@skrr-ai/cli 0.1.50 → 0.1.52

package/dist/lib/exec-runtime-binary.js

@@ -212,9 +212,11 @@ function notInstalledMessage() {
  * preserving "exit code = the daemon's exit code" semantics that scripts
  * may depend on.
  */
-function execRuntimeBinary(args) {
+function execRuntimeBinary(args, opts = {}) {
     return new Promise((resolve, reject) => {
-        const bin = findRuntimeBinary();
+        // `binary` lets `status` render from the LIVE daemon's program rather than
+        // the first one on PATH (OSK-12102); every other verb forwards to PATH.
+        const bin = opts.binary ?? findRuntimeBinary();
         if (!bin) {
             reject(new Error('runtime-binary-not-installed'));
             return;

package/dist/lib/first-party-harness-broker.js

@@ -73,6 +73,7 @@ const api_fetch_1 = require("./api-fetch");
 const auth_storage_1 = require("./auth-storage");
 const auth_core_init_1 = require("./auth-core-init");
 const config_1 = require("./config");
+const cli_id_1 = require("./cli-id");
 const cred_envelope_1 = require("./cred-envelope");
 const device_id_1 = require("./device-id");
 const first_party_harness_1 = require("./first-party-harness");
@@ -259,7 +260,10 @@ async function acquireManagedSession(input = {}, deps = {}) {
                 sessionToken,
                 model: input.model?.trim() || AUTOMATIC_MODEL,
                 localRuntimeId: (deps.localRuntimeId ?? localRuntimeId)(),
-                machineUuid: (deps.machineUuid ?? auth_core_1.ensureMachineDaemonId)(),
+                // The hardware id every Daemon row is keyed on — the same function
+                // the daemon calls — not the minted `~/.skrr/daemon.id` UUIDv7,
+                // so the reservation's attribution joins to this machine (OSK-12063).
+                machineUuid: (deps.machineUuid ?? auth_core_1.getMachineUuid)(),
             }, fetchImpl, acquisition.signal);
         }
         catch (err) {
@@ -856,9 +860,10 @@ function hasLocalCredential() {
 /**
  * This installation's runtime id.
  *
- * Persisted at first login as `cliId`; regenerated deterministically when absent
- * (same hostname+user always yields the same value), matching `daemonBroker.ts`
- * and `refresh.ts`. Normalized to the `cli_` namespace the server requires,
+ * The id login and refresh present, read through `resolveCliId` (a named
+ * profile may have its own, OSK-12156); regenerated deterministically as the
+ * machine id when nothing is stored (same hostname+user always yields the same
+ * value). Normalized to the `cli_` namespace the server requires,
  * because `OVERSKY_CLI_ID` is overlaid verbatim with no format check and a
  * hand-set value would otherwise come back as an opaque
  * `runtime-id-namespace-mismatch`.
@@ -866,7 +871,7 @@ function hasLocalCredential() {
 function localRuntimeId() {
     const configured = (() => {
         try {
-            return (0, config_1.loadConfig)().cliId?.trim();
+            return (0, cli_id_1.resolveCliId)((0, config_1.loadConfig)());
         }
         catch {
             return undefined;

package/dist/lib/harnesses.d.ts

@@ -64,6 +64,16 @@ export interface Harness {
     version?: number;
     claudeEngine?: 'cli' | 'sdk';
     lastSeenAt?: string;
+    /** This harness's own stored permission-mode fallback, when set. */
+    defaultPermissionMode?: string | null;
+    /**
+     * The permission modes this harness can honour, and where the answer came
+     * from — sent by `GET /api/harnesses/:id` for a local row (OSK-12130).
+     */
+    permissionModes?: {
+        modes: string[];
+        source: 'daemon' | 'daemon_record' | 'static' | 'vocabulary' | string;
+    };
     /**
      * Registration metadata. A managed machine's rows carry `machineProduct` and
      * `machineLeaseId`, which is the only link from a lease to the harness rows its

