@skrr-ai/cli 0.1.50 → 0.1.52

package/dist/lib/live-runtime-binary.js

@@ -0,0 +1,193 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.profileFromArgs = profileFromArgs;
+exports.decideStatusBinary = decideStatusBinary;
+exports.describeStatusBinary = describeStatusBinary;
+exports.scriptFromArgs = scriptFromArgs;
+exports.defaultLiveRuntimeDeps = defaultLiveRuntimeDeps;
+/**
+ * Which runtime binary is the LIVE daemon running, and is it the one
+ * `skrr daemon status` is about to forward to? (OSK-12102)
+ *
+ * `execRuntimeBinary` forwards to the first `skrrd` on PATH. That is right for
+ * lifecycle verbs, where PATH order is the person's choice of install. It is
+ * wrong for `status`, whose whole subject is the daemon that is running: with
+ * an old dev build early on PATH and the release daemon live, the header named
+ * `.../releases/0.8.62/skrrd` while the body was rendered by the dev build —
+ * its old layout, no per-category permission table — and nothing on screen
+ * said two binaries were involved.
+ *
+ * The live daemon's pid comes from its island bootstrap file (the same
+ * discovery the CLI's login broker uses); the program from the OS. When the
+ * live program is itself a runtime executable, status is forwarded to it.
+ * When it cannot be exec'd directly (a `node .../dist/index.js` dev daemon),
+ * status stays on the PATH binary and says so.
+ */
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const node_path_1 = __importDefault(require("node:path"));
+const daemonBroker_1 = require("./daemonBroker");
+const exec_runtime_binary_1 = require("./exec-runtime-binary");
+function safeRealpath(deps, p) {
+    try {
+        return deps.realpath(p);
+    }
+    catch {
+        return p;
+    }
+}
+function isRuntimeName(p) {
+    const base = node_path_1.default
+        .basename(p)
+        .toLowerCase()
+        .replace(/\.(exe|cmd)$/, '');
+    return exec_runtime_binary_1.RUNTIME_BINARY_NAMES.some((name) => base === name || base.startsWith(`${name}-`));
+}
+/** The profile a forwarded argv names, `default` otherwise. */
+function profileFromArgs(args) {
+    for (let i = 0; i < args.length; i += 1) {
+        const arg = args[i];
+        if (arg === '--')
+            break;
+        if (arg === '--profile' && args[i + 1] && !args[i + 1].startsWith('-'))
+            return args[i + 1];
+        if (arg.startsWith('--profile=') && arg.length > '--profile='.length) {
+            return arg.slice('--profile='.length);
+        }
+    }
+    return 'default';
+}
+/**
+ * Decide which binary renders `status`. Never throws: a probe that cannot
+ * answer leaves the PATH binary in place (`unknown`).
+ */
+function decideStatusBinary(pathBinary, profile, deps) {
+    let program = null;
+    try {
+        const pid = deps.livePid(profile);
+        program = pid ? deps.programOf(pid) : null;
+    }
+    catch {
+        program = null;
+    }
+    if (!program)
+        return { kind: 'unknown', binary: pathBinary };
+    const pathReal = safeRealpath(deps, pathBinary);
+    const execReal = safeRealpath(deps, program.exec);
+    const scriptReal = program.script ? safeRealpath(deps, program.script) : null;
+    if (pathReal === execReal || (scriptReal !== null && pathReal === scriptReal)) {
+        return { kind: 'same', binary: pathBinary };
+    }
+    // Only a runtime executable is forwarded to. A `node`/Electron-hosted daemon
+    // has an interpreter as its exec, and running the interpreter with status
+    // argv would be nonsense.
+    const directlyRunnable = program.script === null &&
+        (isRuntimeName(program.exec) || isRuntimeName(execReal)) &&
+        deps.isExecutable(program.exec);
+    if (directlyRunnable) {
+        return { kind: 'forward-live', binary: program.exec, pathBinary };
+    }
+    return { kind: 'mismatch', binary: pathBinary, live: program.script ?? program.exec };
+}
+/** One stderr line naming the binary that rendered status, when it is not obvious. */
+function describeStatusBinary(decision) {
+    switch (decision.kind) {
+        case 'forward-live':
+            return (`Rendered by the live daemon's binary ${decision.binary} ` +
+                `(the first skrrd on PATH is ${decision.pathBinary}, a different build).`);
+        case 'mismatch':
+            return (`Rendered by ${decision.binary}, the first skrrd on PATH — NOT the live daemon's ` +
+                `program (${decision.live}). This layout and these checks are that build's, not the live one's.`);
+        default:
+            return null;
+    }
+}
+function darwinProgramOf(pid) {
+    const out = (args) => (0, node_child_process_1.execFileSync)('ps', ['-p', String(pid), '-o', ...args], {
+        encoding: 'utf8',
+        timeout: 2_000,
+        stdio: ['ignore', 'pipe', 'ignore'],
+    }).trim();
+    const exec = out(['comm=']);
+    if (!exec || !node_path_1.default.isAbsolute(exec))
+        return null;
+    return { exec, script: scriptFromArgs(exec, out(['args='])) };
+}
+function linuxProgramOf(pid) {
+    const exec = (0, node_fs_1.readlinkSync)(`/proc/${pid}/exe`);
+    let script = null;
+    try {
+        const cmdline = (0, node_fs_1.readFileSync)(`/proc/${pid}/cmdline`, 'utf8');
+        script = scriptFromArgs(exec, cmdline.split('\0').filter(Boolean).join(' '));
+    }
+    catch {
+        script = null;
+    }
+    return { exec, script };
+}
+/**
+ * For an interpreter-hosted daemon (`node --import x.mjs /x/dist/index.js
+ * start …`), the script: the first argument after the exec that is neither an
+ * option nor the value of a module-loading option. `ps -o args=` is
+ * space-joined, so a path containing a space is not recovered — the result is
+ * only ever used for display and an equality check, where a miss degrades to
+ * the "mismatch" note rather than to a wrong forward.
+ */
+const INTERPRETER_VALUE_OPTIONS = new Set([
+    '-r',
+    '--require',
+    '--import',
+    '--loader',
+    '--experimental-loader',
+    '-e',
+    '--eval',
+]);
+function scriptFromArgs(exec, args) {
+    if (isRuntimeName(exec))
+        return null;
+    const rest = args.startsWith(exec) ? args.slice(exec.length) : args.replace(/^\S+/, '');
+    const tokens = rest.split(/\s+/).filter(Boolean);
+    for (let i = 0; i < tokens.length; i += 1) {
+        const token = tokens[i];
+        if (INTERPRETER_VALUE_OPTIONS.has(token)) {
+            i += 1;
+            continue;
+        }
+        if (token.startsWith('-'))
+            continue;
+        return token;
+    }
+    return null;
+}
+function defaultLiveRuntimeDeps() {
+    return {
+        livePid(profile) {
+            for (const candidate of (0, daemonBroker_1.resolveExactProfileBootstrapPaths)(profile)) {
+                const bootstrap = (0, daemonBroker_1.readBootstrap)(candidate);
+                if (typeof bootstrap?.pid === 'number' && bootstrap.pid > 0)
+                    return bootstrap.pid;
+            }
+            return null;
+        },
+        programOf(pid) {
+            if (process.platform === 'darwin')
+                return darwinProgramOf(pid);
+            if (process.platform === 'linux')
+                return linuxProgramOf(pid);
+            return null;
+        },
+        realpath: (p) => (0, node_fs_1.realpathSync)(p),
+        isExecutable(p) {
+            try {
+                (0, node_fs_1.accessSync)(p, node_fs_1.constants.X_OK);
+                return true;
+            }
+            catch {
+                return false;
+            }
+        },
+    };
+}

