /**
+         * Say which Task model this row belongs to, on the one surface everybody
+         * reads first.
+         *
+         * Canonical Task Model v1 deliberately migrated nothing, so a Task created
+         * before it is a second class of object with visibly different behaviour —
+         * no Updates, no Result, no Activity, no timeline. The only marker was
+         * `specVersion` being ABSENT under `--json`, and absence-as-a-marker is not
+         * something a reader can notice: you have to already know the field exists
+         * to observe that it does not. So `tasks show` said nothing, and the user
+         * found out by watching four other commands report emptiness about a Task
+         * with years of history.
+         *
+         * Printed only for the legacy class. A canonical Task needs no line saying
+         * it is ordinary.
+         */
+        if (t.specVersion === undefined || t.specVersion === null) {
+            this.log('Model:       predates the canonical Task model — no Result, Updates, Activity or timeline');
+        }
         if (t.description) {
             this.log('');
             this.log('Description:');

package/dist/commands/tasks/timeline.js

@@ -5,6 +5,7 @@ const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const format_1 = require("../../lib/format");
+const task_legacy_1 = require("../../lib/task-legacy");
 /**
  * `<action> (<k=v ...>)`, or just the preview when there is nothing to add.
  *
@@ -49,7 +50,14 @@ class TasksTimeline extends base_command_1.BaseCommand {
             this.log(JSON.stringify(result, null, 2));
             return;
         }
-        (0, format_1.renderTable)((result.data ?? []).map((item) => ({
+        const rows = result.data ?? [];
+        if (rows.length === 0) {
+            // `renderTable([])` prints NOTHING — no header, no empty state, exit 0 —
+            // which is indistinguishable from a broken command. Say what happened.
+            this.log(await (0, task_legacy_1.emptyCanonicalView)(args.id, 'timeline entries'));
+            return;
+        }
+        (0, format_1.renderTable)(rows.map((item) => ({
             time: String(item.occurredAt ?? '-')
                 .replace('T', ' ')
                 .slice(0, 19),

package/dist/commands/tasks/updates/add.js

@@ -21,6 +21,9 @@ class TasksUpdatesAdd extends base_command_1.BaseCommand {
     static examples = [
         '<%= config.bin %> tasks updates add <task> --type progress --summary "Migration review complete" --data \'{"completedSinceLast":["Checked migrations 001-014"],"nextActions":["Review authorization"]}\'',
         '<%= config.bin %> tasks updates add <task> --type decision --summary "Use a resource object" --data \'{"decision":"Use WorkResource","rationale":"Identity must survive URL changes"}\'',
+        '<%= config.bin %> tasks updates add <task> --type finding --summary "Cross-tenant leak" --data \'{"finding":"Space ACL is not applied on the list path","impact":"Any member can read another space","severity":"high","evidenceRefs":[]}\'',
+        '<%= config.bin %> tasks updates add <task> --type blocker --summary "Needs a prod credential" --data \'{"cause":"No Atlas API key in this runtime","requiredAction":"Provision a read-only key","nextOwner":{"kind":"human","userId":"<user-id>"}}\'',
+        '<%= config.bin %> tasks updates add <task> --type verification --summary "Repro is gone" --data \'{"claim":"The 409 no longer reproduces","result":"passed","evidenceRefs":[]}\'',
     ];
     static args = {
         task: core_1.Args.string({ required: false, ignoreStdin: true, description: 'Task id or ref' }),
@@ -33,9 +36,27 @@ class TasksUpdatesAdd extends base_command_1.BaseCommand {
             description: 'What changed in the shared understanding of the Task',
         }),
         summary: core_1.Flags.string({ required: true, description: 'One sentence saying what became true' }),
-        data: core_1.Flags.string({ required: true, description: 'Kind-specific JSON payload' }),
+        data: core_1.Flags.string({
+            required: true,
+            description: 'Kind-specific JSON payload. The server enforces one shape per --type, and the array ' +
+                'fields are required even when empty. ' +
+                'progress {completedSinceLast:[],nextActions:[],currentFocus?} · ' +
+                'finding {finding,evidenceRefs:[],impact?,severity?} · ' +
+                'decision {decision,rationale,alternativesConsidered?} · ' +
+                'blocker {cause,requiredAction,nextOwner} · ' +
+                'verification {claim,result:passed|failed|inconclusive,evidenceRefs:[]}. ' +
+                'nextOwner is a principal object like {"kind":"human","userId":"..."}, not a name. ' +
+                "Note --reference sets the Update's own references, NOT data.evidenceRefs.",
+        }),
         resume: core_1.Flags.string({
-            description: 'JSON recovery snapshot; requires --run-id and is committed with the Update',
+            description: 'JSON recovery snapshot; requires --run-id and is committed with the Update. ' +
+                'Every field is optional. `completed`, `nextActions` and `currentFocus` accept either a ' +
+                'plain sentence or {summary,sourceRefs} — the object form is canonical and a bare string ' +
+                'is lifted into it, so the same sentence you put in an Update’s nextActions works here ' +
+                'unchanged. Shape: {completed:[], currentFocus, nextActions:[], ' +
+                'openQuestions:[{question,sourceRef?}], relevantUpdateIds:[], evidenceRefs:[], ' +
+                'deliverableRefs:[], childHeads:[{runId,resumePointId,status}], workspaceStateRef}. ' +
+                'Never put a credential, token or lease in a snapshot — the server refuses one.',
         }),
         'run-id': core_1.Flags.string({ description: 'Canonical Task Run that performed this work' }),
         'spec-version': core_1.Flags.integer({

