@skrr-ai/cli 0.1.50 → 0.1.52

package/dist/lib/daemonBroker.js

@@ -77,6 +77,7 @@ exports.resolveBootstrapPath = resolveBootstrapPath;
 exports.resolveProfileBootstrapPaths = resolveProfileBootstrapPaths;
 exports.resolveBootstrapCandidatePaths = resolveBootstrapCandidatePaths;
 exports.resolveCliHandoffCandidatePaths = resolveCliHandoffCandidatePaths;
+exports.resolveExactProfileBootstrapPaths = resolveExactProfileBootstrapPaths;
 exports.findLiveDaemonBootstrap = findLiveDaemonBootstrap;
 exports.readBootstrap = readBootstrap;
 exports.attemptDaemonBrokerLogin = attemptDaemonBrokerLogin;
@@ -91,10 +92,11 @@ const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const os = __importStar(require("node:os"));
 const auth_core_1 = require("@skrr-ai/auth-core");
+const loopback_http_1 = require("@skrr-ai/auth-core/loopback-http");
 const cli_handoff_wire_1 = require("@skrr-ai/auth-core/cli-handoff-wire");
 const auth_storage_1 = require("./auth-storage");
 const config_1 = require("./config");
-const device_id_1 = require("./device-id");
+const cli_identity_1 = require("./cli-identity");
 const REQUEST_TIMEOUT_MS = 20_000;
 /**
  * Normalize a base URL for equality comparison. Mirrors the daemon-side
@@ -118,6 +120,19 @@ function normalizeBaseUrl(u) {
         return (0, config_1.canonicalizeKnownBaseURL)(trimmed.toLowerCase());
     }
 }
+/**
+ * Codes the daemon's legacy `/v1/auth/cli-handoff` route writes itself. Every
+ * other coded body on that route is the server's, passed through verbatim.
+ */
+const DAEMON_OWN_HANDOFF_CODES = new Set([
+    cli_handoff_wire_1.CLI_HANDOFF_ERROR_BROKER_ONLY,
+    'BODY_TOO_LARGE',
+    'BODY_PARSE_FAILED',
+    'CLI_ID_INVALID',
+    'BASE_URL_MISMATCH',
+    'DAEMON_NOT_AUTHED',
+    'UPSTREAM_UNREACHABLE',
+]);
 /**
  * Compute the bootstrap file path. Exported for tests so they can assert
  * the platform fork without monkeypatching `os.platform()`.
@@ -139,6 +154,16 @@ function resolveProfileBootstrapPaths(primary, entryNames) {
         .map((name) => path.join(path.dirname(primary), name));
     return [primary, ...extras];
 }
+/**
+ * Legacy bootstrap directory (darwin): pre-rename daemons wrote under
+ * `~/Library/Application Support/OverSky/` while this reader looked under
+ * `skrr/` — a drift that silently killed island bootstrapping on macOS
+ * (OSK-12057). New daemons dual-write both; old daemons keep writing only
+ * `OverSky/`, so these stay consulted as fallbacks.
+ */
+function legacyDarwinBootstrapDir() {
+    return path.join(os.homedir(), 'Library', 'Application Support', 'OverSky');
+}
 /**
  * List the bootstrap files that a Sky CLI may use for a local daemon
  * handoff. `default` stays first for backwards compatibility; any other
@@ -150,16 +175,31 @@ function resolveProfileBootstrapPaths(primary, entryNames) {
  */
 function resolveBootstrapCandidatePaths(profile = 'default') {
     const primary = resolveBootstrapPath(profile);
-    if (profile !== 'default')
-        return [primary];
+    if (profile !== 'default') {
+        const legacy = process.platform === 'darwin'
+            ? [path.join(legacyDarwinBootstrapDir(), `daemon-island.${profile}.json`)]
+            : [];
+        return [primary, ...legacy];
+    }
     try {
         if (process.platform === 'darwin') {
-            const dir = path.dirname(primary);
-            const entryNames = fs
-                .readdirSync(dir, { withFileTypes: true })
-                .filter((entry) => entry.isFile())
-                .map((entry) => entry.name);
-            return resolveProfileBootstrapPaths(primary, entryNames);
+            const candidates = [primary];
+            for (const dir of [path.dirname(primary), legacyDarwinBootstrapDir()]) {
+                let entryNames = [];
+                try {
+                    entryNames = fs
+                        .readdirSync(dir, { withFileTypes: true })
+                        .filter((entry) => entry.isFile())
+                        .map((entry) => entry.name);
+                }
+                catch {
+                    continue;
+                }
+                for (const p of resolveProfileBootstrapPaths(path.join(dir, 'daemon-island.default.json'), entryNames)) {
+                    candidates.push(p);
+                }
+            }
+            return [...new Set(candidates)];
         }
         const profilesDir = path.dirname(path.dirname(primary));
         const extras = fs
@@ -208,6 +248,20 @@ function resolveCliHandoffCandidatePaths(profile = 'default') {
 function legacyBootstrapPath() {
     return path.join(os.homedir(), '.skrr', 'daemon-island.json');
 }
+/**
+ * The island files that belong to exactly `profile` — its canonical path and
+ * the pre-rename darwin location — and never another profile's. The broker's
+ * candidate list for `default` deliberately falls through to any running
+ * profile, which is right for borrowing a credential and wrong for naming
+ * which daemon a profile's status describes (OSK-12102).