package/dist/lib/login.d.ts

@@ -38,6 +38,29 @@ export interface CliLoginWithRefreshTokenOptions {
      */
     cliId: string;
 }
+/**
+ * What a shell with no terminal can do instead (OSK-12117). The refusal used to
+ * name only CI tokens, which is not a sign-in: an agent session asking for one
+ * could only hand the job to a person typing `! skrr login`.
+ */
+export declare const HEADLESS_LOGIN_HINT: string;
+/**
+ * The line printed when the daemon descriptor this CLI found is for another
+ * server (OSK-12117).
+ *
+ * It used to assert "the skrr background service on this computer is logged in
+ * to <url>" and recommend repointing the CLI there. What the CLI actually knows
+ * is narrower: ONE descriptor file it read names that server. That file can
+ * belong to another profile's daemon (observed: a localhost:3080 descriptor
+ * while this machine's default daemon was connected to skrr.ai), and in that
+ * case both the claim and the advice were wrong — the advice by moving a
+ * production CLI onto a development server. So say what was read, from where,
+ * and how to check the daemon itself.
+ */
+export declare function describeBrokerBaseUrlMismatch(failure: {
+    daemonServerUrl?: string;
+    descriptorPath?: string;
+}, serverUrl: string): string;
 /**
  * Top-level dispatcher. Picks PKCE localhost vs device-code per the
  * decision tree in the roadmap and persists the result.