package/dist/lib/api-fetch.js

@@ -37,6 +37,8 @@ const config_1 = require("./config");
 // (b) tests that mock './auth-storage' get a single mock target.
 const auth_storage_1 = require("./auth-storage");
 const credential_resolver_1 = require("./credential-resolver");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const idempotency_scope_1 = require("./idempotency-scope");
 const node_adapter_1 = require("./node-adapter");
 const refresh_1 = require("./refresh");
 const delegated_cli_1 = require("./delegated-cli");
@@ -95,6 +97,12 @@ async function apiFetch(pathOrUrl, opts = {}) {
     if (opts.body !== undefined && method !== 'GET') {
         body = JSON.stringify(opts.body);
     }
+    // Same rule as every `dataService` write (`@skrr-ai/data-provider`
+    // idempotency), chosen once so the 401 retries below resend the same key.
+    (0, idempotency_scope_1.bindAutonomousIdempotencyScope)();
+    const callerHeaders = method === 'GET'
+        ? (opts.headers ?? {})
+        : (0, data_provider_1.withIdempotencyKey)(opts.headers, { method, url: pathOrUrl, body: opts.body });
     // A trusted Agent process cannot smuggle an explicit human credential into
     // this escape hatch. The daemon-issued session token is the sole principal.
     //
@@ -146,7 +154,7 @@ async function apiFetch(pathOrUrl, opts = {}) {
         // Caller headers are applied BEFORE the auth header below is read, and
         // deliberately cannot clobber Authorization / Content-Type: an idempotency
         // key is additive metadata, not a way to re-auth the request.
-        for (const [k, v] of Object.entries(opts.headers ?? {})) {
+        for (const [k, v] of Object.entries(callerHeaders)) {
             const lower = k.toLowerCase();
             if (lower === 'authorization' || lower === 'content-type')
                 continue;

package/dist/lib/assignee-resolver.d.ts

@@ -9,12 +9,13 @@
  * reference into exactly one member of the task's space, or an actionable
  * failure that names the candidates.
  *
- * Scoping to the space is not just ergonomics. The server rejects assignees
- * that are not space members (`SpacePermissionService.validateAssigneeSpaceMembership`
- * → `ASSIGNEE_NOT_IN_SPACE`), so resolving against the space membership list
- * means a name that resolves is a name that will be accepted — we never build
- * a request the server is guaranteed to refuse, and we cannot accidentally
- * leak a directory-wide user search into a space the caller can't see.
+ * Scoping to the space is not just ergonomics. The server accepts space members
+ * and, beyond them, only the caller's own agent when it is shared with no one
+ * else (`AgentTaskConsent` → otherwise `ASSIGNEE_NOT_IN_SPACE`), so a name that
+ * resolves against the membership list is a name that will be accepted, and we
+ * cannot accidentally leak a directory-wide user search into a space the caller
+ * can't see. An owner-delegated agent is not a member and so is not resolvable
+ * by name here; it is passed by raw id.
  */
 export type MemberKind = 'user' | 'agent';
 export type SpaceMember = {