+ */
+function resolveExactProfileBootstrapPaths(profile = 'default') {
+    const primary = resolveBootstrapPath(profile);
+    if (process.platform === 'darwin') {
+        return [primary, path.join(legacyDarwinBootstrapDir(), `daemon-island.${profile}.json`)];
+    }
+    return profile === 'default' ? [primary, legacyBootstrapPath()] : [primary];
+}
 /**
  * Resolve the first live daemon bootstrap for a profile. Message-intent
  * submission reuses the same authenticated loopback discovery as the login
@@ -301,6 +355,7 @@ async function attemptDaemonBrokerLogin(opts) {
     const usable = [];
     const unbound = [];
     let mismatchedBootstrap = null;
+    let mismatchedPath = null;
     for (const candidate of candidates) {
         const candidateBootstrap = readBootstrap(candidate);
         if (!candidateBootstrap)
@@ -310,7 +365,10 @@ async function attemptDaemonBrokerLogin(opts) {
             typeof opts.baseURL === 'string' &&
             opts.baseURL.length > 0 &&
             normalizeBaseUrl(opts.baseURL) !== normalizeBaseUrl(candidateBootstrap.serverUrl)) {
-            mismatchedBootstrap ??= candidateBootstrap;
+            if (!mismatchedBootstrap) {
+                mismatchedBootstrap = candidateBootstrap;
+                mismatchedPath = candidate;
+            }
             continue;
         }
         if (typeof candidateBootstrap.serverUrl !== 'string' ||
@@ -326,8 +384,11 @@ async function attemptDaemonBrokerLogin(opts) {
             return {
                 ok: false,
                 reason: 'base_url_mismatch',
-                detail: `The skrr background service on this computer is not logged in to ${opts.baseURL}; it is logged in to ${mismatchedBootstrap.serverUrl}.`,
+                // What was READ, not a claim about the daemon: the descriptor may be
+                // another profile's (OSK-12117).
+                detail: `The daemon descriptor ${mismatchedPath ?? ''} is for ${mismatchedBootstrap.serverUrl}, not ${opts.baseURL}.`,
                 daemonServerUrl: mismatchedBootstrap.serverUrl,
+                ...(mismatchedPath ? { descriptorPath: mismatchedPath } : {}),
             };
         }
         return {
@@ -346,6 +407,17 @@ async function attemptDaemonBrokerLogin(opts) {
     let outcome = null;
     for (const { bootstrap, sourcePath } of usable) {
         outcome = await brokerThrough(bootstrap, opts, sourcePath);
+        if (!outcome.ok) {
+            // Say which daemon answered: a guest's refusal has a different repair.
+            outcome = {
+                ...outcome,
+                descriptorPath: outcome.descriptorPath ?? sourcePath,
+                ...(bootstrap.daemonId ? { daemonId: bootstrap.daemonId } : {}),
+                ...(sourcePath === exports.DEDICATED_RUNTIME_CLI_HANDOFF_DESCRIPTOR
+                    ? { dedicatedGuest: true }
+                    : {}),
+            };
+        }
         if (outcome.ok || outcome.reason !== 'network')
             return outcome;
     }
@@ -400,6 +472,13 @@ async function brokerThrough(bootstrap, opts, sourcePath) {
         // 403 HANDOFF_BROKER_ONLY anyway.
         if (!offersRefreshFamily)
             return redeem;
+        const minted = await mintRefreshFamilyThrough(bootstrap, opts);
+        // Both doors refused: report the one that says more. The legacy route
+        // usually carries the server's code itself, but an older daemon's token
+        // route may be the only one that named it.