package/dist/lib/keychain.d.ts

@@ -11,6 +11,19 @@ export declare function setActiveProfile(profile: string): void;
  */
 export declare function isProfileResolved(): boolean;
 export declare function getActiveProfile(): string;
+/** The resolved config root this process's credentials belong to. */
+export declare function resolvedConfigRoot(): string;
+/** Is `root` this account's default skrr root, the owner of the legacy slot? */
+export declare function isDefaultConfigRoot(root?: string): boolean;
+/** A slot other than this root's own. */
+export type ForeignSlot = {
+    kind: 'legacy';
+} | {
+    kind: 'displaced';
+    cliId: string;
+};
+/** True when this root's own slot IS the historical profile-only slot. */
+export declare function isLegacySlotCurrent(): boolean;
 /** @internal exposed for tests / diagnostics. */
 export declare function __currentServiceForTest(): string;
 /**
@@ -47,6 +60,32 @@ export declare function readServerOrigin(): string | null;
 export declare function writeServerOrigin(origin: string): boolean;
 /** Remove the issuing-origin companion slot. */
 export declare function deleteServerOrigin(): void;
+/** Raw owner record (`{configRoot, cliId}` JSON) of this root's own slot. */
+export declare function readOwner(): string | null;
+export declare function writeOwner(owner: string): boolean;
+export declare function deleteOwner(): void;
+/** Every value a CLI bundle keeps in the Keychain, read from one service. */
+export interface KeychainBundleSlots {
+    token: KeychainEntry;
+    refresh: KeychainEntry | null;
+    serverOrigin: string | null;
+    owner: string | null;
+}
+/**
+ * Read a whole bundle from a slot this root does not own (the legacy slot, or a
+ * displaced one). The caller decides whether it is ours; nothing here rewrites
+ * a slot on another config's behalf.
+ */
+export declare function readBundleAt(slot: ForeignSlot): KeychainBundleSlots | null;
+/**
+ * Copy every item of one slot to another BYTE FOR BYTE (the displacement
+ * rescue). Raw on purpose: the secret items may be sealed under the owning
+ * config's envelope key, and re-sealing them under ours would make the copy
+ * unreadable to the one config it exists for.
+ */
+export declare function copyBundle(from: ForeignSlot, to: ForeignSlot): boolean;
+/** Remove every CLI item under a slot this root does not own. The caller proves ownership. */
+export declare function deleteAllAt(slot: ForeignSlot): void;
 export declare function deleteToken(): void;
 export declare function deleteRefreshToken(): void;
 /**