package/dist/lib/login.js

@@ -1,5 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.HEADLESS_LOGIN_HINT = void 0;
+exports.describeBrokerBaseUrlMismatch = describeBrokerBaseUrlMismatch;
 exports.cliLogin = cliLogin;
 exports.cliLoginWithRefreshToken = cliLoginWithRefreshToken;
 /**
@@ -29,12 +31,40 @@ const node_child_process_1 = require("node:child_process");
 const auth_core_1 = require("@skrr-ai/auth-core");
 const auth_storage_1 = require("./auth-storage");
 const config_1 = require("./config");
-const device_id_1 = require("./device-id");
+const cli_identity_1 = require("./cli-identity");
 const ssh_detect_1 = require("./ssh-detect");
 const device_code_1 = require("./device-code");
 const device_identity_1 = require("./device-identity");
 const oauthLogin_1 = require("./oauthLogin");
 const daemonBroker_1 = require("./daemonBroker");
+const daemonBrokerRefusal_1 = require("./daemonBrokerRefusal");
+/**
+ * What a shell with no terminal can do instead (OSK-12117). The refusal used to
+ * name only CI tokens, which is not a sign-in: an agent session asking for one
+ * could only hand the job to a person typing `! skrr login`.
+ */
+exports.HEADLESS_LOGIN_HINT = '`skrr login --device-code` works without a terminal: it prints a URL and a code for a ' +
+    'person to approve in any browser, and finishes when they do. For CI, use ' +
+    '`skrr create-token` and set OVERSKY_TOKEN=osk_ci_...';
+/**
+ * The line printed when the daemon descriptor this CLI found is for another
+ * server (OSK-12117).
+ *
+ * It used to assert "the skrr background service on this computer is logged in
+ * to <url>" and recommend repointing the CLI there. What the CLI actually knows
+ * is narrower: ONE descriptor file it read names that server. That file can
+ * belong to another profile's daemon (observed: a localhost:3080 descriptor
+ * while this machine's default daemon was connected to skrr.ai), and in that
+ * case both the claim and the advice were wrong — the advice by moving a
+ * production CLI onto a development server. So say what was read, from where,
+ * and how to check the daemon itself.
+ */
+function describeBrokerBaseUrlMismatch(failure, serverUrl) {
+    const where = failure.descriptorPath ? ` (${failure.descriptorPath})` : '';
+    return (`  Skipped the daemon hand-off: the daemon descriptor found${where} is for ` +
+        `${failure.daemonServerUrl}, not ${serverUrl}. It may belong to a different profile's ` +
+        'daemon; `skrr daemon status` shows which server this profile’s daemon is on.');
+}
 /**
  * Top-level dispatcher. Picks PKCE localhost vs device-code per the
  * decision tree in the roadmap and persists the result.
@@ -44,16 +74,16 @@ async function cliLogin(opts = {}) {
     const serverUrl = (opts.serverUrl ?? cfg.baseURL).replace(/\/+$/, '');
     const scope = opts.scope ?? 'cli';
     // Persist the cliId on first login so future refreshes present a
-    // stable device identity. Same invariant as the device-code-only
-    // path this supersedes.
-    const cliId = cfg.cliId ?? (0, device_id_1.generateCliId)();
-    if (!cfg.cliId) {
-        (0, config_1.saveConfig)({ ...cfg, cliId });
-    }
+    // stable device identity. A named profile signing in with no credential is
+    // issued its OWN id here, so the hand-off confirm below cannot retire another
+    // profile's session (OSK-12156); see `cli-identity.ts`.
+    const cliId = (0, cli_identity_1.cliIdForLogin)(cfg);
     const envForce = isTruthy(process.env.OVERSKY_FORCE_DEVICE_CODE);
     const ssh = (0, ssh_detect_1.detectSshSession)();
     /** Set when the broker was refused for a reason that WAITING fixes. */
     let brokerRateLimited = false;
+    /** Set when a live daemon answered the hand-off and refused it (OSK-12149). */
+    let brokerRefusal = null;
     // --- Daemon-as-broker pre-flight ---------------------------------------
     // When the local `oversky` daemon is already authenticated for this user
     // on this machine, the cleanest UX is no second browser flow at all:
@@ -100,7 +130,8 @@ async function cliLogin(opts = {}) {
                 };
             }
             console.log('');
-            console.log('  Authorized via the skrr background service on this computer (no browser needed).');