+        if (!minted.ok && !minted.code && redeem.code && redeem.reason !== 'network')
+            return redeem;
+        return minted;
     }
     return mintRefreshFamilyThrough(bootstrap, opts);
 }
@@ -415,7 +494,9 @@ async function redeemCliHandoffToken(bootstrap, opts = {}) {
     const abortTimer = setTimeout(() => controller.abort(), timeoutMs);
     let response;
     try {
-        response = await fetch(url, {
+        // The descriptor secret is a loopback-only credential: never `fetch`, which
+        // sends 127.0.0.1 to HTTP_PROXY under Bun and NODE_USE_ENV_PROXY (OSK-12134).
+        response = await (0, loopback_http_1.loopbackFetch)(url, {
             method: 'POST',
             headers: {
                 Authorization: `Bearer ${bootstrap.secret}`,
@@ -467,6 +548,28 @@ async function redeemCliHandoffToken(bootstrap, opts = {}) {
                 ...(code ? { code } : {}),
             };
         }
+        // A daemon that names the SERVER's refusal of its own mint carries
+        // `upstreamCode` / `upstreamStatus` beside the 503 (older daemons omit them). Surface the
+        // server's code — `DEVICE_PROOF_PIN_MISMATCH` has a specific repair that
+        // `HANDOFF_TOKEN_UNAVAILABLE` cannot point at (OSK-12149).
+        const upstreamCode = typeof parsedBody?.upstreamCode === 'string'
+            ? parsedBody.upstreamCode
+            : undefined;
+        const upstreamStatus = typeof parsedBody?.upstreamStatus === 'number'
+            ? parsedBody.upstreamStatus
+            : undefined;
+        if (upstreamCode || upstreamStatus !== undefined) {
+            return {
+                ok: false,
+                reason: 'upstream_refused',
+                refusedBy: 'server',
+                detail: message,
+                ...(upstreamStatus !== undefined
+                    ? { status: upstreamStatus }
+                    : { status: response.status }),
+                ...(upstreamCode ? { code: upstreamCode } : code ? { code } : {}),
+            };
+        }
         return {
             ok: false,
             // 503 HANDOFF_TOKEN_UNAVAILABLE lands in server_error with its code
@@ -474,6 +577,7 @@ async function redeemCliHandoffToken(bootstrap, opts = {}) {
             // upstream unreachable, mint cool-down). That is a daemon outage, not a
             // decline, and the code keeps it diagnosable.
             reason: response.status >= 500 ? 'server_error' : 'unknown',
+            refusedBy: 'daemon',
             detail: message,
             status: response.status,
             ...(code ? { code } : {}),
@@ -497,7 +601,9 @@ async function mintRefreshFamilyThrough(bootstrap, opts) {
     const abortTimer = setTimeout(() => controller.abort(), timeoutMs);
     let response;
     try {
-        response = await fetch(url, {
+        // The descriptor secret is a loopback-only credential: never `fetch`, which
+        // sends 127.0.0.1 to HTTP_PROXY under Bun and NODE_USE_ENV_PROXY (OSK-12134).
+        response = await (0, loopback_http_1.loopbackFetch)(url, {
             method: 'POST',
             headers: {
                 Authorization: `Bearer ${bootstrap.secret}`,
@@ -558,7 +664,14 @@ async function mintRefreshFamilyThrough(bootstrap, opts) {
             };
         }
         if (response.status === 503 && code === 'DAEMON_NOT_AUTHED') {
-            return { ok: false, reason: 'daemon_not_authed', detail: message, status: 503, code };
+            return {
+                ok: false,
+                reason: 'daemon_not_authed',
+                refusedBy: 'daemon',
+                detail: message,
+                status: 503,
+                code,
+            };
         }
         // 429 is TRANSIENT and its remedy is time, which makes it the one failure
         // here that a fall-through cannot substitute for. Left in the `unknown`
@@ -592,12 +705,26 @@ async function mintRefreshFamilyThrough(bootstrap, opts) {
                 ...(daemonServerUrl ? { daemonServerUrl } : {}),
             };
         }
+        // A coded body the daemon did not write is the server's refusal of the
+        // daemon's mint, passed through verbatim (`cliHandoff.ts`). A 4xx one —
+        // observed: 401 DEVICE_PROOF_PIN_MISMATCH — is a decision with a named
+        // repair, and used to land in `unknown`, where no caller could classify it.
