@skrr-ai/cli 0.1.49 → 0.1.51

package/dist/lib/agentic-stream.js

@@ -2,17 +2,22 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AgenticStreamClient = exports.USER_CONNECTION_CAP_CODE = exports.NON_INTERACTIVE_QUESTION_DISMISSAL = void 0;
 exports.writeJsonLine = writeJsonLine;
+exports.describePermissionTarget = describePermissionTarget;
 exports.envelopesText = envelopesText;
 exports.envelopeKey = envelopeKey;
 exports.unseenEnvelopes = unseenEnvelopes;
 exports.projectDaemonToolEvents = projectDaemonToolEvents;
+exports.describePermissionDecider = describePermissionDecider;
+exports.projectPermissionResolutions = projectPermissionResolutions;
 exports.renderableDelta = renderableDelta;
 exports.transportRefusal = transportRefusal;
 exports.transportRefusalMessage = transportRefusalMessage;
 exports.attachDeadlineFor = attachDeadlineFor;
 exports.jitteredRetryDelay = jitteredRetryDelay;
+exports.projectSessionNotices = projectSessionNotices;
 exports.detectSeqGap = detectSeqGap;
 exports.seqGapNotice = seqGapNotice;
+exports.describeRunPermission = describeRunPermission;
 exports.toWebSocketOrigin = toWebSocketOrigin;
 const node_readline_1 = require("node:readline");
 const socket_io_client_1 = require("socket.io-client");
@@ -48,6 +53,71 @@ exports.NON_INTERACTIVE_QUESTION_DISMISSAL = 'No answer: this turn was started n
 function writeJsonLine(output, value) {
     output.write(`${JSON.stringify(value) ?? 'null'}\n`);
 }
+const PERMISSION_DETAIL_MAX = 400;
+/**
+ * What a permission request would DO, in one line a person can judge.
+ *
+ * The prompt used to be `Allow tool <name>?` and nothing else, so a shell
+ * approval read "Allow tool unknown? [y/N]" and a person approved a command
+ * they never saw (OSK-12119). The command, or else the path, or else the
+ * arguments, is the part that decides the answer.
+ *
+ * The text is chosen by the agent and printed to a terminal, so control
+ * characters are escaped: an embedded carriage return or escape sequence could
+ * otherwise redraw the line and show the person a different command than the
+ * one they are approving.
+ */
+function describePermissionTarget(toolInput) {
+    if (!toolInput || typeof toolInput !== 'object' || Array.isArray(toolInput))
+        return null;
+    const input = toolInput;
+    const pick = (...keys) => {
+        for (const key of keys) {
+            const value = input[key];
+            if (typeof value === 'string' && value.trim())
+                return value;
+            if (Array.isArray(value) && value.length > 0 && value.every((v) => typeof v === 'string')) {
+                return value.join(' ');
+            }
+        }
+        return null;
+    };
+    let detail = pick('command', 'cmd', 'script');
+    if (!detail) {
+        const target = pick('file_path', 'filePath', 'path', 'url');
+        if (target)
+            detail = target;
+    }
+    if (!detail) {
+        if (Object.keys(input).length === 0)
+            return null;
+        try {
+            detail = JSON.stringify(input);
+        }
+        catch {
+            return null;
+        }
+    }
+    let escaped = '';
+    for (const c of detail) {
+        const code = c.charCodeAt(0);
+        const control = code < 0x20 || (code >= 0x7f && code <= 0x9f);
+        if (!control)
+            escaped += c;
+        else
+            escaped += c === '\n' ? '\\n' : `\\x${code.toString(16).padStart(2, '0')}`;
+    }
+    return escaped.length > PERMISSION_DETAIL_MAX
+        ? `${escaped.slice(0, PERMISSION_DETAIL_MAX)}… (${escaped.length - PERMISSION_DETAIL_MAX} more characters)`
+        : escaped;
+}
+function describePermission(event) {
+    // Permission events carry toolName/toolInput beyond the base event type.
