@skrr-ai/cli 0.1.50 → 0.1.52

package/dist/lib/agentic-stream.d.ts

@@ -94,6 +94,20 @@ export type AgenticStreamOptions = {
     /** How long to keep trying to attach before reporting a detach. Default 30s. */
     attachTimeoutMs?: number;
 };
+/**
+ * What a permission request would DO, in one line a person can judge.
+ *
+ * The prompt used to be `Allow tool <name>?` and nothing else, so a shell
+ * approval read "Allow tool unknown? [y/N]" and a person approved a command
+ * they never saw (OSK-12119). The command, or else the path, or else the
+ * arguments, is the part that decides the answer.
+ *
+ * The text is chosen by the agent and printed to a terminal, so control
+ * characters are escaped: an embedded carriage return or escape sequence could
+ * otherwise redraw the line and show the person a different command than the
+ * one they are approving.
+ */
+export declare function describePermissionTarget(toolInput: unknown): string | null;
 /**
  * Small Node-side adapter for the existing Agentic Socket.IO contract.
  * It deliberately normalizes only lifecycle/text/tool events; the server's
@@ -159,6 +173,25 @@ export type ProjectedToolEvent = {
  * of the run. The pairing is unambiguous within a turn.
  */
 export declare function projectDaemonToolEvents(envelopes: unknown[], namesByCall: Map<string, string>): ProjectedToolEvent[];
+/**
+ * WHO or WHAT decided a permission request, as a reader needs it (OSK-12113).
+ *
+ * `by` names the surface or fallback that resolved the ask and is a closed wire
+ * enum; `basis` beside it says what decided. The distinction is the finding: an
+ * edit acceptEdits applied on its own was recorded `by: "cli"`, which read as
+ * the CLI user having approved something nobody was asked about.
+ */
+export declare function describePermissionDecider(ev: {
+    by?: unknown;
+    basis?: unknown;
+    mode?: unknown;
+    surface?: unknown;
+}): string;
+/**
+ * Daemon `permission-resolved` envelopes as `permission.resolved` events, named
+ * by the tool their `permission-ask` announced and carrying who decided.
+ */
+export declare function projectPermissionResolutions(envelopes: unknown[], toolsByRequest: Map<string, string>): AgenticStreamEvent[];
 /**
  * The part of a cumulative snapshot that has not been shown yet.
  *
@@ -262,8 +295,32 @@ export type SeqGap = {
     from: number;
     to: number;
 };
+/**
+ * `service` envelopes that carry a `notice` — words for the person, not
+ * diagnostics — projected as `session.notice` events. Today the only notice is
+ * `harness-session-reset`: the local harness could not resume its previous
+ * session and began a new one, so its local working context is gone.
+ */
+export declare function projectSessionNotices(envelopes: unknown[]): AgenticStreamEvent[];
 export declare function detectSeqGap(highestApplied: number, incoming: number): SeqGap | null;
-export declare function seqGapNotice(gap: SeqGap): string;
+/**
+ * The notice a reader sees when chunks went missing.
+ *
+ * It names `run.result` only when this client will actually fill `run.result`
+ * from the persisted message (`recordBackfill`). The sentence used to promise
+ * it unconditionally, while `run.result.text` was folded from the envelopes
+ * that DID arrive — so the one run told to trust `run.result` was the run whose
+ * `run.result.text` was empty, with the answer only in the record (OSK-12132).
+ */
+export declare function seqGapNotice(gap: SeqGap, options?: {
+    recordBackfill?: boolean;
+}): string;
+/**
+ * The permission mode a `run.started` reports, and where it came from
+ * (OSK-12089). `null` when the event carries no mode report at all — a cloud
+ * turn from an older server, say — so nothing is claimed.
+ */
+export declare function describeRunPermission(event: AgenticStreamEvent): string | null;
 export declare class AgenticStreamClient {
     private readonly options;
     private socket;
@@ -289,8 +346,15 @@ export declare class AgenticStreamClient {
      * repeat count varies run to run and cannot be inferred by a consumer.
      */
     private readonly seenLifecycle;
+    /**
+     * Whether this client's transport has dropped since it first connected. Until
+     * it has, every `session:join` it sends declares a FIRST join (OSK-12124).