package/dist/lib/keychain.js

@@ -1,9 +1,45 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_PROFILE = void 0;
 exports.setActiveProfile = setActiveProfile;
 exports.isProfileResolved = isProfileResolved;
 exports.getActiveProfile = getActiveProfile;
+exports.resolvedConfigRoot = resolvedConfigRoot;
+exports.isDefaultConfigRoot = isDefaultConfigRoot;
+exports.isLegacySlotCurrent = isLegacySlotCurrent;
 exports.__currentServiceForTest = __currentServiceForTest;
 exports.isAvailable = isAvailable;
 exports.resetAvailability = resetAvailability;
@@ -14,6 +50,12 @@ exports.writeRefreshToken = writeRefreshToken;
 exports.readServerOrigin = readServerOrigin;
 exports.writeServerOrigin = writeServerOrigin;
 exports.deleteServerOrigin = deleteServerOrigin;
+exports.readOwner = readOwner;
+exports.writeOwner = writeOwner;
+exports.deleteOwner = deleteOwner;
+exports.readBundleAt = readBundleAt;
+exports.copyBundle = copyBundle;
+exports.deleteAllAt = deleteAllAt;
 exports.deleteToken = deleteToken;
 exports.deleteRefreshToken = deleteRefreshToken;
 exports.deleteLegacyBrandEntries = deleteLegacyBrandEntries;
@@ -42,11 +84,39 @@ exports.resolveProfileFromArgv = resolveProfileFromArgv;
  *   account = "cli-refresh"           → refresh JWT
  *   account = "cli-refresh-expires"   → epoch ms expiry, optional
  *   account = "cli-server-origin"     → issuing API origin (non-secret)
+ *   account = "cli-owner"             → JSON {configRoot, cliId} of the config
+ *                                       that wrote this bundle (non-secret)
+ *
+ * OSK-12135 — the slot is namespaced by CONFIG ROOT as well as profile. The
+ * login Keychain is one per macOS user, but the CLI identity (`cliId`) lives in
+ * the config root, so a second skrr setup on the same Mac (a different HOME or
+ * `SKRR_CONFIG_DIR`) with the same profile name used to write into this
+ * profile's slot, and the next refresh presented a token bound to the other
+ * setup's `cliId` (`stored=cli_devin_dogfood presented=cli_81ff3efd4ff8`).
+ *
+ *   - The account's DEFAULT root (`<passwd home>/.skrr`) keeps the historical
+ *     service name `ai.skrr.cli.<profile>`, so a normal single-config machine
+ *     reads exactly the slot it always has — no migration, no re-login, and an
+ *     older skrr binary sharing that config keeps interoperating.
+ *   - Any other root writes `ai.skrr.cli.<profile>.root-<sha256(root)[:12]>`,
+ *     a region no other root can name. It may READ the legacy slot as a
+ *     migration, and only when that bundle positively belongs to it (see
+ *     `auth-storage.ts`).
+ *   - `ai.skrr.cli.<profile>.cli-<cliId>` holds a credential the default root
+ *     DISPLACED from its own slot because an older binary of another config
+ *     wrote it there. It is keyed by the identity the server bound it to, so
+ *     only that config can adopt it, and a login destroys nobody's credential.
+ *
+ * The passwd home (not `$HOME`) defines "default", because a setup that swaps
+ * `$HOME` is exactly the second config this protects against.
  *
  * On non-darwin (Linux/CI) every function is a no-op / null-return so the
  * caller cleanly falls back to the file-based `cli-auth.json` backend.
  */
 const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = require("node:crypto");
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
 const cred_envelope_1 = require("./cred-envelope");
 const auth_core_1 = require("@skrr-ai/auth-core");
 /** Service-name prefix. Always followed by `.<profile>`. */
@@ -58,6 +128,7 @@ const ACCOUNT_EXPIRES = 'cli-token-expires';
 const ACCOUNT_REFRESH = 'cli-refresh';
 const ACCOUNT_REFRESH_EXPIRES = 'cli-refresh-expires';
 const ACCOUNT_SERVER_ORIGIN = 'cli-server-origin';
+const ACCOUNT_OWNER = 'cli-owner';
 /** macOS `security` exit code when the requested item does not exist. */
 const SECURITY_ITEM_NOT_FOUND = 44;
 /** Cached availability — probed once at first call. */
@@ -95,9 +166,55 @@ function isProfileResolved() {
 function getActiveProfile() {
     return _activeProfile;
 }
-function currentService() {
+/** The resolved config root this process's credentials belong to. */
+function resolvedConfigRoot() {
+    return path.resolve((0, auth_core_1.resolveConfigRoot)());
+}
+/**
+ * The account's home from the user database, NOT `$HOME`. A second skrr setup
+ * that swaps `$HOME` must not count as the default root, or it would share the
+ * historical slot with the real one — the incident this namespacing exists for.
+ */
+function accountHome() {
+    try {
+        const home = os.userInfo().homedir;
+        if (home)
+            return home;
+    }
+    catch {
+        /* no passwd entry (some containers) — fall through */
+    }
+    return os.homedir();
+}
+/** Is `root` this account's default skrr root, the owner of the legacy slot? */
+function isDefaultConfigRoot(root = resolvedConfigRoot()) {