+    const fields = event;
+    const name = String(fields.toolName ?? 'unknown');
+    const detail = describePermissionTarget(fields.toolInput);
+    return detail ? `${name}: ${detail}` : name;
+}
 /**
  * Small Node-side adapter for the existing Agentic Socket.IO contract.
  * It deliberately normalizes only lifecycle/text/tool events; the server's
@@ -179,6 +249,82 @@ function projectDaemonToolEvents(envelopes, namesByCall) {
     }
     return out;
 }
+const SURFACE_LABELS = {
+    web: 'the web app',
+    cli: 'the skrr CLI',
+    desktop: 'the desktop app',
+    mobile: 'the mobile app',
+};
+/** `by` alone, for a daemon that predates `basis` — said no more precisely than it knows. */
+const BY_LABELS = {
+    cockpit: 'an answer relayed by the server',
+    avatar: 'a person on the desktop app',
+    timeout: 'nobody — the request timed out',
+    server: 'the server (the run is unattended, so nobody could be asked)',
+    cli: 'the harness side, without asking anyone',
+    cache: 'an earlier decision for this session',
+};
+/**
+ * WHO or WHAT decided a permission request, as a reader needs it (OSK-12113).
+ *
+ * `by` names the surface or fallback that resolved the ask and is a closed wire
+ * enum; `basis` beside it says what decided. The distinction is the finding: an
+ * edit acceptEdits applied on its own was recorded `by: "cli"`, which read as
+ * the CLI user having approved something nobody was asked about.
+ */
+function describePermissionDecider(ev) {
+    const mode = typeof ev.mode === 'string' && ev.mode ? ev.mode : '';
+    switch (ev.basis) {
+        case 'mode':
+            return mode
+                ? `the ${mode} permission mode (nobody was asked)`
+                : "the session's permission mode (nobody was asked)";
+        case 'policy':
+            return ev.by === 'server'
+                ? 'the unattended-run policy (nobody could be asked)'
+                : 'a runtime policy (nobody was asked)';
+        case 'session-grant':
+            return 'an earlier "allow for this session"';
+        case 'person': {
+            const where = typeof ev.surface === 'string' ? SURFACE_LABELS[ev.surface] : undefined;
+            return where ? `a person on ${where}` : 'a person';
+        }
+        default:
+            return (typeof ev.by === 'string' && BY_LABELS[ev.by]) || 'an unrecorded decider';
+    }
+}
+/**
+ * Daemon `permission-resolved` envelopes as `permission.resolved` events, named
+ * by the tool their `permission-ask` announced and carrying who decided.
+ */
+function projectPermissionResolutions(envelopes, toolsByRequest) {
+    const out = [];
+    for (const envelope of envelopes) {
+        const ev = envelope?.ev;
+        if (!ev || typeof ev.requestId !== 'string')
+            continue;
+        if (ev.t === 'permission-ask') {
+            if (typeof ev.toolName === 'string')
+                toolsByRequest.set(ev.requestId, ev.toolName);
+            continue;
+        }
+        if (ev.t !== 'permission-resolved')
+            continue;
+        const toolName = toolsByRequest.get(ev.requestId);
+        out.push({
+            type: 'permission.resolved',
+            requestId: ev.requestId,
+            ...(toolName ? { toolName } : {}),
+            decision: ev.decision,
+            by: ev.by,
+            ...(typeof ev.basis === 'string' ? { basis: ev.basis } : {}),
+            ...(typeof ev.mode === 'string' ? { mode: ev.mode } : {}),
+            ...(typeof ev.surface === 'string' ? { surface: ev.surface } : {}),
+            decidedBy: describePermissionDecider(ev),
+        });
+    }
+    return out;
+}
 /**
  * The part of a cumulative snapshot that has not been shown yet.
