@skrr-ai/cli 0.1.51 → 0.1.52

package/dist/commands/tasks/create.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.taskTagLabelWarning = taskTagLabelWarning;
 exports.droppedEstimateWarning = droppedEstimateWarning;
 exports.taskCreateMayHaveCommitted = taskCreateMayHaveCommitted;
 exports.taskMatchesCreateIdentity = taskMatchesCreateIdentity;
@@ -36,6 +37,16 @@ const web_url_1 = require("../../lib/web-url");
  * Same shape as `warnDroppedDefaultAssignees` below, which does this for a
  * silently-dropped assignee (OSK-4857).
  */
+/**
+ * `tagLabelWarning` for a task: the task-label vocabulary of the ambient
+ * workspace. Shared by `tasks create` and `tasks update`.
+ */
+function taskTagLabelWarning(tags, attachedLabelIds) {
+    return (0, label_ref_1.tagLabelWarning)(tags, attachedLabelIds, {
+        applicableTo: 'task',
+        ...(process.env.OVERSKY_WORKSPACE_ID ? { workspaceId: process.env.OVERSKY_WORKSPACE_ID } : {}),
+    });
+}
 function droppedEstimateWarning(requested, written, spaceId) {
     if (requested === undefined || requested === null)
         return null;
@@ -137,7 +148,8 @@ class TasksCreate extends base_command_1.BaseCommand {
             description: 'Stable caller-supplied idempotency key for create/upsert workflows',
         }),
         'default-agent': core_1.Flags.string({
-            description: 'Override the automatic assignee with an Agent. Use "auto" to inherit the space lead ' +
+            description: 'Override the automatic assignee with an Agent (it becomes the assignee that runs the task; ' +
+                '--assignee-agent names one directly). Use "auto" to inherit the space lead ' +
                 'agent. Without this, a task falls to the agent this session is bound to ' +
                 '(OVERSKY_SESSION_AGENT_ID), to you when --execution-mode is human, or to nobody. ' +
                 'Cannot be combined with --execution-mode human.',
@@ -161,8 +173,9 @@ class TasksCreate extends base_command_1.BaseCommand {
             description: 'Commitment ID that owns this task. Use for work created directly from a commitment without a linked goal.',
         }),
         project: core_1.Flags.string({
-            description: 'Canonical Project ID — attach the task to a project. A task created with a project ' +
-                "but no --space resolves and inherits the project's space.",
+            description: 'Project to attach the task to: its `id` (uuid; a pasted `_id` is accepted and rewritten ' +
+                'to the `id`), or its ref (OSK-P-5) with --space. Without --space the task inherits ' +
+                "the project's space.",
         }),
         cycle: core_1.Flags.string({
             description: 'Cycle ID, or "current" / "next" within the task Space',
@@ -174,7 +187,8 @@ class TasksCreate extends base_command_1.BaseCommand {
             description: 'Source message ID (requires --source-conversation or daemon session context)',
         }),
         'assignee-agent': core_1.Flags.string({
-            description: 'Assignee agent — id or name, resolved within --space (repeatable)',
+            description: 'Assignee agent: the agent that DOES the work when the task starts (the first listed runs). ' +
+                'Id or name, resolved within --space (repeatable)',
             multiple: true,
         }),
         'assignee-user': core_1.Flags.string({
@@ -182,7 +196,8 @@ class TasksCreate extends base_command_1.BaseCommand {
             multiple: true,
         }),
         'dri-agent': core_1.Flags.string({
-            description: 'Explicit accountable agent DRI (separate from assignees)',
+            description: 'Accountable agent (DRI), separate from assignees. `tasks start` runs an assignee, ' +
+                'not the DRI — use --assignee-agent for the agent that does the work',
         }),
         'dri-user': core_1.Flags.string({
             description: 'Explicit accountable human DRI (separate from assignees)',
@@ -219,7 +234,7 @@ class TasksCreate extends base_command_1.BaseCommand {
                 'ancestor it inherits from); with none set, the server drops the value. Set one with ' +
                 '`spaces update <space> --estimate-scale <scale> --estimate-migration <clear|migrate>`.',
         }),
-        tag: core_1.Flags.string({ description: 'Tag (repeatable)', multiple: true }),
+        tag: core_1.Flags.string({ description: label_ref_1.TAG_FLAG_HELP, multiple: true }),
         'label-id': core_1.Flags.string({
             aliases: ['label'],
             description: 'Attach a task label (repeatable) — id, or a name from `skrr labels list --applicable-to task`. ' +
@@ -517,6 +532,11 @@ class TasksCreate extends base_command_1.BaseCommand {
         const estimateWarning = droppedEstimateWarning(flags.estimate, created, payload.spaceId);
         if (estimateWarning)
             this.warn(estimateWarning);
+        // A `--tag` spelled like a declared label is almost always a label someone
+        // meant to attach (OSK-12053). Say so; never convert it implicitly.
+        const tagWarning = await taskTagLabelWarning(flags.tag, resolvedLabelIds);
+        if (tagWarning)
+            this.warn(tagWarning);
         if (flags.json) {
             // The raw task row alone cannot tell a script the assignee it implicitly
             // asked for was dropped (`assigneeAgentIds: []`) from "nobody was ever