+        const refusedBy = code
+            ? DAEMON_OWN_HANDOFF_CODES.has(code)
+                ? 'daemon'
+                : 'server'
+            : undefined;
         return {
             ok: false,
-            reason: response.status >= 500 ? 'server_error' : 'unknown',
+            reason: response.status >= 500
+                ? 'server_error'
+                : refusedBy === 'server'
+                    ? 'upstream_refused'
+                    : 'unknown',
             detail: message,
             status: response.status,
             ...(code ? { code } : {}),
+            ...(refusedBy ? { refusedBy } : {}),
         };
     }
     // Happy path — validate the response shape minimally.
@@ -894,14 +1021,11 @@ async function maybeAutoBroker(opts) {
     if (opts.commandId && AUTH_SELF_MANAGED_COMMANDS.has(opts.commandId)) {
         return { triggered: false };
     }
-    // Mint a cliId on the fly when missing. Persisted by the caller on
+    // The same decision an interactive login makes (OSK-12156): a named profile
+    // with no stored credential is issued its own id, so a durable hand-off's
+    // confirm cannot retire another profile's session. Persisted by the caller on
     // success so the rotation row stays bound across processes.
-    let cliId = opts.cliConfig.cliId;
-    let updatedConfig;
-    if (!cliId) {
-        cliId = (0, device_id_1.generateCliId)();
-        updatedConfig = { ...opts.cliConfig, cliId };
-    }
+    const { cliId, updatedConfig } = (0, cli_identity_1.planLoginCliId)(opts.cliConfig);
     const outcome = await attemptDaemonBrokerLoginAndPersist({
         cliId,
         baseURL: opts.cliConfig.baseURL,

package/dist/lib/daemonBrokerRefusal.d.ts

@@ -0,0 +1,51 @@
+/**
+ * What to tell a person whose local daemon ANSWERED the CLI hand-off and
+ * refused it (OSK-12149, OSK-12151).
+ *
+ * The auto-broker used to be "fail-quiet": every refusal except a rate limit
+ * and a base-URL mismatch was dropped, and the command then said only "Not
+ * signed in. Run `skrr login` first." That sentence is true and points at the
+ * wrong repair whenever the daemon's refusal is specific — observed: the server
+ * refused the daemon's own mint with `401 DEVICE_PROOF_PIN_MISMATCH`, which
+ * `skrr daemon login` repairs (an interactive daemon login re-pins its device
+ * key), and which on a Dedicated Runtime guest no login the tenant can run
+ * repairs at all.
+ *
+ * One function decides the headline and the remedy so the NOT_SIGNED_IN error,
+ * `skrr login`'s progress line and its headless refusal cannot drift apart.
+ */
+import type { DaemonBrokerFailure } from './daemonBroker';
+/**
+ * True when a daemon ANSWERED the hand-off and refused it — as opposed to no
+ * daemon being there to ask (`no_bootstrap`, a stale descriptor nobody listens
+ * behind). This is the case the CLI must explain rather than reduce to "Not
+ * signed in": the person has a daemon, it said something specific, and that
+ * decides whether `skrr login` would even help.
+ */
+export declare function isAnsweredBrokerRefusal(outcome: DaemonBrokerFailure): boolean;
+export interface BrokerRefusalDescription {
+    /** One sentence: who refused and what they said, with status and code. */
+    headline: string;
+    /** What to do about it — never a login the reader cannot perform. */
+    remedy: string;
+    /** True when waiting and retrying is the repair. */
+    transient: boolean;
+    /** True when the refusing daemon is a Dedicated Runtime guest's. */
+    dedicatedGuest: boolean;
+    /** Machine-readable twin for `--json` error details. */
+    broker: {
+        reason: DaemonBrokerFailure['reason'];
+        refusedBy?: 'daemon' | 'server';
+        status?: number;
+        code?: string;
+        detail?: string;
+        descriptorPath?: string;
+        daemonId?: string;
+    };
+}
+/**
+ * Describe a broker failure for a person, or null when there is nothing to
+ * say: no daemon was there to ask, or the failure already has its own message
+ * (`base_url_mismatch`, `rate_limited`).