  *
@@ -271,6 +417,23 @@ function attachDeadlineFor(timeoutMs, refusal) {
 function jitteredRetryDelay(retryAfterMs, random = Math.random) {
     return Math.round(retryAfterMs * (1 + random() * 0.25));
 }
+/**
+ * `service` envelopes that carry a `notice` — words for the person, not
+ * diagnostics — projected as `session.notice` events. Today the only notice is
+ * `harness-session-reset`: the local harness could not resume its previous
+ * session and began a new one, so its local working context is gone.
+ */
+function projectSessionNotices(envelopes) {
+    const out = [];
+    for (const envelope of envelopes) {
+        const ev = envelope?.ev;
+        if (ev?.t !== 'service' || typeof ev.notice !== 'string' || typeof ev.text !== 'string') {
+            continue;
+        }
+        out.push({ type: 'session.notice', notice: ev.notice, message: ev.text });
+    }
+    return out;
+}
 function detectSeqGap(highestApplied, incoming) {
     if (!Number.isFinite(incoming) || incoming <= 0)
         return null;
@@ -281,11 +444,54 @@ function detectSeqGap(highestApplied, incoming) {
         return null;
     return { from: highestApplied + 1, to: incoming - 1 };
 }
-function seqGapNotice(gap) {
+/**
+ * The notice a reader sees when chunks went missing.
+ *
+ * It names `run.result` only when this client will actually fill `run.result`
+ * from the persisted message (`recordBackfill`). The sentence used to promise
+ * it unconditionally, while `run.result.text` was folded from the envelopes
+ * that DID arrive — so the one run told to trust `run.result` was the run whose
+ * `run.result.text` was empty, with the answer only in the record (OSK-12132).
+ */
+function seqGapNotice(gap, options = {}) {
     const count = gap.to - gap.from + 1;
+    const where = options.recordBackfill === false
+        ? 'The full answer is in the persisted message.'
+        : 'The full answer is in the persisted message and in run.result.';
     return (`[${count} stream chunk${count === 1 ? '' : 's'} (seq ${gap.from}` +
         `${count === 1 ? '' : `-${gap.to}`}) never arrived — the text above is incomplete. ` +
-        'The full answer is in the persisted message and in run.result.]');
+        `${where}]`);
+}
+/** How long, at most, a gapped run waits for the record before settling anyway. */
+const GAP_BACKFILL_ATTEMPTS = 3;
+const GAP_BACKFILL_RETRY_MS = 400;
+const PERMISSION_SOURCE_LABELS = {
+    request: 'this turn',
+    agent: "the agent's default",
+    harness: "the harness's default",
+    contract: 'the execution contract',
+    policy: 'the unattended-run policy',
+};
+/**
+ * The permission mode a `run.started` reports, and where it came from
+ * (OSK-12089). `null` when the event carries no mode report at all — a cloud
+ * turn from an older server, say — so nothing is claimed.
+ */
+function describeRunPermission(event) {
+    const source = typeof event.permissionModeSource === 'string' ? event.permissionModeSource : '';
+    const mode = typeof event.permissionMode === 'string' && event.permissionMode ? event.permissionMode : '';
+    if (!source)
+        return null;
+    if (!mode) {
+        return source === 'daemon'
+            ? "set by the daemon's own config on that machine (no agent, harness or turn mode is set)"
+            : 'unknown';
+    }
+    const from = PERMISSION_SOURCE_LABELS[source] ?? source;
+    const coerced = typeof event.permissionModeCoercedFrom === 'string' && event.permissionModeCoercedFrom
+        ? ` — ${event.permissionModeCoercedFrom} was asked for, which this harness cannot honour`
+        : '';
+    return `${mode} (from ${from})${coerced}`;
 }
 class AgenticStreamClient {
     options;
@@ -316,6 +522,8 @@ class AgenticStreamClient {
     seenLifecycle = new Set();
     /** `call` → tool name, so a daemon `tool-call-end` can be named (OSK-7730). */
     toolNamesByCall = new Map();
+    /** `permission-ask` requestId → tool name, to name its resolution (OSK-12113). */
+    toolNamesByPermission = new Map();
     /** Text already written to the terminal, for suffix-only rendering. */
     renderedText = '';
     idleTimer = null;
@@ -507,7 +715,7 @@ class AgenticStreamClient {
                     sessionId: this.options.sessionId,
                     fromSeq: gap.from,
                     toSeq: gap.to,
-                    message: seqGapNotice(gap),
+                    message: seqGapNotice(gap, { recordBackfill: Boolean(this.options.reconcileTerminal) }),
                 });
             }
             if (seq > this.highestSeq)
@@ -605,6 +813,18 @@ class AgenticStreamClient {
                 for (const projected of projectDaemonToolEvents(fresh, this.toolNamesByCall)) {
                     this.emitToolEvent({ ...projected, sessionId: this.options.sessionId });
                 }
+                // Notices meant for the person — a local harness that could not resume
+                // its previous session and started a fresh one (OSK-12131). A plain
+                // `service` line is diagnostic chatter and stays in the envelope; one
+                // marked `notice` is said out loud.