+    return path.resolve(root) === path.resolve(accountHome(), '.skrr');
+}
+function legacyService() {
     return `${SERVICE_BASE}.${_activeProfile}`;
 }
+function currentService() {
+    const root = resolvedConfigRoot();
+    if (isDefaultConfigRoot(root))
+        return legacyService();
+    const digest = (0, node_crypto_1.createHash)('sha256').update(root).digest('hex').slice(0, 12);
+    return `${legacyService()}.root-${digest}`;
+}
+function displacedService(cliId) {
+    // A cliId is `cli_<hex>` in practice; anything else is hashed so the service
+    // name never carries characters `security -i` quoting has to worry about.
+    const safe = /^[A-Za-z0-9_-]{1,64}$/.test(cliId)
+        ? cliId
+        : (0, node_crypto_1.createHash)('sha256').update(cliId).digest('hex').slice(0, 16);
+    return `${legacyService()}.cli-${safe}`;
+}
+function serviceForSlot(slot) {
+    return slot.kind === 'legacy' ? legacyService() : displacedService(slot.cliId);
+}
+/** True when this root's own slot IS the historical profile-only slot. */
+function isLegacySlotCurrent() {
+    return currentService() === legacyService();
+}
 /** @internal exposed for tests / diagnostics. */
 function __currentServiceForTest() {
     return currentService();
@@ -140,7 +257,11 @@ function resetAvailability() {
 function isSecretAccount(account) {
     return account === ACCOUNT_TOKEN || account === ACCOUNT_REFRESH;
 }
-function readSlot(account, service = currentService()) {
+/**
+ * `raw` returns the stored string exactly, with no envelope transform — for
+ * copying another config's item, which may be sealed under a key we lack.
+ */
+function readSlot(account, service = currentService(), raw_ = false) {
     let raw;
     try {
         const out = (0, node_child_process_1.execFileSync)('security', ['find-generic-password', '-s', service, '-a', account, '-w'], { stdio: ['ignore', 'pipe', 'ignore'], encoding: 'utf-8' });
@@ -161,7 +282,7 @@ function readSlot(account, service = currentService()) {
         }
         return null;
     }
-    if (!isSecretAccount(account))
+    if (raw_ || !isSecretAccount(account))
         return raw;
     // L12 — route secret slots through the envelope.
     // - Envelope on disk + path active → returns plaintext.
@@ -172,7 +293,10 @@ function readSlot(account, service = currentService()) {
     const result = (0, cred_envelope_1.maybeDecryptOnRead)(raw);
     if (result.plaintext === null)
         return null;
-    if (result.needsMigration) {
+    // Only this root's OWN slot is upgraded. A slot read as a migration source may
+    // belong to another config, whose envelope key this process does not hold —
+    // sealing it under ours would make it unreadable to its owner (OSK-12135).
+    if (result.needsMigration && service === currentService()) {
         // Best-effort upgrade — a failure here doesn't break the read; the
         // slot just stays plaintext and we'll try again on the next read.
         try {
@@ -191,11 +315,11 @@ function readSlot(account, service = currentService()) {
 function quoteForSecurityInteractive(v) {
     return '"' + v.replace(/\\/g, '\\\\').replace(/"/g, '\\"') + '"';
 }
-function writeSlot(account, value, service = currentService()) {
+function writeSlot(account, value, service = currentService(), raw = false) {
     try {
         // L12 — wrap secret-bearing slots through the envelope when active.
-        // Empty / non-secret slots are passthrough.
-        const wireValue = isSecretAccount(account) ? (0, cred_envelope_1.maybeEncryptForWrite)(value) : value;
+        // Empty / non-secret slots are passthrough, and so is a raw copy.
+        const wireValue = !raw && isSecretAccount(account) ? (0, cred_envelope_1.maybeEncryptForWrite)(value) : value;
         // -i reads commands from stdin so the JWT never appears in argv (it
         // would otherwise be visible to same-UID `ps` observers). -U updates
         // in place instead of failing with "item already exists".
@@ -231,13 +355,11 @@ function deleteSlot(account, service = currentService()) {
         }
     }
 }
-function readToken() {
-    if (!isAvailable())
-        return null;
-    const token = readSlot(ACCOUNT_TOKEN);
+function readEntryAt(service, account, expiresAccount) {
+    const token = readSlot(account, service);
     if (!token)
         return null;
-    const expiresRaw = readSlot(ACCOUNT_EXPIRES);
+    const expiresRaw = readSlot(expiresAccount, service);
     let expiresAt;
     if (expiresRaw) {
         const parsed = Number.parseInt(expiresRaw, 10);
@@ -246,51 +368,41 @@ function readToken() {
     }
     return expiresAt !== undefined ? { token, expiresAt } : { token };
 }
-function writeToken(token, expiresAt) {
-    if (!isAvailable())
-        return false;
-    if (!token)
-        return false;
-    if (!writeSlot(ACCOUNT_TOKEN, token))
+function writeEntryAt(service, account, expiresAccount, token, expiresAt) {