+ */
+export declare function describeBrokerRefusal(failure: DaemonBrokerFailure, bin?: string): BrokerRefusalDescription | null;

package/dist/lib/daemonBrokerRefusal.js

@@ -0,0 +1,127 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isAnsweredBrokerRefusal = isAnsweredBrokerRefusal;
+exports.describeBrokerRefusal = describeBrokerRefusal;
+/**
+ * True when a daemon ANSWERED the hand-off and refused it — as opposed to no
+ * daemon being there to ask (`no_bootstrap`, a stale descriptor nobody listens
+ * behind). This is the case the CLI must explain rather than reduce to "Not
+ * signed in": the person has a daemon, it said something specific, and that
+ * decides whether `skrr login` would even help.
+ */
+function isAnsweredBrokerRefusal(outcome) {
+    switch (outcome.reason) {
+        case 'no_bootstrap':
+        case 'bootstrap_parse':
+        case 'network':
+            return false;
+        case 'stale_bootstrap':
+            // A bare 401 is the daemon refusing a descriptor secret that rotated;
+            // re-reading the file next time heals it. A coded one is a real answer.
+            return Boolean(outcome.code);
+        default:
+            return true;
+    }
+}
+/** Codes whose repair is signing the DAEMON in again (laptop only). */
+const DAEMON_RELOGIN_CODES = new Set([
+    'DEVICE_PROOF_PIN_MISMATCH',
+    'SESSION_REVOKED',
+    'PRINCIPAL_UNRESOLVED',
+    'DAEMON_NOT_AUTHED',
+]);
+/** Codes whose repair is time. */
+const TRANSIENT_CODES = new Set([
+    'DEVICE_PROOF_VERIFY_UNAVAILABLE',
+    'SERVICE_UNAVAILABLE',
+    'HANDOFF_RATE_LIMITED',
+    'RATE_LIMITED',
+    'UPSTREAM_UNREACHABLE',
+]);
+function statusAndCode(f) {
+    const parts = [typeof f.status === 'number' ? `HTTP ${f.status}` : '', f.code ?? ''].filter(Boolean);
+    return parts.length > 0 ? ` (${parts.join(' ')})` : '';
+}
+function sentence(detail) {
+    const d = (detail ?? '').trim();
+    if (!d)
+        return '';
+    return /[.!?]$/.test(d) ? ` ${d}` : ` ${d}.`;
+}
+/**
+ * Describe a broker failure for a person, or null when there is nothing to
+ * say: no daemon was there to ask, or the failure already has its own message
+ * (`base_url_mismatch`, `rate_limited`).
+ */
+function describeBrokerRefusal(failure, bin = 'skrr') {
+    if (!isAnsweredBrokerRefusal(failure))
+        return null;
+    if (failure.reason === 'base_url_mismatch' || failure.reason === 'rate_limited')
+        return null;
+    const dedicatedGuest = failure.dedicatedGuest === true;
+    const code = failure.code ?? '';
+    const who = dedicatedGuest
+        ? `This Dedicated Runtime's skrr service${failure.daemonId ? ` (daemon ${failure.daemonId})` : ''}`
+        : 'The skrr background service on this computer';
+    const refusal = failure.reason === 'timeout'
+        ? `${who} did not answer the sign-in hand-off in time.`
+        : failure.refusedBy === 'server' || failure.reason === 'upstream_refused'
+            ? `${who} asked the skrr server for a credential for this CLI, and the server refused${statusAndCode(failure)}.${sentence(failure.detail)}`
+            : `${who} could not hand this CLI a credential${statusAndCode(failure)}.${sentence(failure.detail)}`;
+    const transient = failure.reason === 'timeout' ||
+        TRANSIENT_CODES.has(code) ||
+        (failure.reason === 'server_error' && !DAEMON_RELOGIN_CODES.has(code));
+    let remedy;
+    if (dedicatedGuest) {
+        // Nobody signs in on a guest: the daemon's credential comes from the
+        // machine's attested bootstrap, and a tenant `skrr login` would only put a
+        // personal credential on a shared machine. Name the machine instead.