package/dist/commands/tasks/start.d.ts

@@ -1,6 +1,7 @@
 import { BaseCommand } from '../../base-command';
 export default class TasksStart extends BaseCommand {
     static description: string;
+    static aliases: string[];
     static examples: string[];
     static args: {
         id: import("@oclif/core/lib/interfaces").Arg<string | undefined, Record<string, unknown>>;
@@ -13,3 +14,16 @@ export default class TasksStart extends BaseCommand {
     };
     run(): Promise<void>;
 }
+/**
+ * What to run next, printed after a start (OSK-12128). A start used to print
+ * two ids and stop, and the way to watch it was found by accident. Every
+ * command named here exists; `tasks-start.follow-up.spec.ts` pins that.
+ *
+ * The last line announces the files a local run adds to its working directory:
+ * the daemon writes a per-run instruction file (AGENTS.md for Codex, CLAUDE.md
+ * for a worktree session, plus any server-sent context file) when nothing is
+ * at that name, and removes what it wrote afterwards unless it was changed
+ * (`daemon/src/session-context-file.ts`). Unannounced, those were the first two
+ * files in a directory the task said to leave alone.
+ */
+export declare function startFollowUpLines(bin: string, taskRef: string): string[];

package/dist/commands/tasks/start.js

@@ -1,12 +1,17 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.startFollowUpLines = startFollowUpLines;
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const task_resolver_1 = require("../../lib/task-resolver");
 const git_task_1 = require("../../lib/git-task");
 class TasksStart extends base_command_1.BaseCommand {
-    static description = 'Start execution of a task (spawns a conversation + session)';
+    static description = 'Start execution of a task: its assignee agent runs it in a new conversation + session. ' +
+        'Alias: tasks execute';
+    // `tasks execute` is the verb a first-time user reaches for, and it was
+    // "not a command" (OSK-12128). One command, two names.
+    static aliases = ['tasks:execute'];
     static examples = [
         '<%= config.bin %> tasks start <task-id>',
         '<%= config.bin %> tasks start',
@@ -109,6 +114,31 @@ class TasksStart extends base_command_1.BaseCommand {
             this.log(`${branch.created ? 'Created' : 'Checked out'} branch: ${branch.branch}`);
         this.log(`Conversation: ${result.conversationId}`);
         this.log(`Session:      ${result.sessionId}`);
+        for (const line of startFollowUpLines(this.config.bin, taskIdentity.id))
+            this.log(line);
     }
 }
 exports.default = TasksStart;
+/**
+ * What to run next, printed after a start (OSK-12128). A start used to print
+ * two ids and stop, and the way to watch it was found by accident. Every
+ * command named here exists; `tasks-start.follow-up.spec.ts` pins that.
+ *
+ * The last line announces the files a local run adds to its working directory:
+ * the daemon writes a per-run instruction file (AGENTS.md for Codex, CLAUDE.md
+ * for a worktree session, plus any server-sent context file) when nothing is
+ * at that name, and removes what it wrote afterwards unless it was changed
+ * (`daemon/src/session-context-file.ts`). Unannounced, those were the first two
+ * files in a directory the task said to leave alone.
+ */
+function startFollowUpLines(bin, taskRef) {
+    return [
+        '',
+        'Follow it:',
+        `  ${bin} tasks watch ${taskRef}            status until it finishes or fails`,
+        `  ${bin} tasks transcript ${taskRef}       what the agent has said so far`,
+        `  ${bin} tasks approvals list ${taskRef}   approval requests waiting on you`,
+        'On a local machine, the run may add its instruction file (AGENTS.md / CLAUDE.md) to the',
+        'working directory while it runs; files the run wrote are removed afterwards unless changed.',
+    ];
+}