+    if (!writeSlot(account, token, service))
         return false;
     if (expiresAt && Number.isFinite(expiresAt)) {
-        writeSlot(ACCOUNT_EXPIRES, String(Math.trunc(expiresAt)));
+        writeSlot(expiresAccount, String(Math.trunc(expiresAt)), service);
     }
     else {
         // Stale expiry from a prior write would lie about the token's lifetime.
-        deleteSlot(ACCOUNT_EXPIRES);
+        deleteSlot(expiresAccount, service);
     }
     return true;
 }
-function readRefreshToken() {
+function readToken() {
     if (!isAvailable())
         return null;
-    const token = readSlot(ACCOUNT_REFRESH);
+    return readEntryAt(currentService(), ACCOUNT_TOKEN, ACCOUNT_EXPIRES);
+}
+function writeToken(token, expiresAt) {
+    if (!isAvailable())
+        return false;
     if (!token)
+        return false;
+    return writeEntryAt(currentService(), ACCOUNT_TOKEN, ACCOUNT_EXPIRES, token, expiresAt);
+}
+function readRefreshToken() {
+    if (!isAvailable())
         return null;
-    const expiresRaw = readSlot(ACCOUNT_REFRESH_EXPIRES);
-    let expiresAt;
-    if (expiresRaw) {
-        const parsed = Number.parseInt(expiresRaw, 10);
-        if (Number.isFinite(parsed) && parsed > 0)
-            expiresAt = parsed;
-    }
-    return expiresAt !== undefined ? { token, expiresAt } : { token };
+    return readEntryAt(currentService(), ACCOUNT_REFRESH, ACCOUNT_REFRESH_EXPIRES);
 }
 function writeRefreshToken(token, expiresAt) {
     if (!isAvailable())
         return false;
     if (!token)
         return false;
-    if (!writeSlot(ACCOUNT_REFRESH, token))
-        return false;
-    if (expiresAt && Number.isFinite(expiresAt)) {
-        writeSlot(ACCOUNT_REFRESH_EXPIRES, String(Math.trunc(expiresAt)));
-    }
-    else {
-        deleteSlot(ACCOUNT_REFRESH_EXPIRES);
-    }
-    return true;
+    return writeEntryAt(currentService(), ACCOUNT_REFRESH, ACCOUNT_REFRESH_EXPIRES, token, expiresAt);
 }
 /**
  * Read the API origin that issued the active token bundle.
@@ -321,6 +433,82 @@ function deleteServerOrigin() {
         return;
     deleteSlot(ACCOUNT_SERVER_ORIGIN);
 }
+/** Raw owner record (`{configRoot, cliId}` JSON) of this root's own slot. */
+function readOwner() {
+    if (!isAvailable())
+        return null;
+    const value = readSlot(ACCOUNT_OWNER);
+    return value && value.length > 0 ? value : null;
+}
+function writeOwner(owner) {
+    if (!isAvailable())
+        return false;
+    if (!owner)
+        return false;
+    return writeSlot(ACCOUNT_OWNER, owner);
+}
+function deleteOwner() {
+    if (!isAvailable())
+        return;
+    deleteSlot(ACCOUNT_OWNER);
+}
+/**
+ * Read a whole bundle from a slot this root does not own (the legacy slot, or a
+ * displaced one). The caller decides whether it is ours; nothing here rewrites
+ * a slot on another config's behalf.
+ */
+function readBundleAt(slot) {
+    if (!isAvailable())
+        return null;
+    const service = serviceForSlot(slot);
+    const token = readEntryAt(service, ACCOUNT_TOKEN, ACCOUNT_EXPIRES);
+    if (!token)
+        return null;
+    return {
+        token,
+        refresh: readEntryAt(service, ACCOUNT_REFRESH, ACCOUNT_REFRESH_EXPIRES),
+        serverOrigin: readSlot(ACCOUNT_SERVER_ORIGIN, service) || null,
+        owner: readSlot(ACCOUNT_OWNER, service) || null,
+    };
+}
+const BUNDLE_ACCOUNTS = [
+    ACCOUNT_TOKEN,
+    ACCOUNT_EXPIRES,
+    ACCOUNT_REFRESH,
+    ACCOUNT_REFRESH_EXPIRES,
+    ACCOUNT_SERVER_ORIGIN,
+    ACCOUNT_OWNER,
+];
+/**
+ * Copy every item of one slot to another BYTE FOR BYTE (the displacement
+ * rescue). Raw on purpose: the secret items may be sealed under the owning
+ * config's envelope key, and re-sealing them under ours would make the copy
+ * unreadable to the one config it exists for.
+ */
+function copyBundle(from, to) {
+    if (!isAvailable())
+        return false;
+    const source = serviceForSlot(from);
+    const target = serviceForSlot(to);
+    if (readSlot(ACCOUNT_TOKEN, source, true) === null)
+        return false;
+    for (const account of BUNDLE_ACCOUNTS) {
+        const value = readSlot(account, source, true);
+        if (value === null)
+            deleteSlot(account, target);
+        else if (!writeSlot(account, value, target, true))
+            return false;
+    }
+    return true;
+}
+/** Remove every CLI item under a slot this root does not own. The caller proves ownership. */
+function deleteAllAt(slot) {
+    if (!isAvailable())
+        return;
+    const service = serviceForSlot(slot);
+    for (const account of BUNDLE_ACCOUNTS)
+        deleteSlot(account, service);
+}
 function deleteToken() {
     if (!isAvailable())
         return;
@@ -423,6 +611,7 @@ function deleteAll() {
     deleteToken();
     deleteRefreshToken();
     deleteServerOrigin();
+    deleteOwner();
 }
 /**
  * Pull `--profile` out of raw argv.