+        remedy = transient
+            ? 'This is usually temporary; retry in a minute. Nobody signs in on a Dedicated Runtime — ' +
+                `if it persists, check the machine from your own computer with \`${bin} machines dedicated health-check <lease-id>\` ` +
+                `(\`${bin} machines dedicated list\` shows the lease id).`
+            : 'Nobody signs in on a Dedicated Runtime: its daemon holds the account. From your own computer, run ' +
+                `\`${bin} machines dedicated health-check <lease-id>\` (\`${bin} machines dedicated list\` shows the lease id), ` +
+                `and \`${bin} machines dedicated restart <lease-id>\` if the hand-off stays refused.`;
+    }
+    else if (code === 'DEVICE_PROOF_PIN_MISMATCH') {
+        remedy =
+            `Run \`${bin} daemon login\` to sign the background service in again — an interactive daemon login re-pins its device key — then retry. ` +
+                `\`${bin} login\` signs this CLI in on its own instead.`;
+    }
+    else if (DAEMON_RELOGIN_CODES.has(code) || failure.reason === 'daemon_not_authed') {
+        remedy =
+            `Run \`${bin} daemon login\` to sign the background service in again, then retry. ` +
+                `\`${bin} login\` signs this CLI in on its own instead.`;
+    }
+    else if (failure.reason === 'ci_token_refused') {
+        remedy =
+            `The background service is signed in with a CI token, which cannot sign a person in. Use \`${bin} login\`, ` +
+                `or \`${bin} create-token\` for a CI credential.`;
+    }
+    else if (transient) {
+        remedy =
+            `This is usually temporary; retry in a minute. \`${bin} daemon status\` and \`${bin} daemon logs\` show the service's side, ` +
+                `and \`${bin} login\` signs this CLI in without it.`;
+    }
+    else {
+        remedy =
+            `\`${bin} daemon status\` and \`${bin} daemon logs\` show the service's side. ` +
+                `\`${bin} login\` signs this CLI in without it.`;
+    }
+    return {
+        headline: refusal,
+        remedy,
+        transient,
+        dedicatedGuest,
+        broker: {
+            reason: failure.reason,
+            ...(failure.refusedBy ? { refusedBy: failure.refusedBy } : {}),
+            ...(typeof failure.status === 'number' ? { status: failure.status } : {}),
+            ...(failure.code ? { code: failure.code } : {}),
+            ...(failure.detail ? { detail: failure.detail } : {}),
+            ...(failure.descriptorPath ? { descriptorPath: failure.descriptorPath } : {}),
+            ...(failure.daemonId ? { daemonId: failure.daemonId } : {}),
+        },
+    };
+}

package/dist/lib/dedicated-machines.d.ts

@@ -111,8 +111,17 @@ export declare function describeDedicatedCheckpoint(lease: DedicatedLease | unde
  * machine to the previous image. Files under the workspace survive both.
  */
 export interface DedicatedImageStanding {
-    /** A newer image exists that has not already failed on this machine. */
+    /**
+     * A newer APPROVED image exists that has not already failed on this machine.
+     * False is not "running the latest daemon": a release no approved image
+     * carries yet is not an update this machine can move to (OSK-12153).
+     */
     updateAvailable?: boolean;
+    /**
+     * The daemon the approved image carries, when the server can say: this
+     * machine runs that image and its daemon reported a version. Null otherwise.
+     */
+    approvedImageDaemonVersion?: string | null;
     /** When the older image stops being supported; null when there is no deadline. */
     updateBy?: string | null;
     lastUpdate?: {
@@ -121,6 +130,26 @@ export interface DedicatedImageStanding {
         settledAt?: string | null;
     } | null;
 }
+/**
+ * The latest daemon release, as `show` read it from the signed release feed:
+ * a version, or why it could not be read. Never inferred from the machine.
+ */
+export type LatestDaemonRelease = {
+    version: string;
+} | {
+    error: string;
+};
+/** -1 / 0 / 1, or null when either side is not a version. */
+export declare function compareDaemonVersions(a: string, b: string): number | null;
+/**
+ * Which daemon the approved image carries against the latest daemon release
+ * (OSK-12153). `image update: current` used to be the whole answer, while the
+ * daemon on the same machine said a newer release existed: "current" means no
+ * newer APPROVED image, and a release that no approved image carries yet is not
+ * something this machine can move to. Both halves are said, and an unknown
+ * half is said to be unknown rather than left out.