+            console.log('  Authorized via the skrr background service on this computer (no browser needed). ' +
+                'Stored a durable session for this profile.');
             return {
                 token: brokerResult.accessToken,
                 refreshToken: brokerResult.refreshToken,
@@ -148,25 +179,42 @@ async function cliLogin(opts = {}) {
         }
         if (brokerResult.reason === 'base_url_mismatch' && brokerResult.daemonServerUrl) {
             console.log('');
-            console.log(`  The skrr background service on this computer is logged in to ${brokerResult.daemonServerUrl}, but skrr is configured for ${serverUrl}.`);
-            console.log(`  Skipping the daemon-broker handoff. Run \`skrr login --base-url ${brokerResult.daemonServerUrl}\` to use the daemon instead.`);
+            console.log(describeBrokerBaseUrlMismatch(brokerResult, serverUrl));
+        }
+        // The daemon answered and refused. Say so before whatever comes next —
+        // a browser that opens with no stated cause, or a refusal about terminals
+        // that says nothing about the daemon, both hid the real reason.
+        brokerRefusal = (0, daemonBrokerRefusal_1.describeBrokerRefusal)(brokerResult);
+        if (brokerRefusal && !(0, ssh_detect_1.isNonInteractive)()) {
+            console.log('');
+            console.log(`  Asked the local skrr service for a session first. ${brokerRefusal.headline}`);
+            console.log('  Continuing with a sign-in of this CLI’s own.');
         }
-    }
-    if ((0, ssh_detect_1.isNonInteractive)()) {
-        throw new Error(brokerRateLimited
-            ? 'The skrr background service on this computer is being rate-limited while brokering logins, and this ' +
-                'shell cannot run the browser flow instead. The limit is per 15-minute window — ' +
-                'retry shortly. For CI, use `skrr create-token` and set OVERSKY_TOKEN=osk_ci_...'
-            : 'skrr login requires an interactive terminal or an SSH session. ' +
-                'For CI, use `skrr create-token` and set OVERSKY_TOKEN=osk_ci_...');
     }
     // --- Decision tree (first match wins) ---
+    //
+    // Device code BEFORE the terminal check (OSK-12117). It needs no terminal of
+    // its own: it prints a URL and a code, a person approves them in any browser,
+    // and this process polls until they do. That is the one way an agent session
+    // or any other shell without a TTY can finish a login, and the refusal below
+    // used to fire first — so `--device-code` was refused for lacking the very
+    // thing it does not use.
     if (opts.forceDeviceCode) {
         return runDeviceCode(serverUrl, cliId, 'user_requested', ssh);
     }
     if (envForce) {
         return runDeviceCode(serverUrl, cliId, 'env_force', ssh);
     }
+    if ((0, ssh_detect_1.isNonInteractive)()) {
+        throw new Error(brokerRateLimited
+            ? 'The skrr background service on this computer is being rate-limited while brokering logins, and this ' +
+                'shell cannot run the browser flow instead. The limit is per 15-minute window — ' +
+                `retry shortly, or sign in now with ${exports.HEADLESS_LOGIN_HINT}`
+            : brokerRefusal
+                ? `${brokerRefusal.headline} ${brokerRefusal.remedy}\n` +
+                    `skrr login would otherwise open a browser, and this shell has no terminal to run it from. ${exports.HEADLESS_LOGIN_HINT}`
+                : `skrr login opens a browser, and this shell has no terminal to run it from. ${exports.HEADLESS_LOGIN_HINT}`);
+    }
     if (ssh.detected) {
         // Device-code's "open this URL on your laptop" UX is the correct
         // move under SSH — the localhost callback would bind on the remote
@@ -248,9 +296,7 @@ async function cliLoginWithRefreshToken(opts) {
     // the operator retries. The refresh exchange itself is idempotent on
     // the server side (rotation is the unit of retry); writing the cliId
     // up-front never causes a server-state mismatch.
-    if (cfg.cliId !== opts.cliId) {
-        (0, config_1.saveConfig)({ ...cfg, cliId: opts.cliId });
-    }
+    (0, cli_identity_1.persistPresentedCliId)(cfg, opts.cliId);
     let pair;
     try {
         pair = await (0, auth_core_1.refreshDaemonToken)(serverUrl, opts.refreshToken, opts.cliId, {