package/dist/lib/label-ref.d.ts

@@ -102,3 +102,37 @@ export declare class LabelRefError extends Error {
  * label ends up attached to a year of work.
  */
 export declare function resolveLabelRefs(refs: string[] | undefined, context: LabelRefContext): Promise<string[]>;
+/**
+ * Help for a `--tag` flag that sits beside `--label` (OSK-12053).
+ *
+ * Tags and labels are two DIFFERENT vocabularies: a tag is any free string,
+ * stored as typed on `task.tags`; a label is declared (`skrr labels`) and is
+ * what `--label` filters, the board and the label guidance read. The flags used
+ * to be described as "Tag (repeatable)" and "Attach a task label", so a person
+ * wanting the `dogfood` label typed `--tag dogfood` on every task of a program
+ * and none of them was labelled.
+ */
+export declare const TAG_FLAG_HELP: string;
+export interface TagNamingLabel {
+    tag: string;
+    label: LabelRow;
+}
+/**
+ * The `--tag` values that equal a declared label's name, each paired with that
+ * label — the one case where the mistake is certain enough to say so.
+ *
+ * Best-effort by construction: it only ever feeds a WARNING, so a vocabulary
+ * that cannot be read yields no matches rather than an error, and the tags are
+ * stored as typed either way. Nothing is converted into a label implicitly —
+ * which one a person meant is theirs to say, and a warning that names the exact
+ * flag costs one retry.
+ */
+export declare function tagsNamingLabels(tags: string[] | undefined, context: LabelVocabularyContext): Promise<TagNamingLabel[]>;
+/** The stderr line for `tagsNamingLabels` hits; an empty string when there are none. */
+export declare function describeTagsNamingLabels(hits: TagNamingLabel[]): string;
+/**
+ * The whole `--tag` check a write command runs: the warning for tags that equal
+ * a declared label AND were not also attached through `--label` (passing both
+ * is someone doing it right). An empty string means say nothing.
+ */
+export declare function tagLabelWarning(tags: string[] | undefined, attachedLabelIds: string[] | undefined, context: LabelVocabularyContext): Promise<string>;