package/dist/lib/daemonBroker.d.ts

@@ -139,6 +139,8 @@ export interface DaemonBrokerOptions {
     profile?: string;
     /** Override the bootstrap file path entirely (tests / unusual layouts). */
     bootstrapPathOverride?: string;
+    /** Test seam: the ordered candidate list, when one path is not enough. */
+    candidatePathsOverride?: readonly string[];
     /** Override total request timeout. Tests use a short value. */
     timeoutMs?: number;
 }
@@ -159,6 +161,24 @@ export declare function resolveProfileBootstrapPaths(primary: string, entryNames
  * deterministic when more than one matching daemon is running.
  */
 export declare function resolveBootstrapCandidatePaths(profile?: string): string[];
+/**
+ * A Dedicated Runtime guest's workload hand-off descriptor.
+ *
+ * On that product the daemon runs as `skrr-runtime` and everything the user runs
+ * — terminals, Bash tool calls, engines — as `skrr-workload`, so the island
+ * bootstrap above sits in a home this process cannot read. The daemon publishes
+ * this second descriptor to the shared workload group instead
+ * (`daemon/src/dedicated-cli-handoff.ts`). Its secret is accepted by the
+ * cli-handoff route and nothing else, so it is a hand-off candidate ONLY: it is
+ * deliberately absent from `resolveBootstrapCandidatePaths`, which message-intent
+ * submission also reads and which needs the island secret.
+ *
+ * Fixed and root-controlled (the daemon unit's RuntimeDirectory), so nothing the
+ * user configures can point the broker somewhere else.
+ */
+export declare const DEDICATED_RUNTIME_CLI_HANDOFF_DESCRIPTOR = "/run/skrr-dedicated-runtime/cli-handoff/descriptor.json";
+/** Where the cli-handoff broker looks, in order. */
+export declare function resolveCliHandoffCandidatePaths(profile?: string): string[];
 /**
  * Resolve the first live daemon bootstrap for a profile. Message-intent
  * submission reuses the same authenticated loopback discovery as the login