package/dist/lib/message-intent.js

@@ -11,6 +11,7 @@ exports.canonicalSlackChannelRequest = canonicalSlackChannelRequest;
 exports.canonicalSlackOwnerDmRequest = canonicalSlackOwnerDmRequest;
 exports.rejectAutonomousSlackTarget = rejectAutonomousSlackTarget;
 const auth_core_1 = require("@skrr-ai/auth-core");
+const loopback_http_1 = require("@skrr-ai/auth-core/loopback-http");
 const api_fetch_1 = require("./api-fetch");
 const daemonBroker_1 = require("./daemonBroker");
 const runtime_context_1 = require("./runtime-context");
@@ -152,7 +153,8 @@ async function submitDaemonLoopbackMessageIntent({ context, request, env, bootst
     });
     try {
         const response = await Promise.race([
-            (fetchImpl || globalThis.fetch)(`http://${bootstrap.host}:${bootstrap.port}/v1/agent/message-intents`, {
+            // The daemon secret and session token stay on loopback (OSK-12134).
+            (fetchImpl || loopback_http_1.loopbackFetch)(`http://${bootstrap.host}:${bootstrap.port}/v1/agent/message-intents`, {
                 method: 'POST',
                 headers: {
                     Authorization: `Bearer ${bootstrap.secret}`,

package/dist/lib/oauthLogin.js

@@ -44,7 +44,7 @@ const node_http_1 = __importDefault(require("node:http"));
 const node_child_process_1 = require("node:child_process");
 const auth_storage_1 = require("./auth-storage");
 const config_1 = require("./config");
-const device_id_1 = require("./device-id");
+const cli_identity_1 = require("./cli-identity");
 const publicEndpoints_generated_1 = require("./publicEndpoints.generated");
 // ---------------------------------------------------------------------------
 // PKCE helpers
@@ -272,13 +272,7 @@ async function runOAuthLogin(opts) {
         });
     // Resolve cliId — explicit override wins; otherwise persist on disk
     // so subsequent refreshes present the same device identity.
-    let cliId = opts?.cliId;
-    if (!cliId) {
-        cliId = cfg.cliId ?? (0, device_id_1.generateCliId)();
-        if (!cfg.cliId) {
-            (0, config_1.saveConfig)({ ...cfg, cliId });
-        }
-    }
+    const cliId = opts?.cliId ?? (0, cli_identity_1.cliIdForLogin)(cfg);
     const { codeVerifier, codeChallenge } = generatePkce();
     const state = generateState();
     return new Promise((resolve) => {