package/dist/lib/label-ref.js

@@ -33,11 +33,14 @@
  * their path.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LabelRefError = void 0;
+exports.TAG_FLAG_HELP = exports.LabelRefError = void 0;
 exports.looksLikeLabelId = looksLikeLabelId;
 exports.closestNames = closestNames;
 exports.collectLabelVocabulary = collectLabelVocabulary;
 exports.resolveLabelRefs = resolveLabelRefs;
+exports.tagsNamingLabels = tagsNamingLabels;
+exports.describeTagsNamingLabels = describeTagsNamingLabels;
+exports.tagLabelWarning = tagLabelWarning;
 const data_provider_1 = require("@skrr-ai/data-provider");
 const workspaces_1 = require("./workspaces");
 /** A canonical v4 uuid, which is what every label id is. */
@@ -171,3 +174,67 @@ async function resolveLabelRefs(refs, context) {
     }
     return resolved;
 }
+/**
+ * Help for a `--tag` flag that sits beside `--label` (OSK-12053).
+ *
+ * Tags and labels are two DIFFERENT vocabularies: a tag is any free string,
+ * stored as typed on `task.tags`; a label is declared (`skrr labels`) and is
+ * what `--label` filters, the board and the label guidance read. The flags used
+ * to be described as "Tag (repeatable)" and "Attach a task label", so a person
+ * wanting the `dogfood` label typed `--tag dogfood` on every task of a program
+ * and none of them was labelled.
+ */
+exports.TAG_FLAG_HELP = 'Free-form tag (repeatable), stored exactly as typed and never checked against anything. ' +
+    'NOT a label: to classify the task under a declared label (`labels list`), use --label.';
+/**
+ * The `--tag` values that equal a declared label's name, each paired with that
+ * label — the one case where the mistake is certain enough to say so.
+ *
+ * Best-effort by construction: it only ever feeds a WARNING, so a vocabulary
+ * that cannot be read yields no matches rather than an error, and the tags are
+ * stored as typed either way. Nothing is converted into a label implicitly —
+ * which one a person meant is theirs to say, and a warning that names the exact
+ * flag costs one retry.
+ */
+async function tagsNamingLabels(tags, context) {
+    const input = (tags ?? []).map((tag) => tag.trim()).filter(Boolean);
+    if (input.length === 0)
+        return [];
+    let vocabulary;
+    try {
+        vocabulary = await collectLabelVocabulary(context);
+    }
+    catch {
+        return [];
+    }
+    const hits = [];
+    for (const tag of input) {
+        const needle = tag.toLowerCase();
+        const label = vocabulary.find((row) => (row.name ?? '').toLowerCase() === needle);
+        if (label)
+            hits.push({ tag, label });
+    }
+    return hits;
+}
+/** The stderr line for `tagsNamingLabels` hits; an empty string when there are none. */
+function describeTagsNamingLabels(hits) {
+    if (hits.length === 0)
+        return '';
+    const names = hits.map((hit) => `"${hit.tag}"`).join(', ');
+    const flags = hits.map((hit) => `--label ${hit.label.name}`).join(' ');
+    return (`--tag ${names} ${hits.length === 1 ? 'was' : 'were'} stored as free-form ` +
+        `${hits.length === 1 ? 'tag' : 'tags'}, NOT as the declared label of the same name, ` +
+        `so a label filter will not find this task. To attach the label, pass ${flags}.`);
+}
+/**
+ * The whole `--tag` check a write command runs: the warning for tags that equal
+ * a declared label AND were not also attached through `--label` (passing both
+ * is someone doing it right). An empty string means say nothing.
+ */
+async function tagLabelWarning(tags, attachedLabelIds, context) {
+    if (!tags || tags.length === 0)
+        return '';
+    const attached = new Set(attachedLabelIds ?? []);
+    const hits = await tagsNamingLabels(tags, context);
+    return describeTagsNamingLabels(hits.filter((hit) => !attached.has(hit.label.id)));
+}

package/dist/lib/live-runtime-binary.d.ts

@@ -0,0 +1,40 @@
+export interface LiveProgram {
+    /** The executable the OS reports for the live pid. */
+    exec: string;
+    /** For an interpreter-launched daemon, the script it runs. */
+    script: string | null;
+}
+export interface LiveRuntimeDeps {
+    /** pid of the live daemon for `profile`, or null. */
+    livePid(profile: string): number | null;
+    /** The live pid's program, or null when the OS will not say. */
+    programOf(pid: number): LiveProgram | null;
+    realpath(p: string): string;
+    isExecutable(p: string): boolean;
+}
+export type StatusBinaryDecision = {
+    kind: 'same';
+    binary: string;
+} | {
+    kind: 'unknown';
+    binary: string;
+} | {
+    kind: 'forward-live';
+    binary: string;
+    pathBinary: string;
+} | {
+    kind: 'mismatch';
+    binary: string;
+    live: string;
+};
+/** The profile a forwarded argv names, `default` otherwise. */
+export declare function profileFromArgs(args: readonly string[]): string;
+/**
+ * Decide which binary renders `status`. Never throws: a probe that cannot
+ * answer leaves the PATH binary in place (`unknown`).
+ */
+export declare function decideStatusBinary(pathBinary: string, profile: string, deps: LiveRuntimeDeps): StatusBinaryDecision;
+/** One stderr line naming the binary that rendered status, when it is not obvious. */
+export declare function describeStatusBinary(decision: StatusBinaryDecision): string | null;
+export declare function scriptFromArgs(exec: string, args: string): string | null;
+export declare function defaultLiveRuntimeDeps(): LiveRuntimeDeps;