+     */
+    private transportDropped;
     /** `call` → tool name, so a daemon `tool-call-end` can be named (OSK-7730). */
     private readonly toolNamesByCall;
+    /** `permission-ask` requestId → tool name, to name its resolution (OSK-12113). */
+    private readonly toolNamesByPermission;
     /** Text already written to the terminal, for suffix-only rendering. */
     private renderedText;
     private idleTimer;
@@ -314,6 +378,21 @@ export declare class AgenticStreamClient {
     settledResult(): AgenticStreamResult | null;
     constructor(options: AgenticStreamOptions);
     run(): Promise<AgenticStreamResult>;
+    /**
+     * The `session:join` payload.
+     *
+     * This client learns its session id from the HTTP acceptance and only then
+     * connects, while a daemon turn publishes its `session:init` at once. The
+     * server drops buffered frames older than the socket's connect time — right
+     * for a RE-connect, which already rendered them, and wrong here, where they
+     * were never seen: `run.started` (the dispatched mode and its source) never
+     * reached a daemon turn's stream (OSK-12124). `firstJoin` says so, and the
+     * server then replays the pre-connect lifecycle frames. Both joins of the
+     * first connection carry it, because the server's replay drains the shared
+     * buffer and either join may be the one that reaches it first; the stream's
+     * own lifecycle dedupe absorbs the overlap. After a drop it is not sent.
+     */
+    private sessionJoinPayload;
     /**
      * (Re)start the silence watchdog that asks the durable record what happened.
      *
@@ -372,6 +451,14 @@ export declare class AgenticStreamClient {
     private emitToolEvent;
     private emit;
     private finish;
+    /**
+     * The answer as the durable record holds it, for a run whose stream had a
+     * hole. Bounded: the record is written before the terminal event is sent, so
+     * it is normally there at once, and a record that stays silent must not hold
+     * the run open — the reader then gets what the stream delivered.
+     */
+    private readRecordedText;
+    private settle;
     /**
      * OSK-2944 — a transient connect failure must not end an ACCEPTED run.
      *

package/dist/lib/agentic-stream.js

@@ -2,17 +2,22 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AgenticStreamClient = exports.USER_CONNECTION_CAP_CODE = exports.NON_INTERACTIVE_QUESTION_DISMISSAL = void 0;
 exports.writeJsonLine = writeJsonLine;
+exports.describePermissionTarget = describePermissionTarget;
 exports.envelopesText = envelopesText;
 exports.envelopeKey = envelopeKey;
 exports.unseenEnvelopes = unseenEnvelopes;
 exports.projectDaemonToolEvents = projectDaemonToolEvents;
+exports.describePermissionDecider = describePermissionDecider;
+exports.projectPermissionResolutions = projectPermissionResolutions;
 exports.renderableDelta = renderableDelta;
 exports.transportRefusal = transportRefusal;
 exports.transportRefusalMessage = transportRefusalMessage;
 exports.attachDeadlineFor = attachDeadlineFor;
 exports.jitteredRetryDelay = jitteredRetryDelay;
+exports.projectSessionNotices = projectSessionNotices;
 exports.detectSeqGap = detectSeqGap;
 exports.seqGapNotice = seqGapNotice;
+exports.describeRunPermission = describeRunPermission;
 exports.toWebSocketOrigin = toWebSocketOrigin;
 const node_readline_1 = require("node:readline");
 const socket_io_client_1 = require("socket.io-client");
@@ -48,6 +53,71 @@ exports.NON_INTERACTIVE_QUESTION_DISMISSAL = 'No answer: this turn was started n
 function writeJsonLine(output, value) {
     output.write(`${JSON.stringify(value) ?? 'null'}\n`);
 }
+const PERMISSION_DETAIL_MAX = 400;
+/**
+ * What a permission request would DO, in one line a person can judge.
+ *
+ * The prompt used to be `Allow tool <name>?` and nothing else, so a shell
+ * approval read "Allow tool unknown? [y/N]" and a person approved a command
+ * they never saw (OSK-12119). The command, or else the path, or else the
+ * arguments, is the part that decides the answer.
+ *
+ * The text is chosen by the agent and printed to a terminal, so control
+ * characters are escaped: an embedded carriage return or escape sequence could
+ * otherwise redraw the line and show the person a different command than the
+ * one they are approving.