package/dist/lib/refresh.js

@@ -27,6 +27,7 @@ Object.defineProperty(exports, "PermanentAuthFailure", { enumerable: true, get:
 Object.defineProperty(exports, "TransientAuthFailure", { enumerable: true, get: function () { return auth_core_1.TransientAuthFailure; } });
 const auth_storage_1 = require("./auth-storage");
 const config_1 = require("./config");
+const cli_id_1 = require("./cli-id");
 const credential_resolver_1 = require("./credential-resolver");
 const device_identity_1 = require("./device-identity");
 exports.CLI_REFRESH_EARLY_MS = 5 * 60 * 1000;
@@ -182,7 +183,10 @@ async function ensureFreshCliCredential(opts = {}) {
  */
 async function refreshCliToken() {
     const cfg = (0, config_1.loadConfig)();
-    if (!cfg.cliId) {
+    // The id the stored credential was minted under — the machine id, or this
+    // profile's own (OSK-12156). One resolver, so refresh cannot disagree with login.
+    const cliId = (0, cli_id_1.resolveCliId)(cfg);
+    if (!cliId) {
         throw new CliRefreshUnavailableError('No CLI identity persisted (cliId). Run `skrr login` to initialize.');
     }
     const origin = getCliOrigin();
@@ -195,7 +199,7 @@ async function refreshCliToken() {
         if (!bundle?.refreshToken) {
             throw new CliRefreshUnavailableError('No refresh token available — sign in with `skrr login`.');
         }
-        const pair = await (0, auth_core_1.refreshDaemonToken)(serverUrl, bundle.refreshToken, cfg.cliId, 
+        const pair = await (0, auth_core_1.refreshDaemonToken)(serverUrl, bundle.refreshToken, cliId, 
         // L11 Phase 3 — attach a device-identity proof to every refresh.
         // The signer returns null when device identity isn't initialized
         // (Phase 1 binary, KEK rotation hot path), and the server's lenient

package/dist/lib/tasks.d.ts

@@ -8,6 +8,25 @@ import type { ParsedDeliverableCoordinate, ParsedExpectationSpec } from '@skrr-a
  */
 export declare function resolveTaskGoalFlag(value: string | undefined): string | null | undefined;
 export declare const TASK_GOAL_NOT_FOUND = "TASK_GOAL_NOT_FOUND";
+/**
+ * `--working-directory` on `tasks create` / `update` / `upsert`. `none`,
+ * `null` and `clear` mean "no per-task override": on update the PATCH sends
+ * `workingDirectory: null` ($unset → inherit the agent default), on create it
+ * stores as absent. The sentinel set mirrors `resolveTaskGoalFlag` — it is the
+ * spelling a user who knows `--goal none` reaches for.
+ * Undefined means the flag was not passed.
+ */
+export declare function workingDirectoryFromFlag(value: string | undefined): string | null | undefined;
+/**
+ * Validate a RESOLVED `workingDirectory` payload value (post-merge, so flag
+ * and `--from-json` inputs are checked identically). `null`/`undefined` are
+ * always fine — they mean "no override". A string must be absolute: the path
+ * is resolved on the daemon's filesystem, so a relative value can neither be
+ * verified here nor trusted there — it would fall back, silently, at run
+ * time. Failing here is the same contract as every other bad spec in this
+ * file: refuse before the write, never store a value that cannot take effect.
+ */
+export declare function workingDirectoryValidationError(value: unknown): string | null;
 /**
  * The refusal for a goal id that names no goal, in CLI terms.
  *
@@ -91,6 +110,7 @@ export type TaskCreateFlagValues = {
     estimate?: number;
     tag?: string[];
     'label-id'?: string[];
+    'working-directory'?: string;
     worktree?: boolean;
     'lifecycle-definition'?: string;
     'lifecycle-version'?: string;