package/dist/commands/tasks/update.js

@@ -9,6 +9,7 @@ const tasks_1 = require("../../lib/tasks");
 const task_resolver_1 = require("../../lib/task-resolver");
 const tasks_2 = require("../../lib/tasks");
 const create_1 = require("./create");
+const label_ref_1 = require("../../lib/label-ref");
 class TasksUpdate extends base_command_1.BaseCommand {
     static description = 'Update an existing task (partial patch). Status and PROJECT changes go through ' +
         '`tasks move` — see `--goal` / `--space` below.';
@@ -156,7 +157,10 @@ class TasksUpdate extends base_command_1.BaseCommand {
             description: 'Remove a task from the list this one blocks (repeatable)',
             multiple: true,
         }),
-        tag: core_1.Flags.string({ description: 'Replace tags (repeatable)', multiple: true }),
+        tag: core_1.Flags.string({
+            description: `Replace tags (repeatable, whole-list). ${label_ref_1.TAG_FLAG_HELP}`,
+            multiple: true,
+        }),
         'label-id': core_1.Flags.string({
             aliases: ['label'],
             description: 'Replace the task labels with these ids (repeatable, whole-list). ' +
@@ -444,6 +448,9 @@ class TasksUpdate extends base_command_1.BaseCommand {
         const estimateWarning = (0, create_1.droppedEstimateWarning)(flags.estimate, updated, updated?.spaceId);
         if (estimateWarning)
             this.warn(estimateWarning);
+        const tagWarning = await (0, create_1.taskTagLabelWarning)(flags.tag, flags['label-id']);
+        if (tagWarning)
+            this.warn(tagWarning);
         if (flags.json) {
             this.log(JSON.stringify((0, web_url_1.withTaskUrl)(this.cliConfig.baseURL, updated), null, 2));
             return;

package/dist/commands/whoami.js

@@ -10,6 +10,7 @@ const auth_storage_1 = require("../lib/auth-storage");
 const keychain_1 = require("../lib/keychain");
 const cred_envelope_1 = require("../lib/cred-envelope");
 const config_1 = require("../lib/config");
+const cli_id_1 = require("../lib/cli-id");
 /**
  * `skrr whoami`
  *
@@ -101,7 +102,7 @@ class Whoami extends base_command_1.BaseCommand {
             daemonId,
             server: this.cliConfig.baseURL,
             profile: (0, keychain_1.getActiveProfile)(),
-            cliId: this.cliConfig.cliId ?? null,
+            cliId: (0, cli_id_1.resolveCliId)(this.cliConfig) ?? null,
             token: {
                 source: this.credentialSourceLabel(),
                 kind: this.resolvedCredential.kind,
@@ -135,8 +136,9 @@ class Whoami extends base_command_1.BaseCommand {
         // where the login message sends you to find out where you are (OSK-301).
         this.log(`Server:         ${(0, config_1.describeDeployment)(this.cliConfig.baseURL)}`);
         this.log(`Profile:        ${(0, keychain_1.getActiveProfile)()}`);
-        if (this.cliConfig.cliId) {
-            this.log(`CLI ID:         ${this.cliConfig.cliId}`);
+        const cliId = (0, cli_id_1.resolveCliId)(this.cliConfig);
+        if (cliId) {
+            this.log(`CLI ID:         ${cliId}`);
         }
         this.log(`Token source:   ${this.credentialSourceLabel() ?? '(none)'}`);
         this.log(`Token kind:     ${this.resolvedCredential.kind}`);

package/dist/lib/agent-config.d.ts

@@ -2,6 +2,8 @@ export declare const COMMITMENT_RESPONSIBILITY_LEVELS: readonly ["reasoning_only
 export declare const REASONING_TOOL_ESCAPES: readonly ["bash", "browser"];
 /** Warning printed by the three retired Commitment permission flags (OSK-11975). */
 export declare const COMMITMENT_PERMISSION_FLAG_RETIRED = "This setting no longer has any effect: Commitment runs use the agent's own permissions.";
+/** The three retired flags themselves: accepted at parse, warned on, never sent. */
+export declare const RETIRED_COMMITMENT_PERMISSION_FLAGS: readonly ["reasoning-tool-escape", "commitment-responsibility", "commitment-responsibility-ceiling"];
 export declare const RELEASE_INSTALL_CHANNELS: readonly ["latest", "manual"];
 /**
  * `09:00-18:00` or `09:00-18:00@America/Los_Angeles`, or a JSON object.