+ */
+function describePermissionTarget(toolInput) {
+    if (!toolInput || typeof toolInput !== 'object' || Array.isArray(toolInput))
+        return null;
+    const input = toolInput;
+    const pick = (...keys) => {
+        for (const key of keys) {
+            const value = input[key];
+            if (typeof value === 'string' && value.trim())
+                return value;
+            if (Array.isArray(value) && value.length > 0 && value.every((v) => typeof v === 'string')) {
+                return value.join(' ');
+            }
+        }
+        return null;
+    };
+    let detail = pick('command', 'cmd', 'script');
+    if (!detail) {
+        const target = pick('file_path', 'filePath', 'path', 'url');
+        if (target)
+            detail = target;
+    }
+    if (!detail) {
+        if (Object.keys(input).length === 0)
+            return null;
+        try {
+            detail = JSON.stringify(input);
+        }
+        catch {
+            return null;
+        }
+    }
+    let escaped = '';
+    for (const c of detail) {
+        const code = c.charCodeAt(0);
+        const control = code < 0x20 || (code >= 0x7f && code <= 0x9f);
+        if (!control)
+            escaped += c;
+        else
+            escaped += c === '\n' ? '\\n' : `\\x${code.toString(16).padStart(2, '0')}`;
+    }
+    return escaped.length > PERMISSION_DETAIL_MAX
+        ? `${escaped.slice(0, PERMISSION_DETAIL_MAX)}… (${escaped.length - PERMISSION_DETAIL_MAX} more characters)`
+        : escaped;
+}
+function describePermission(event) {
+    // Permission events carry toolName/toolInput beyond the base event type.
+    const fields = event;
+    const name = String(fields.toolName ?? 'unknown');
+    const detail = describePermissionTarget(fields.toolInput);
+    return detail ? `${name}: ${detail}` : name;
+}
 /**
  * Small Node-side adapter for the existing Agentic Socket.IO contract.
  * It deliberately normalizes only lifecycle/text/tool events; the server's
@@ -179,6 +249,87 @@ function projectDaemonToolEvents(envelopes, namesByCall) {
     }
     return out;
 }
+const SURFACE_LABELS = {
+    web: 'the web app',
+    cli: 'the skrr CLI',
+    desktop: 'the desktop app',
+    mobile: 'the mobile app',
+};
+/** `by` alone, for a daemon that predates `basis` — said no more precisely than it knows. */
+const BY_LABELS = {
+    cockpit: 'an answer relayed by the server',
+    avatar: 'a person on the desktop app',
+    timeout: 'nobody — the request timed out',
+    server: 'the server (the run is unattended, so nobody could be asked)',
+    cli: 'the harness side, without asking anyone',
+    cache: 'an earlier decision for this session',
+};
+/**
+ * WHO or WHAT decided a permission request, as a reader needs it (OSK-12113).
+ *
+ * `by` names the surface or fallback that resolved the ask and is a closed wire
+ * enum; `basis` beside it says what decided. The distinction is the finding: an
+ * edit acceptEdits applied on its own was recorded `by: "cli"`, which read as
+ * the CLI user having approved something nobody was asked about.
+ */
+function describePermissionDecider(ev) {
+    const mode = typeof ev.mode === 'string' && ev.mode ? ev.mode : '';
+    switch (ev.basis) {
+        case 'mode':
+            return mode
+                ? `the ${mode} permission mode (nobody was asked)`
+                : "the session's permission mode (nobody was asked)";
+        case 'policy':
+            if (ev.by === 'server')
+                return 'the unattended-run policy (nobody could be asked)';
+            // A client that denied on its own because it could not ask anyone — the
+            // skrr CLI without --approve-tools, say (OSK-12113).
+            if (typeof ev.surface === 'string' && SURFACE_LABELS[ev.surface]) {
+                return `${SURFACE_LABELS[ev.surface]}, which had nobody to ask (nobody was asked)`;
+            }
+            return 'a runtime policy (nobody was asked)';
+        case 'session-grant':
+            return 'an earlier "allow for this session"';
+        case 'person': {
+            const where = typeof ev.surface === 'string' ? SURFACE_LABELS[ev.surface] : undefined;
+            return where ? `a person on ${where}` : 'a person';
+        }
+        default:
+            return (typeof ev.by === 'string' && BY_LABELS[ev.by]) || 'an unrecorded decider';
+    }
+}
+/**
+ * Daemon `permission-resolved` envelopes as `permission.resolved` events, named
+ * by the tool their `permission-ask` announced and carrying who decided.