package/dist/lib/tasks.js

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RECOGNIZED_TASK_VERDICTS = exports.DELIVERABLE_LIFECYCLE_VALUES = exports.EXPECT_FLAG_HELP = exports.TASK_WORK_EVENT_KINDS = exports.TASK_PRIORITIES = exports.TASK_GOAL_NOT_FOUND = void 0;
 exports.resolveTaskGoalFlag = resolveTaskGoalFlag;
+exports.workingDirectoryFromFlag = workingDirectoryFromFlag;
+exports.workingDirectoryValidationError = workingDirectoryValidationError;
 exports.describeTaskGoalNotFound = describeTaskGoalNotFound;
 exports.releasePinRepairGuard = releasePinRepairGuard;
 exports.taskUpdateMutationGuard = taskUpdateMutationGuard;
@@ -38,6 +40,7 @@ exports.verdictIsRecognized = verdictIsRecognized;
 const data_provider_1 = require("@skrr-ai/data-provider");
 const prompt_1 = require("./prompt");
 const projects_1 = require("./projects");
+const node_path_1 = require("node:path");
 /**
  * `--goal` on `tasks update`. `none`, `null` and `clear` detach the goal: PATCH
  * sends `goalId: null`. Anything else names a goal. `clear` is accepted because
@@ -54,6 +57,47 @@ function resolveTaskGoalFlag(value) {
     return v;
 }
 exports.TASK_GOAL_NOT_FOUND = 'TASK_GOAL_NOT_FOUND';
+/**
+ * `--working-directory` on `tasks create` / `update` / `upsert`. `none`,
+ * `null` and `clear` mean "no per-task override": on update the PATCH sends
+ * `workingDirectory: null` ($unset → inherit the agent default), on create it
+ * stores as absent. The sentinel set mirrors `resolveTaskGoalFlag` — it is the
+ * spelling a user who knows `--goal none` reaches for.
+ * Undefined means the flag was not passed.
+ */
+function workingDirectoryFromFlag(value) {
+    if (value === undefined)
+        return undefined;
+    const v = value.trim();
+    if (!v || ['none', 'null', 'clear'].includes(v.toLowerCase()))
+        return null;
+    return v;
+}
+/**
+ * Validate a RESOLVED `workingDirectory` payload value (post-merge, so flag
+ * and `--from-json` inputs are checked identically). `null`/`undefined` are
+ * always fine — they mean "no override". A string must be absolute: the path
+ * is resolved on the daemon's filesystem, so a relative value can neither be
+ * verified here nor trusted there — it would fall back, silently, at run
+ * time. Failing here is the same contract as every other bad spec in this
+ * file: refuse before the write, never store a value that cannot take effect.
+ */
+function workingDirectoryValidationError(value) {
+    if (value === undefined || value === null)
+        return null;
+    if (typeof value !== 'string' || !value.trim()) {
+        return 'workingDirectory must be an absolute path string (or null for no override)';
+    }
+    if (value.length > 1024) {
+        return 'workingDirectory must be at most 1024 characters';
+    }
+    if (!(0, node_path_1.isAbsolute)(value.trim())) {
+        return (`workingDirectory must be an absolute path on the daemon's filesystem ` +
+            `(got '${value}'). ` +
+            'A relative path cannot be resolved there — pass the full path, or "none" to clear.');
+    }
+    return null;
+}
 /**
  * The refusal for a goal id that names no goal, in CLI terms.
  *
@@ -331,6 +375,8 @@ function buildTaskCreatePayload(body, flags = {}) {
         // is a Task→Task edge rather than a pointer at a chat message.
         spawnedByTaskId: flags['spawned-by'],
         spawnReason: flags['spawn-reason'],
+        // Per-task working-directory override; 'none' ⇒ null (no override).
+        workingDirectory: workingDirectoryFromFlag(flags['working-directory']),
         // Worktree isolation opt-in. --worktree ⇒ 'ephemeral', --no-worktree ⇒
         // 'shared', omitted ⇒ undefined (inherit space policy / global default).
         executionIsolation: executionIsolationFromWorktreeFlag(flags.worktree),
@@ -409,6 +455,9 @@ function validateTaskCreatePayload(payload) {
     if (payload.templateId !== undefined && !isBoundedString(payload.templateId, 1, 100)) {
         errors.push('templateId must be a non-empty string at most 100 characters');
     }
+    const workingDirectoryError = workingDirectoryValidationError(payload.workingDirectory);
+    if (workingDirectoryError)
+        errors.push(workingDirectoryError);
     if (payload.lifecycle !== undefined) {
         const binding = payload.lifecycle;
         if (!binding || typeof binding !== 'object' || Array.isArray(binding)) {
@@ -538,14 +587,24 @@ async function resolveTaskCreateScope(payload, opts = {}) {
             payload.spaceId = parentSpaceId;
     }
     const projectId = stringValue(payload.projectId);
-    if (projectId && !stringValue(payload.spaceId)) {
+    // A Mongo `_id` is resolved even beside --space: the server addresses a