+ */
+export declare function describeDedicatedDaemonRelease(image: DedicatedImageStanding, latest: LatestDaemonRelease | null | undefined): string | null;
 /** One line saying where a machine's image stands and what the owner can do. */
 export declare function describeDedicatedImageStanding(image: DedicatedImageStanding, leaseId?: string): string;
 /**
@@ -527,7 +556,9 @@ export declare function dedicatedSpendSummary(lease: DedicatedLease): string;
  */
 /** One line saying what a deletion still allows. */
 export declare function describeDedicatedDeletion(deletion: DedicatedLeaseDeletion, leaseId?: string): string;
-export declare function describeDedicatedLease(lease: DedicatedLease, harnesses?: readonly Harness[]): string[];
+export declare function describeDedicatedLease(lease: DedicatedLease, harnesses?: readonly Harness[], opts?: {
+    latestDaemonRelease?: LatestDaemonRelease | null;
+}): string[];
 /** "2026-09-30 14:00 UTC (in 17 days)" — a deadline readable without converting it. */
 export declare function formatDedicatedDeadline(value: string | null | undefined, now?: Date): string;
 /**

package/dist/lib/dedicated-machines.js

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEDICATED_FILE_MAX_BYTES = exports.DEDICATED_FILE_CHUNK_BYTES = exports.DEDICATED_EXEC_DEFAULT_TIMEOUT_MS = exports.DEDICATED_EXEC_MAX_TIMEOUT_MS = exports.DEDICATED_MACHINE_PRODUCT = exports.DEDICATED_LEASE_ACTIONS = void 0;
 exports.describeDedicatedCheckpoint = describeDedicatedCheckpoint;
+exports.compareDaemonVersions = compareDaemonVersions;
+exports.describeDedicatedDaemonRelease = describeDedicatedDaemonRelease;
 exports.describeDedicatedImageStanding = describeDedicatedImageStanding;
 exports.dedicatedRuntimeCreateInput = dedicatedRuntimeCreateInput;
 exports.isDedicatedRepositoryRef = isDedicatedRepositoryRef;
@@ -73,6 +75,52 @@ function describeDedicatedCheckpoint(lease) {
         return null;
     return (0, data_provider_1.describeMachineCheckpointOutcome)(operation.checkpoint, { action: operation.action });
 }
+function versionParts(version) {
+    const match = /^v?(\d+)\.(\d+)\.(\d+)/.exec(String(version || '').trim());
+    return match ? match.slice(1, 4).map(Number) : null;
+}
+/** -1 / 0 / 1, or null when either side is not a version. */
+function compareDaemonVersions(a, b) {
+    const left = versionParts(a);
+    const right = versionParts(b);
+    if (!left || !right)
+        return null;
+    for (let i = 0; i < 3; i += 1) {
+        if (left[i] !== right[i])
+            return left[i] < right[i] ? -1 : 1;
+    }
+    return 0;
+}
+/**
+ * Which daemon the approved image carries against the latest daemon release
+ * (OSK-12153). `image update: current` used to be the whole answer, while the
+ * daemon on the same machine said a newer release existed: "current" means no
+ * newer APPROVED image, and a release that no approved image carries yet is not
+ * something this machine can move to. Both halves are said, and an unknown
+ * half is said to be unknown rather than left out.