+ */
+function projectPermissionResolutions(envelopes, toolsByRequest) {
+    const out = [];
+    for (const envelope of envelopes) {
+        const ev = envelope?.ev;
+        if (!ev || typeof ev.requestId !== 'string')
+            continue;
+        if (ev.t === 'permission-ask') {
+            if (typeof ev.toolName === 'string')
+                toolsByRequest.set(ev.requestId, ev.toolName);
+            continue;
+        }
+        if (ev.t !== 'permission-resolved')
+            continue;
+        const toolName = toolsByRequest.get(ev.requestId);
+        out.push({
+            type: 'permission.resolved',
+            requestId: ev.requestId,
+            ...(toolName ? { toolName } : {}),
+            decision: ev.decision,
+            by: ev.by,
+            ...(typeof ev.basis === 'string' ? { basis: ev.basis } : {}),
+            ...(typeof ev.mode === 'string' ? { mode: ev.mode } : {}),
+            ...(typeof ev.surface === 'string' ? { surface: ev.surface } : {}),
+            decidedBy: describePermissionDecider(ev),
+        });
+    }
+    return out;
+}
 /**
  * The part of a cumulative snapshot that has not been shown yet.
  *
@@ -271,6 +422,23 @@ function attachDeadlineFor(timeoutMs, refusal) {
 function jitteredRetryDelay(retryAfterMs, random = Math.random) {
     return Math.round(retryAfterMs * (1 + random() * 0.25));
 }
+/**
+ * `service` envelopes that carry a `notice` — words for the person, not
+ * diagnostics — projected as `session.notice` events. Today the only notice is
+ * `harness-session-reset`: the local harness could not resume its previous
+ * session and began a new one, so its local working context is gone.
+ */
+function projectSessionNotices(envelopes) {
+    const out = [];
+    for (const envelope of envelopes) {
+        const ev = envelope?.ev;
+        if (ev?.t !== 'service' || typeof ev.notice !== 'string' || typeof ev.text !== 'string') {
+            continue;
+        }
+        out.push({ type: 'session.notice', notice: ev.notice, message: ev.text });
+    }
+    return out;
+}
 function detectSeqGap(highestApplied, incoming) {
     if (!Number.isFinite(incoming) || incoming <= 0)
         return null;
@@ -281,11 +449,54 @@ function detectSeqGap(highestApplied, incoming) {
         return null;
     return { from: highestApplied + 1, to: incoming - 1 };
 }
-function seqGapNotice(gap) {
+/**
+ * The notice a reader sees when chunks went missing.
+ *
+ * It names `run.result` only when this client will actually fill `run.result`
+ * from the persisted message (`recordBackfill`). The sentence used to promise
+ * it unconditionally, while `run.result.text` was folded from the envelopes
+ * that DID arrive — so the one run told to trust `run.result` was the run whose
+ * `run.result.text` was empty, with the answer only in the record (OSK-12132).
+ */
+function seqGapNotice(gap, options = {}) {
     const count = gap.to - gap.from + 1;
+    const where = options.recordBackfill === false
+        ? 'The full answer is in the persisted message.'
+        : 'The full answer is in the persisted message and in run.result.';
     return (`[${count} stream chunk${count === 1 ? '' : 's'} (seq ${gap.from}` +
         `${count === 1 ? '' : `-${gap.to}`}) never arrived — the text above is incomplete. ` +
-        'The full answer is in the persisted message and in run.result.]');
+        `${where}]`);
+}
+/** How long, at most, a gapped run waits for the record before settling anyway. */
+const GAP_BACKFILL_ATTEMPTS = 3;
+const GAP_BACKFILL_RETRY_MS = 400;
+const PERMISSION_SOURCE_LABELS = {
+    request: 'this turn',
+    agent: "the agent's default",
+    harness: "the harness's default",
+    contract: 'the execution contract',
+    policy: 'the unattended-run policy',
+};
+/**
+ * The permission mode a `run.started` reports, and where it came from
+ * (OSK-12089). `null` when the event carries no mode report at all — a cloud
+ * turn from an older server, say — so nothing is claimed.