+    // project by its `id` or its ref only, so passing the `_id` through would
+    // fail there with less to say about it (OSK-12054).
+    if (projectId && (!stringValue(payload.spaceId) || looksLikeStorageId(projectId))) {
         const project = await getCachedProject(projectId, opts.projectCache);
         resolution.project = project;
-        const projectSpaceId = stringValue(project.spaceId);
-        if (!projectSpaceId) {
-            throw new Error(`Project ${projectId} did not return an owning space`);
+        // Accepting a second spelling obliges returning the canonical one: the
+        // write carries `id`, never whatever the caller happened to paste.
+        const canonicalId = stringValue(project.id);
+        if (canonicalId && canonicalId !== projectId)
+            payload.projectId = canonicalId;
+        if (!stringValue(payload.spaceId)) {
+            const projectSpaceId = stringValue(project.spaceId);
+            if (!projectSpaceId) {
+                throw new Error(`Project ${projectId} did not return an owning space`);
+            }
+            payload.spaceId = projectSpaceId;
         }
-        payload.spaceId = projectSpaceId;
     }
     return resolution;
 }
@@ -756,6 +815,11 @@ function createPatchFromCreatePayload(payload) {
         'executionMode',
         'tags',
         'labelIds',
+        // Per-task working-directory override — part of the same execution shape
+        // the create payload carries, and equally meaningful on the update leg of
+        // an upsert. Absent here, `upsert --working-directory` silently no-ops on
+        // an existing task.
+        'workingDirectory',
     ];
     for (const field of copyFields) {
         if (payload[field] !== undefined)
@@ -840,21 +904,36 @@ async function getCachedTask(taskIdValue, cache) {
     }
     return cache.get(taskIdValue);
 }
+/** A 24-hex Mongo ObjectId — the storage `_id` entity JSON prints beside `id`. */
+const STORAGE_ID_RE = /^[0-9a-f]{24}$/i;
+function looksLikeStorageId(value) {
+    return STORAGE_ID_RE.test(value);
+}
+/**
+ * Entity JSON prints both `id` (canonical) and `_id` (storage) with nothing
+ * saying which one commands take, so a pasted `_id` is accepted as the same
+ * project rather than refused as unknown (OSK-12054). The caller then writes
+ * the canonical `id` — see `resolveTaskCreateScope`.
+ */
+function projectMatchesId(project, ref) {
+    return String(project.id ?? '') === ref || String(project._id ?? '') === ref;
+}
 async function getCachedProject(projectId, cache) {
     const load = async () => {
         const filtered = await projects_1.projectApi.search({ q: projectId, limit: 20 });
-        let exact = (0, projects_1.projectsFrom)(filtered).filter((project) => String(project.id ?? project._id ?? '') === projectId);
+        let exact = (0, projects_1.projectsFrom)(filtered).filter((project) => projectMatchesId(project, projectId));
         // The cross-space endpoint's `q` contract covers title/description/ref,
         // not UUID. Fall back to the bounded visible project catalog so canonical
         // IDs still resolve without inventing a second project read endpoint.
         if (exact.length === 0) {
             const catalog = await projects_1.projectApi.search({ limit: 200 });
-            exact = (0, projects_1.projectsFrom)(catalog).filter((project) => String(project.id ?? project._id ?? '') === projectId);
+            exact = (0, projects_1.projectsFrom)(catalog).filter((project) => projectMatchesId(project, projectId));
         }
         if (exact.length !== 1) {
             throw new Error(exact.length > 1
                 ? `Project id ${projectId} matched multiple projects`
-                : `Project id ${projectId} was not found; pass a canonical project id or add --space`);
+                : `Project ${projectId} was not found among the projects you can see. Pass the ` +
+                    "project's `id` (the uuid `projects list` prints), or its ref (OSK-P-5) together with --space");
         }
         return exact[0];
     };

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/credentialEnvelopeBridge.d.ts

@@ -21,6 +21,8 @@ type DisabledReason = 'kek_unavailable' | 'init_failed' | 'platform_unsupported'
 export declare function __setStateForTest(next: CredEnvelopeState): CredEnvelopeState;
 /** @internal Test seam — read state for assertions. */
 export declare function __getStateForTest(): CredEnvelopeState;
+/** @internal Test seam — each spec owns its warn-dedupe horizon. */
+export declare function __clearWarnDedupeForTest(): void;
 /**
  * Initialize the envelope path. Idempotent — second call when state is
  * non-uninit returns immediately.