+ */
+function describeDedicatedDaemonRelease(image, latest) {
+    if (!latest)
+        return null;
+    const carried = image.approvedImageDaemonVersion || null;
+    const latestText = 'version' in latest
+        ? `latest release skrrd ${latest.version}`
+        : `latest release unknown (${latest.error})`;
+    if (!carried) {
+        return image.updateAvailable ? latestText : `approved image's daemon unknown · ${latestText}`;
+    }
+    if (!('version' in latest)) {
+        return `approved image carries skrrd ${carried} · ${latestText}`;
+    }
+    const compared = compareDaemonVersions(carried, latest.version);
+    if (compared === 0) {
+        return `approved image carries skrrd ${carried}, the latest release`;
+    }
+    if (compared === -1) {
+        return `approved image carries skrrd ${carried} · latest release skrrd ${latest.version} is not in an approved image yet, so there is nothing to update to`;
+    }
+    return `approved image carries skrrd ${carried} · ${latestText}`;
+}
 /** One line saying where a machine's image stands and what the owner can do. */
 function describeDedicatedImageStanding(image, leaseId) {
     const last = image.lastUpdate;
@@ -547,7 +595,7 @@ function describeDedicatedDeletion(deletion, leaseId) {
     }
     return 'nothing to restore; every copy is deleted when the window closes';
 }
-function describeDedicatedLease(lease, harnesses = []) {
+function describeDedicatedLease(lease, harnesses = [], opts = {}) {
     const lines = [dedicatedLeaseDisplayName(lease)];
     const row = (label, value) => {
         if (value === undefined || value === null || value === '')
@@ -584,6 +632,7 @@ function describeDedicatedLease(lease, harnesses = []) {
     row('image', image);
     if (lease.health?.image) {
         row('image update', describeDedicatedImageStanding(lease.health.image, dedicatedLeaseId(lease)));
+        row('image daemon', describeDedicatedDaemonRelease(lease.health.image, opts.latestDaemonRelease));
     }
     if (lease.daemon?.version || lease.daemon?.lastHeartbeatAt) {
         row('daemon', [

package/dist/lib/delegated-cli.js

@@ -49,6 +49,7 @@ const fs = __importStar(require("node:fs"));
 const os = __importStar(require("node:os"));
 const path = __importStar(require("node:path"));
 const auth_core_1 = require("@skrr-ai/auth-core");
+const loopback_http_1 = require("@skrr-ai/auth-core/loopback-http");
 function isDelegatedCliSession(env = process.env) {
     return Boolean(env.OVERSKY_AUTONOMOUS_SESSION === '1' &&
         env.OVERSKY_DELEGATED_CLI_BROKER_URL?.trim() &&
@@ -213,7 +214,9 @@ async function fetchDelegatedCliCredential(env = process.env, options = {}) {
     try {
         let res;
         try {
-            res = await fetch(brokerUrl, {
+            // Proxy-free and loopback-only (OSK-12134): the capability and the
+            // credential it returns must never reach HTTP_PROXY.
+            res = await (0, loopback_http_1.loopbackFetch)(brokerUrl, {
                 method: 'POST',
                 headers: { Accept: 'application/json', 'Content-Type': 'application/json' },
                 body: JSON.stringify({
@@ -257,6 +260,22 @@ async function fetchDelegatedCliCredential(env = process.env, options = {}) {
             const body = (await res.json().catch(() => null));
             if (res.status === 403 && body?.code === 'DELEGATED_CLI_CAPABILITY_REJECTED')
                 return null;
+            if ((res.status === 503 || body?.code === 'DELEGATED_CLI_CREDENTIAL_UNAVAILABLE') &&
+                (typeof body?.upstreamCode === 'string' || typeof body?.upstreamStatus === 'number')) {
+                // The daemon named the server's refusal of its own mint (OSK-12151):
+                // say that, with the code, rather than guess at three possible causes.
+                const named = [
+                    typeof body?.upstreamStatus === 'number' ? `HTTP ${body.upstreamStatus}` : '',
+                    typeof body?.upstreamCode === 'string' ? body.upstreamCode : '',
+                ]
+                    .filter(Boolean)
+                    .join(' ');
+                // The daemon's `message` already names the refusal; fall back to the
+                // status and code when an older daemon sent none.
+                throw new Error(typeof body?.message === 'string' && body.message
+                    ? `the daemon's delegated CLI broker could not mint a credential: ${body.message}`
+                    : `the skrr server refused the daemon's request for this session's credential (${named}).`);
+            }
             if (res.status === 503 || body?.code === 'DELEGATED_CLI_CREDENTIAL_UNAVAILABLE') {
                 throw new Error(`the daemon's delegated CLI broker is alive but cannot mint a credential ` +
                     `(HTTP ${res.status}). The daemon cannot reach the auth upstream, holds ` +

package/dist/lib/exec-runtime-binary.d.ts

@@ -71,7 +71,9 @@ export declare function notInstalledMessage(): string;
  * preserving "exit code = the daemon's exit code" semantics that scripts
  * may depend on.
  */
-export declare function execRuntimeBinary(args: string[]): Promise<number>;
+export declare function execRuntimeBinary(args: string[], opts?: {
+    binary?: string;
+}): Promise<number>;
 /** Output from a short-lived runtime probe such as `skrrd status --json`. */
 export type RuntimeBinaryOutput = {
     code: number;