+                for (const notice of projectSessionNotices(fresh)) {
+                    this.emit({ ...notice, sessionId: this.options.sessionId });
+                }
+                // Who decided each permission request — a person (and where), the
+                // mode, a policy — said beside the decision (OSK-12113).
+                for (const resolved of projectPermissionResolutions(fresh, this.toolNamesByPermission)) {
+                    this.emit({ ...resolved, sessionId: this.options.sessionId });
+                }
                 this.emit({ ...scoped, type: 'session.output' });
                 return;
             }
@@ -731,7 +951,7 @@ class AgenticStreamClient {
             });
             return;
         }
-        const answer = await this.ask(`Allow tool ${event.toolName ?? 'unknown'}? [y/N] `);
+        const answer = await this.ask(`Allow ${describePermission(event)}? [y/N] `);
         const approved = /^y(es)?$/i.test(answer.trim());
         this.socket.emit(approved ? 'permission:approve' : 'permission:deny', {
             sessionId: this.options.sessionId,
@@ -843,7 +1063,19 @@ class AgenticStreamClient {
             writeJsonLine(output, event);
             return;
         }
-        if (event.type === 'text.delta' && typeof event.text === 'string') {
+        if (event.type === 'run.started') {
+            const permission = describeRunPermission(event);
+            if (permission)
+                output.write(`[run] permission: ${permission}\n`);
+        }
+        else if ((event.type === 'run.completed' || event.type === 'run.failed') &&
+            typeof event.harnessModel === 'string' &&
+            event.harnessModel) {
+            // Which model the harness ran — the agent's pick, or what `default`
+            // resolved to on that machine (OSK-12111).
+            output.write(`[run] model: ${event.harnessModel} (reported by the harness)\n`);
+        }
+        else if (event.type === 'text.delta' && typeof event.text === 'string') {
             // Print what is NEW. See `renderableDelta` — the old `\r` repaint could
             // not rewind past a newline, so a multi-line answer was reprinted once
             // per snapshot and its blocks fused (OSK-7701, OSK-7731).
@@ -870,18 +1102,31 @@ class AgenticStreamClient {
             output.write(`\n${String(event.message ?? '')}\n`);
             this.renderedText = this.accumulated;
         }
+        else if (event.type === 'permission.resolved') {
+            const verb = event.decision === 'allow' ? 'allowed' : 'denied';
+            output.write(`\n[permission] ${String(event.toolName ?? 'tool')} ${verb} by ${String(event.decidedBy ?? '')}\n`);
+            this.renderedText = this.accumulated;
+        }
+        else if (event.type === 'session.notice') {
+            output.write(`\n[session] ${String(event.message ?? '')}\n`);
+            this.renderedText = this.accumulated;
+        }
         else if (event.type === 'transport.disconnected') {
             output.write(`\n[reconnecting] ${String(event.reason ?? '')}\n`);
             this.renderedText = this.accumulated;
         }
-        else if (event.type === 'permission.requested' || event.type === 'question.requested') {
+        else if (event.type === 'permission.requested') {
+            output.write(`\n[${event.type}] ${describePermission(event)}\n`);
+            this.renderedText = this.accumulated;
+        }
+        else if (event.type === 'question.requested') {
             output.write(`\n[${event.type}]\n`);
             this.renderedText = this.accumulated;
         }
         else if (event.type === 'permission.approved' && event.auto === true) {
             // Said out loud, because nobody was asked: the flag approved it, and a
             // reader of this log should see which tools that covered (OSK-10323).