package/dist/lib/daemonBroker.js

@@ -71,10 +71,12 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEDICATED_RUNTIME_CLI_HANDOFF_DESCRIPTOR = void 0;
 exports.normalizeBaseUrl = normalizeBaseUrl;
 exports.resolveBootstrapPath = resolveBootstrapPath;
 exports.resolveProfileBootstrapPaths = resolveProfileBootstrapPaths;
 exports.resolveBootstrapCandidatePaths = resolveBootstrapCandidatePaths;
+exports.resolveCliHandoffCandidatePaths = resolveCliHandoffCandidatePaths;
 exports.findLiveDaemonBootstrap = findLiveDaemonBootstrap;
 exports.readBootstrap = readBootstrap;
 exports.attemptDaemonBrokerLogin = attemptDaemonBrokerLogin;
@@ -164,6 +166,33 @@ function resolveBootstrapCandidatePaths(profile = 'default') {
         return process.platform === 'darwin' ? [primary] : [primary, legacyBootstrapPath()];
     }
 }
+/**
+ * A Dedicated Runtime guest's workload hand-off descriptor.
+ *
+ * On that product the daemon runs as `skrr-runtime` and everything the user runs
+ * — terminals, Bash tool calls, engines — as `skrr-workload`, so the island
+ * bootstrap above sits in a home this process cannot read. The daemon publishes
+ * this second descriptor to the shared workload group instead
+ * (`daemon/src/dedicated-cli-handoff.ts`). Its secret is accepted by the
+ * cli-handoff route and nothing else, so it is a hand-off candidate ONLY: it is
+ * deliberately absent from `resolveBootstrapCandidatePaths`, which message-intent
+ * submission also reads and which needs the island secret.
+ *
+ * Fixed and root-controlled (the daemon unit's RuntimeDirectory), so nothing the
+ * user configures can point the broker somewhere else.
+ */
+exports.DEDICATED_RUNTIME_CLI_HANDOFF_DESCRIPTOR = '/run/skrr-dedicated-runtime/cli-handoff/descriptor.json';
+/** Where the cli-handoff broker looks, in order. */
+function resolveCliHandoffCandidatePaths(profile = 'default') {
+    const candidates = resolveBootstrapCandidatePaths(profile);
+    // Any profile: a guest runs one daemon, and the auto-broker resolves the
+    // default profile regardless of `--profile`, so a narrower condition here would
+    // only describe behaviour production never reaches.
+    if (process.platform === 'linux') {
+        candidates.push(exports.DEDICATED_RUNTIME_CLI_HANDOFF_DESCRIPTOR);
+    }
+    return candidates;
+}
 /**
  * Pre-Phase-K bootstrap path (non-darwin). Read-only fallback consulted
  * when the canonical path is absent — covers a freshly-upgraded daemon
@@ -247,13 +276,15 @@ function readBootstrap(filePath) {
  */
 async function attemptDaemonBrokerLogin(opts) {
     const profile = opts.profile ?? 'default';
-    const candidates = opts.bootstrapPathOverride
-        ? [opts.bootstrapPathOverride]
-        : resolveBootstrapCandidatePaths(profile);
-    let bootstrap = null;
-    let usedPath = null;
-    let unboundBootstrap = null;
-    let unboundPath = null;
+    const candidates = opts.candidatePathsOverride
+        ? [...opts.candidatePathsOverride]
+        : opts.bootstrapPathOverride
+            ? [opts.bootstrapPathOverride]
+            : resolveCliHandoffCandidatePaths(profile);
+    // Bound candidates (their serverUrl matches this CLI) in order, then unbound
+    // ones. Every usable candidate is kept, not just the first: see below.
+    const usable = [];
+    const unbound = [];
     let mismatchedBootstrap = null;
     for (const candidate of candidates) {
         const candidateBootstrap = readBootstrap(candidate);
@@ -269,19 +300,13 @@ async function attemptDaemonBrokerLogin(opts) {
         }
         if (typeof candidateBootstrap.serverUrl !== 'string' ||
             candidateBootstrap.serverUrl.length === 0) {
-            unboundBootstrap ??= candidateBootstrap;
-            unboundPath ??= candidate;
+            unbound.push(candidateBootstrap);
             continue;
         }
-        bootstrap = candidateBootstrap;
-        usedPath = candidate;
-        break;
-    }
-    if (!bootstrap && unboundBootstrap && unboundPath) {
-        bootstrap = unboundBootstrap;
-        usedPath = unboundPath;
+        usable.push(candidateBootstrap);
     }
-    if (!bootstrap || !usedPath) {
+    usable.push(...unbound);
+    if (usable.length === 0) {
         if (mismatchedBootstrap?.serverUrl) {
             return {
                 ok: false,
@@ -296,6 +321,22 @@ async function attemptDaemonBrokerLogin(opts) {
             detail: `No daemon bootstrap file found (looked in ${candidates.join(', ')})`,
         };
     }
+    // A candidate nothing is listening behind moves on to the next one. Liveness is
+    // only a pid check, and EPERM counts as alive — on a Dedicated Runtime guest
+    // nearly every pid belongs to another uid, so a stale island file in the
+    // workload's own home (restored dotfiles, say) passes it and used to shadow the
+    // daemon's live hand-off descriptor forever, with `skrr` reporting "Not signed
+    // in". Only a refused connection falls through: any answer, or a timeout, is a
+    // daemon that is really there, and its outcome stands.
+    let outcome = null;
+    for (const bootstrap of usable) {
+        outcome = await brokerThrough(bootstrap, opts);
+        if (outcome.ok || outcome.reason !== 'network')
+            return outcome;
+    }
+    return outcome;
+}
+async function brokerThrough(bootstrap, opts) {
     const url = `http://${bootstrap.host}:${bootstrap.port}/v1/auth/cli-handoff`;
     const timeoutMs = opts.timeoutMs ?? REQUEST_TIMEOUT_MS;
     const controller = new AbortController();