+ */
+function describeRunPermission(event) {
+    const source = typeof event.permissionModeSource === 'string' ? event.permissionModeSource : '';
+    const mode = typeof event.permissionMode === 'string' && event.permissionMode ? event.permissionMode : '';
+    if (!source)
+        return null;
+    if (!mode) {
+        return source === 'daemon'
+            ? "set by the daemon's own config on that machine (no agent, harness or turn mode is set)"
+            : 'unknown';
+    }
+    const from = PERMISSION_SOURCE_LABELS[source] ?? source;
+    const coerced = typeof event.permissionModeCoercedFrom === 'string' && event.permissionModeCoercedFrom
+        ? ` — ${event.permissionModeCoercedFrom} was asked for, which this harness cannot honour`
+        : '';
+    return `${mode} (from ${from})${coerced}`;
 }
 class AgenticStreamClient {
     options;
@@ -314,8 +525,15 @@ class AgenticStreamClient {
      * repeat count varies run to run and cannot be inferred by a consumer.
      */
     seenLifecycle = new Set();
+    /**
+     * Whether this client's transport has dropped since it first connected. Until
+     * it has, every `session:join` it sends declares a FIRST join (OSK-12124).
+     */
+    transportDropped = false;
     /** `call` → tool name, so a daemon `tool-call-end` can be named (OSK-7730). */
     toolNamesByCall = new Map();
+    /** `permission-ask` requestId → tool name, to name its resolution (OSK-12113). */
+    toolNamesByPermission = new Map();
     /** Text already written to the terminal, for suffix-only rendering. */
     renderedText = '';
     idleTimer = null;
@@ -373,11 +591,30 @@ class AgenticStreamClient {
         // the result instead of awaiting an attach nobody is still attempting.
         if (this.settled || this.closed || !this.socket)
             return result;
-        this.socket.emit('session:join', { sessionId: this.options.sessionId });
+        this.socket.emit('session:join', this.sessionJoinPayload());
         this.emit({ type: 'session.joined', sessionId: this.options.sessionId });
         this.armIdleProbe();
         return result;
     }
+    /**
+     * The `session:join` payload.
+     *
+     * This client learns its session id from the HTTP acceptance and only then
+     * connects, while a daemon turn publishes its `session:init` at once. The
+     * server drops buffered frames older than the socket's connect time — right
+     * for a RE-connect, which already rendered them, and wrong here, where they
+     * were never seen: `run.started` (the dispatched mode and its source) never
+     * reached a daemon turn's stream (OSK-12124). `firstJoin` says so, and the
+     * server then replays the pre-connect lifecycle frames. Both joins of the
+     * first connection carry it, because the server's replay drains the shared
+     * buffer and either join may be the one that reaches it first; the stream's
+     * own lifecycle dedupe absorbs the overlap. After a drop it is not sent.
+     */
+    sessionJoinPayload() {
+        return this.transportDropped
+            ? { sessionId: this.options.sessionId }
+            : { sessionId: this.options.sessionId, firstJoin: true };
+    }
     /**
      * (Re)start the silence watchdog that asks the durable record what happened.
      *
@@ -507,7 +744,7 @@ class AgenticStreamClient {
                     sessionId: this.options.sessionId,
                     fromSeq: gap.from,
                     toSeq: gap.to,
-                    message: seqGapNotice(gap),
+                    message: seqGapNotice(gap, { recordBackfill: Boolean(this.options.reconcileTerminal) }),
                 });
             }
             if (seq > this.highestSeq)
@@ -518,10 +755,11 @@ class AgenticStreamClient {
         const socket = this.socket;
         const match = (event) => !event.sessionId || event.sessionId === this.options.sessionId;
         socket.on('connect', () => {
-            socket.emit('session:join', { sessionId: this.options.sessionId });
+            socket.emit('session:join', this.sessionJoinPayload());
             this.emit({ type: 'transport.connected', sessionId: this.options.sessionId });
         });
         socket.on('disconnect', (reason) => {
+            this.transportDropped = true;
             if (this.settled)
                 return;
             this.emit({ type: 'transport.disconnected', sessionId: this.options.sessionId, reason });
@@ -605,6 +843,18 @@ class AgenticStreamClient {
                 for (const projected of projectDaemonToolEvents(fresh, this.toolNamesByCall)) {
                     this.emitToolEvent({ ...projected, sessionId: this.options.sessionId });
                 }
+                // Notices meant for the person — a local harness that could not resume
+                // its previous session and started a fresh one (OSK-12131). A plain
+                // `service` line is diagnostic chatter and stays in the envelope; one
+                // marked `notice` is said out loud.