-            output.write(`\n[permission] ${String(event.toolName ?? 'unknown')} allowed by --approve-tools\n`);
+            output.write(`\n[permission] ${describePermission(event)} allowed by --approve-tools\n`);
             this.renderedText = this.accumulated;
         }
         else if (event.type === 'question.answered' && event.nonInteractive) {
@@ -894,6 +1139,42 @@ class AgenticStreamClient {
             return;
         this.settled = true;
         this.lastEvent = event;
+        // A stream that lost chunks told its reader the full answer would be in
+        // `run.result`. The terminal event does not always carry it — a failed
+        // turn's `execution:error` has no `result` — so read it from the record
+        // before settling, or the promise is false exactly when it was made
+        // (OSK-12132).
+        if (this.reportedGap && this.options.reconcileTerminal) {
+            void this.readRecordedText().then((recorded) => this.settle(status, event, recorded));
+            return;
+        }
+        this.settle(status, event, undefined);
+    }
+    /**
+     * The answer as the durable record holds it, for a run whose stream had a
+     * hole. Bounded: the record is written before the terminal event is sent, so
+     * it is normally there at once, and a record that stays silent must not hold
+     * the run open — the reader then gets what the stream delivered.
+     */
+    async readRecordedText() {
+        const reconcile = this.options.reconcileTerminal;
+        if (!reconcile)
+            return undefined;
+        for (let attempt = 0; attempt < GAP_BACKFILL_ATTEMPTS; attempt += 1) {
+            if (attempt > 0)
+                await new Promise((r) => setTimeout(r, GAP_BACKFILL_RETRY_MS));
+            try {
+                const terminal = await reconcile();
+                if (terminal && typeof terminal.text === 'string' && terminal.text)
+                    return terminal.text;
+            }
+            catch {
+                // No evidence either way; try again, then settle on the stream.
+            }
+        }
+        return undefined;
+    }
+    settle(status, event, recordedText) {
         // `execution:complete` carries the final answer as `result`, and it is
         // AUTHORITATIVE — preferred over whatever the deltas added up to, not just
         // used when they added up to nothing.
@@ -922,6 +1203,12 @@ class AgenticStreamClient {
         if (finalText && finalText !== this.accumulated && !accumulationIsSuperset) {
             this.accumulated = finalText;
         }
+        // The record wins over a stream known to have lost chunks, unless what
+        // arrived is already longer (the record lags a completed stream, never the
+        // other way round).
+        if (recordedText && recordedText.length > this.accumulated.length) {
+            this.accumulated = recordedText;
+        }
         // The finished answer, as every other surface shows it: the web applies
         // this same sanitizer, so a scheduling JSON block or leaked function-call
         // XML the model wrote into its reply is removed here too instead of being

package/dist/lib/api-fetch.js

@@ -42,6 +42,7 @@ const idempotency_scope_1 = require("./idempotency-scope");
 const node_adapter_1 = require("./node-adapter");
 const refresh_1 = require("./refresh");
 const delegated_cli_1 = require("./delegated-cli");
+const daemonBroker_1 = require("./daemonBroker");
 const workspace_header_1 = require("./workspace-header");
 const non_json_response_1 = require("./non-json-response");
 class ApiFetchError extends Error {
@@ -191,6 +192,24 @@ async function apiFetch(pathOrUrl, opts = {}) {
             res = await fetchWithCredential(cred);
         }
     }
+    else if (res.status === 401 &&
+        (0, daemonBroker_1.isBrokeredHandoffToken)(cred.token) &&
+        !isAuthEndpoint(pathOrUrl)) {
+        // Broker-mode hand-off credential: nothing was persisted, so there is no
+        // stored family for `ensureFreshCliCredential` to rotate. Re-redeem over
+        // loopback once (forceRefresh bypasses the daemon's cached token) and
+        // retry once — the same recovery contract the delegated path has.
+        const fresh = await (0, daemonBroker_1.redeemBrokeredHandoffToken)(true);
+        if (fresh?.accessToken) {
+            cred = {
+                token: fresh.accessToken,
+                source: 'env-token',
+                kind: (0, credential_resolver_1.kindOf)(fresh.accessToken),
+            };
+            (0, node_adapter_1.setAdapterCredentialOverride)(cred);
+            res = await fetchWithCredential(cred);
+        }
+    }
     else if (res.status === 401 && !autonomousCredential && !isAuthEndpoint(pathOrUrl)) {
         const fresh = await (0, refresh_1.ensureFreshCliCredential)({ credential: cred, force: true });
         if (fresh.refreshed && fresh.credential.token) {

package/dist/lib/auth-core-init.d.ts

@@ -1,4 +1,3 @@
-import { type AuthBundle } from './auth-storage';
 type DedicatedGenerationPreparationOptions = {
     machineUuid?: string;
     configDir?: string;
@@ -43,15 +42,9 @@ export declare class CliCredentialInitializationError extends Error {
  *      `isCredEnvelopeActive()` to decide whether to wrap the private
  *      key on persist.
  *   2. `initDeviceIdentity` second.
- *   3. Server enrollment is fire-and-forget; only attempts if a current
- *      access token is already on disk (peek via the file backend slot
- *      so a missing token short-circuits cleanly without creating a
- *      whole CredentialResolver chain here).
  *
- * The peek path uses `backends.readKeychainToken / readFileToken`
- * directly so we don't accidentally trigger an interactive prompt or
- * spawn the auth-helper when the user is unauthenticated. Mirrors the
- * daemon's `peekAuthAccessToken()` shape.
+ * The CLI never enrolls the device key with the server; see the comment
+ * in `ensureCliAuthPrefetchStarted` (OSK-12063).
  */
 export declare function prefetchCliAuth(): Promise<void>;
 /**
@@ -63,5 +56,4 @@ export declare function prefetchCliAuth(): Promise<void>;
 export declare function waitForCliCredentialEnvelope(): Promise<void>;
 /** @internal Test seam — reset the module-level one-shot initialization. */
 export declare function __resetPrefetchCliAuthForTest(): void;
-export declare function shouldUseAccessTokenForEnrollment(bundle: Pick<AuthBundle, 'token' | 'expiresAt'> | null | undefined, nowMs?: number, minTtlMs?: number): boolean;
 export {};

package/dist/lib/auth-core-init.js

@@ -9,7 +9,6 @@ exports.ensureAuthCoreConfigured = ensureAuthCoreConfigured;
 exports.prefetchCliAuth = prefetchCliAuth;
 exports.waitForCliCredentialEnvelope = waitForCliCredentialEnvelope;
 exports.__resetPrefetchCliAuthForTest = __resetPrefetchCliAuthForTest;
-exports.shouldUseAccessTokenForEnrollment = shouldUseAccessTokenForEnrollment;
 /**
  * auth-core-init.ts — wire @skrr-ai/auth-core into the Sky CLI process.
  *
@@ -31,8 +30,8 @@ exports.shouldUseAccessTokenForEnrollment = shouldUseAccessTokenForEnrollment;
  *     share the daemon's on-disk artifacts (~/.skrr/profiles/<p>/...)
  *     so a single physical machine has ONE device identity that `skrr`
  *     and `oversky` both consume.