+                for (const notice of projectSessionNotices(fresh)) {
+                    this.emit({ ...notice, sessionId: this.options.sessionId });
+                }
+                // Who decided each permission request — a person (and where), the
+                // mode, a policy — said beside the decision (OSK-12113).
+                for (const resolved of projectPermissionResolutions(fresh, this.toolNamesByPermission)) {
+                    this.emit({ ...resolved, sessionId: this.options.sessionId });
+                }
                 this.emit({ ...scoped, type: 'session.output' });
                 return;
             }
@@ -693,6 +943,10 @@ class AgenticStreamClient {
                     toolUseId: event.toolUseId,
                     toolName: event.toolName,
                     reason: 'CLI was not started with --approve-tools',
+                    // Nobody was asked: this client could not put the prompt to anyone.
+                    // The server records it as a policy decision, not a person's
+                    // (OSK-12113) — it used to read "a person on the skrr CLI".
+                    automatic: true,
                 });
             }
             this.emit({ ...event, type: 'permission.denied', reason: 'noninteractive_or_not_enabled' });
@@ -731,7 +985,7 @@ class AgenticStreamClient {
             });
             return;
         }
-        const answer = await this.ask(`Allow tool ${event.toolName ?? 'unknown'}? [y/N] `);
+        const answer = await this.ask(`Allow ${describePermission(event)}? [y/N] `);
         const approved = /^y(es)?$/i.test(answer.trim());
         this.socket.emit(approved ? 'permission:approve' : 'permission:deny', {
             sessionId: this.options.sessionId,
@@ -843,7 +1097,19 @@ class AgenticStreamClient {
             writeJsonLine(output, event);
             return;
         }
-        if (event.type === 'text.delta' && typeof event.text === 'string') {
+        if (event.type === 'run.started') {
+            const permission = describeRunPermission(event);
+            if (permission)
+                output.write(`[run] permission: ${permission}\n`);
+        }
+        else if ((event.type === 'run.completed' || event.type === 'run.failed') &&
+            typeof event.harnessModel === 'string' &&
+            event.harnessModel) {
+            // Which model the harness ran — the agent's pick, or what `default`
+            // resolved to on that machine (OSK-12111).
+            output.write(`[run] model: ${event.harnessModel} (reported by the harness)\n`);
+        }
+        else if (event.type === 'text.delta' && typeof event.text === 'string') {
             // Print what is NEW. See `renderableDelta` — the old `\r` repaint could
             // not rewind past a newline, so a multi-line answer was reprinted once
             // per snapshot and its blocks fused (OSK-7701, OSK-7731).
@@ -870,18 +1136,31 @@ class AgenticStreamClient {
             output.write(`\n${String(event.message ?? '')}\n`);
             this.renderedText = this.accumulated;
         }
+        else if (event.type === 'permission.resolved') {
+            const verb = event.decision === 'allow' ? 'allowed' : 'denied';
+            output.write(`\n[permission] ${String(event.toolName ?? 'tool')} ${verb} by ${String(event.decidedBy ?? '')}\n`);
+            this.renderedText = this.accumulated;
+        }
+        else if (event.type === 'session.notice') {
+            output.write(`\n[session] ${String(event.message ?? '')}\n`);
+            this.renderedText = this.accumulated;
+        }
         else if (event.type === 'transport.disconnected') {
             output.write(`\n[reconnecting] ${String(event.reason ?? '')}\n`);
             this.renderedText = this.accumulated;
         }
-        else if (event.type === 'permission.requested' || event.type === 'question.requested') {
+        else if (event.type === 'permission.requested') {
+            output.write(`\n[${event.type}] ${describePermission(event)}\n`);
+            this.renderedText = this.accumulated;
+        }
+        else if (event.type === 'question.requested') {
             output.write(`\n[${event.type}]\n`);
             this.renderedText = this.accumulated;
         }
         else if (event.type === 'permission.approved' && event.auto === true) {
             // Said out loud, because nobody was asked: the flag approved it, and a
             // reader of this log should see which tools that covered (OSK-10323).