- *   - Fire-and-forget enrollment when an access token is already
- *     present — short-circuits silently on a fresh install before login.
+ *   - No server enrollment of the device key: that is the daemon login
+ *     path's job (OSK-12063 — see `ensureCliAuthPrefetchStarted`).
  */
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
@@ -41,7 +40,6 @@ const auth_core_1 = require("@skrr-ai/auth-core");
 const cred_envelope_1 = require("./cred-envelope");
 const device_identity_1 = require("./device-identity");
 const auth_storage_1 = require("./auth-storage");
-const config_1 = require("./config");
 function envFlag(name) {
     const v = process.env[name];
     return v === '1' || v === 'true' || v === 'TRUE';
@@ -135,7 +133,6 @@ const PREFETCH_TIMEOUT_MS = 5_000;
 // with a 100–400 ms backoff (~20 s worst-case). Encrypted credentials get this
 // larger, still-finite budget so lock contention cannot masquerade as logout.
 const ENCRYPTED_CREDENTIAL_INIT_TIMEOUT_MS = 25_000;
-const PREFETCH_ENROLL_MIN_TTL_MS = 5 * 60 * 1000;
 let configured = false;
 function ensureAuthCoreConfigured() {
     if (configured)
@@ -247,31 +244,22 @@ function ensureCliAuthPrefetchStarted() {
         try {
             await envelopeInit;
             await (0, device_identity_1.initDeviceIdentity)(DEFAULT_PROFILE);
-            // Fire-and-forget enrollment. Only attempts when a token is on disk
-            // (i.e., the user has already logged in on this machine). A fresh
-            // install before first login simply skips this branch.
-            const cfg = (0, config_1.loadConfig)();
-            const authBundle = peekStoredAuthBundle(cfg.baseURL);
-            if (!authBundle?.token)
-                return;
-            if (!shouldUseAccessTokenForEnrollment(authBundle))
-                return;
-            if (!(0, device_identity_1.getDevicePublicKey)())
-                return;
-            // machineUuid: shared per-machine UUIDv7 minted by auth-core and
-            // persisted at `~/.skrr/daemon.id`. CLI and daemon both read
-            // and write the same file, so a single physical machine has ONE
-            // identifier across binaries. If the file doesn't exist when CLI
-            // runs first, CLI mints it; when the daemon later starts it
-            // reads the same value.
-            const machineUuid = (0, auth_core_1.ensureMachineDaemonId)();
-            (0, device_identity_1.enrollWithServer)({
-                serverUrl: cfg.baseURL,
-                accessToken: authBundle.token,
-                machineUuid,
-            }).catch(() => {
-                /* enrollment failure is non-fatal */
-            });
+            // The CLI deliberately does NOT enroll a device key with the server
+            // (OSK-12063). Enrollment pins the FIRST key presented on a machine's
+            // Daemon row, and every later refresh signed by a different key is
+            // refused. The CLI and the daemon of one profile can hold DIFFERENT
+            // keys (OSK-10314: the daemon stays on the legacy nested profile dir
+            // while consolidation is deferred), so a CLI enrollment could pin a
+            // key the daemon never signs with and lock the daemon out for good.
+            // Enrollment belongs to the daemon's own login path, which enrolls
+            // the key it will actually use.
+            //
+            // Until OSK-12063 this block did enroll, sending the minted UUIDv7
+            // from `~/.skrr/daemon.id` as `machineUuid`. The comment above it
+            // claimed that was the daemon's identifier too; it was not — the
+            // daemon sends the hardware UUID (`getMachineUuid()`), so every CLI
+            // enrollment 404'd DAEMON_NOT_FOUND and backed off. That 404 was the
+            // only thing keeping the pinning hazard above from firing.
         }
         catch (err) {
             if (process.env.DEBUG) {
@@ -292,15 +280,9 @@ function ensureCliAuthPrefetchStarted() {
  *      `isCredEnvelopeActive()` to decide whether to wrap the private
  *      key on persist.
  *   2. `initDeviceIdentity` second.
- *   3. Server enrollment is fire-and-forget; only attempts if a current
- *      access token is already on disk (peek via the file backend slot
- *      so a missing token short-circuits cleanly without creating a
- *      whole CredentialResolver chain here).
  *
- * The peek path uses `backends.readKeychainToken / readFileToken`
- * directly so we don't accidentally trigger an interactive prompt or
- * spawn the auth-helper when the user is unauthenticated. Mirrors the
- * daemon's `peekAuthAccessToken()` shape.
+ * The CLI never enrolls the device key with the server; see the comment
+ * in `ensureCliAuthPrefetchStarted` (OSK-12063).
  */
 async function prefetchCliAuth() {
     ensureCliAuthPrefetchStarted();
@@ -343,35 +325,6 @@ function __resetPrefetchCliAuthForTest() {
     _credEnvelopeInitPromise = null;
     _credEnvelopeInitStartedAt = 0;
 }
-/**
- * Read the access token from keychain/file backends WITHOUT firing the
- * full CredentialResolver chain. The full chain might prompt, spawn the
- * auth-helper, or have other side effects we don't want during a
- * prefetch-on-init pass.
- */
-function peekStoredAuthBundle(expectedServerOrigin) {
-    try {
-        return (0, auth_storage_1.readFromBackend)(expectedServerOrigin).bundle;
-    }
-    catch {
-        return null;
-    }
-}
-function shouldUseAccessTokenForEnrollment(bundle, nowMs = Date.now(), minTtlMs = PREFETCH_ENROLL_MIN_TTL_MS) {
-    if (!bundle?.token)
-        return false;
-    const expMs = accessExpiryMs(bundle);
-    if (expMs === undefined)
-        return true;
-    return expMs - nowMs > minTtlMs;
-}
-function accessExpiryMs(bundle) {
-    if (typeof bundle.expiresAt === 'number' && Number.isFinite(bundle.expiresAt)) {
-        return bundle.expiresAt;
-    }
-    const exp = (0, auth_core_1.decodeJwtExpiry)(bundle.token);
-    return typeof exp === 'number' && Number.isFinite(exp) ? exp * 1000 : undefined;
-}
 // Eager-configure on first import. Cheap and avoids ordering pitfalls in
 // any future command that calls auth-core helpers from outside a Command.
 ensureAuthCoreConfigured();

package/dist/lib/auth-failure.d.ts

@@ -0,0 +1,33 @@
+/**
+ * auth-failure.ts — say WHY a request was refused on authentication (OSK-12116).
+ *
+ * A 401 reaches the CLI after its own renewal has already failed: the access
+ * token expired, the refresh was refused, and the retry went out with the dead
+ * token. The server's answer to that retry is `TOKEN_EXPIRED`, which is true and
+ * useless — the expiry is routine, the refusal to RENEW is the fault, and it was
+ * visible only as an `[auth-core warn]` line on stderr.
+ *
+ * auth-core latches every permanent refresh refusal (`needs-reauth.json`, the
+ * same record `skrr whoami` prints as "Refresh state"). This module reads that
+ * latch and turns it into the sentence the error should have carried.
+ */
+export interface RefreshRefusal {
+    /** Permanent reason code the refresh latched (`REFRESH_INVALID`, `SESSION_REVOKED`, …). */
+    reason?: string;
+    /** The server's own message for the refusal, when auth-core recorded one. */
+    message?: string;
+}
+export interface DescribedAuthFailure {
+    message: string;
+    /** The code a script should key on: the refresh refusal when known. */
+    code: string;
+}
+/**
+ * Explain one refresh refusal in terms of what the reader can do about it.
+ * Returns null when there is no latched refusal, so the caller keeps its
+ * generic wording rather than inventing a cause.
+ */
+export declare function describeRefreshRefusal(refusal: RefreshRefusal | null | undefined, opts: {
+    bin: string;
+    cliId?: string;
+}): DescribedAuthFailure | null;