-            output.write(`\n[permission] ${String(event.toolName ?? 'unknown')} allowed by --approve-tools\n`);
+            output.write(`\n[permission] ${describePermission(event)} allowed by --approve-tools\n`);
             this.renderedText = this.accumulated;
         }
         else if (event.type === 'question.answered' && event.nonInteractive) {
@@ -894,6 +1173,42 @@ class AgenticStreamClient {
             return;
         this.settled = true;
         this.lastEvent = event;
+        // A stream that lost chunks told its reader the full answer would be in
+        // `run.result`. The terminal event does not always carry it — a failed
+        // turn's `execution:error` has no `result` — so read it from the record
+        // before settling, or the promise is false exactly when it was made
+        // (OSK-12132).
+        if (this.reportedGap && this.options.reconcileTerminal) {
+            void this.readRecordedText().then((recorded) => this.settle(status, event, recorded));
+            return;
+        }
+        this.settle(status, event, undefined);
+    }
+    /**
+     * The answer as the durable record holds it, for a run whose stream had a
+     * hole. Bounded: the record is written before the terminal event is sent, so
+     * it is normally there at once, and a record that stays silent must not hold
+     * the run open — the reader then gets what the stream delivered.
+     */
+    async readRecordedText() {
+        const reconcile = this.options.reconcileTerminal;
+        if (!reconcile)
+            return undefined;
+        for (let attempt = 0; attempt < GAP_BACKFILL_ATTEMPTS; attempt += 1) {
+            if (attempt > 0)
+                await new Promise((r) => setTimeout(r, GAP_BACKFILL_RETRY_MS));
+            try {
+                const terminal = await reconcile();
+                if (terminal && typeof terminal.text === 'string' && terminal.text)
+                    return terminal.text;
+            }
+            catch {
+                // No evidence either way; try again, then settle on the stream.
+            }
+        }
+        return undefined;
+    }
+    settle(status, event, recordedText) {
         // `execution:complete` carries the final answer as `result`, and it is
         // AUTHORITATIVE — preferred over whatever the deltas added up to, not just
         // used when they added up to nothing.
@@ -922,6 +1237,12 @@ class AgenticStreamClient {
         if (finalText && finalText !== this.accumulated && !accumulationIsSuperset) {
             this.accumulated = finalText;
         }
+        // The record wins over a stream known to have lost chunks, unless what
+        // arrived is already longer (the record lags a completed stream, never the
+        // other way round).
+        if (recordedText && recordedText.length > this.accumulated.length) {
+            this.accumulated = recordedText;
+        }
         // The finished answer, as every other surface shows it: the web applies
         // this same sanitizer, so a scheduling JSON block or leaked function-call
         // XML the model wrote into its reply is removed here too instead of being

package/dist/lib/auth-core-init.d.ts

@@ -1,4 +1,3 @@
-import { type AuthBundle } from './auth-storage';
 type DedicatedGenerationPreparationOptions = {
     machineUuid?: string;
     configDir?: string;
@@ -43,15 +42,9 @@ export declare class CliCredentialInitializationError extends Error {
  *      `isCredEnvelopeActive()` to decide whether to wrap the private
  *      key on persist.
  *   2. `initDeviceIdentity` second.
- *   3. Server enrollment is fire-and-forget; only attempts if a current
- *      access token is already on disk (peek via the file backend slot
- *      so a missing token short-circuits cleanly without creating a
- *      whole CredentialResolver chain here).
  *
- * The peek path uses `backends.readKeychainToken / readFileToken`
- * directly so we don't accidentally trigger an interactive prompt or
- * spawn the auth-helper when the user is unauthenticated. Mirrors the
- * daemon's `peekAuthAccessToken()` shape.
+ * The CLI never enrolls the device key with the server; see the comment
+ * in `ensureCliAuthPrefetchStarted` (OSK-12063).
  */
 export declare function prefetchCliAuth(): Promise<void>;
 /**
@@ -63,5 +56,4 @@ export declare function prefetchCliAuth(): Promise<void>;
 export declare function waitForCliCredentialEnvelope(): Promise<void>;
 /** @internal Test seam — reset the module-level one-shot initialization. */
 export declare function __resetPrefetchCliAuthForTest(): void;
-export declare function shouldUseAccessTokenForEnrollment(bundle: Pick<AuthBundle, 'token' | 'expiresAt'> | null | undefined, nowMs?: number, minTtlMs?: number): boolean;
 export {};