package/dist/lib/agent-config.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.RELEASE_INSTALL_CHANNELS = exports.COMMITMENT_PERMISSION_FLAG_RETIRED = exports.REASONING_TOOL_ESCAPES = exports.COMMITMENT_RESPONSIBILITY_LEVELS = void 0;
+exports.RELEASE_INSTALL_CHANNELS = exports.RETIRED_COMMITMENT_PERMISSION_FLAGS = exports.COMMITMENT_PERMISSION_FLAG_RETIRED = exports.REASONING_TOOL_ESCAPES = exports.COMMITMENT_RESPONSIBILITY_LEVELS = void 0;
 exports.parseWorkingHoursFlag = parseWorkingHoursFlag;
 exports.mergeAgentConfigFlags = mergeAgentConfigFlags;
 const prompt_1 = require("./prompt");
@@ -9,6 +9,12 @@ exports.COMMITMENT_RESPONSIBILITY_LEVELS = ['reasoning_only', 'full_ownership'];
 exports.REASONING_TOOL_ESCAPES = ['bash', 'browser'];
 /** Warning printed by the three retired Commitment permission flags (OSK-11975). */
 exports.COMMITMENT_PERMISSION_FLAG_RETIRED = "This setting no longer has any effect: Commitment runs use the agent's own permissions.";
+/** The three retired flags themselves: accepted at parse, warned on, never sent. */
+exports.RETIRED_COMMITMENT_PERMISSION_FLAGS = [
+    'reasoning-tool-escape',
+    'commitment-responsibility',
+    'commitment-responsibility-ceiling',
+];
 exports.RELEASE_INSTALL_CHANNELS = ['latest', 'manual'];
 /**
  * `09:00-18:00` or `09:00-18:00@America/Los_Angeles`, or a JSON object.
@@ -102,15 +108,13 @@ function mergeAgentConfigFlags(body, flags) {
     if (flags['todo-working-hours'] !== undefined) {
         parsed.todoWorkingHours = parseWorkingHoursFlag(String(flags['todo-working-hours']));
     }
-    if (flags['reasoning-tool-escape'] !== undefined) {
-        parsed.reasoningToolEscapes = flags['reasoning-tool-escape'];
-    }
-    if (flags['commitment-responsibility'] !== undefined) {
-        parsed.commitmentResponsibilityDefault = flags['commitment-responsibility'];
-    }
-    if (flags['commitment-responsibility-ceiling'] !== undefined) {
-        parsed.commitmentResponsibilityCeiling = flags['commitment-responsibility-ceiling'];
-    }
+    // `--reasoning-tool-escape`, `--commitment-responsibility` and
+    // `--commitment-responsibility-ceiling` are retired (OSK-11975) and are
+    // deliberately NOT forwarded. The server still accepts and echoes the stored
+    // fields, so sending them wrote a value nothing reads and handed it back as
+    // if it were live — and "a ceiling a commitment may not exceed" is a safety
+    // claim a person then believes (OSK-12068). The flags stay parseable so old
+    // scripts do not break; oclif prints COMMITMENT_PERMISSION_FLAG_RETIRED.
     if (flags['tool-resources'] !== undefined) {
         parsed.tool_resources = JSON.parse(String(flags['tool-resources']));
     }

package/dist/lib/agentic-stream.d.ts

@@ -346,6 +346,11 @@ export declare class AgenticStreamClient {
      * repeat count varies run to run and cannot be inferred by a consumer.
      */
     private readonly seenLifecycle;
+    /**
+     * Whether this client's transport has dropped since it first connected. Until
+     * it has, every `session:join` it sends declares a FIRST join (OSK-12124).
+     */
+    private transportDropped;
     /** `call` → tool name, so a daemon `tool-call-end` can be named (OSK-7730). */
     private readonly toolNamesByCall;
     /** `permission-ask` requestId → tool name, to name its resolution (OSK-12113). */
@@ -373,6 +378,21 @@ export declare class AgenticStreamClient {
     settledResult(): AgenticStreamResult | null;
     constructor(options: AgenticStreamOptions);
     run(): Promise<AgenticStreamResult>;
+    /**
+     * The `session:join` payload.
+     *
+     * This client learns its session id from the HTTP acceptance and only then
+     * connects, while a daemon turn publishes its `session:init` at once. The
+     * server drops buffered frames older than the socket's connect time — right
+     * for a RE-connect, which already rendered them, and wrong here, where they
+     * were never seen: `run.started` (the dispatched mode and its source) never
+     * reached a daemon turn's stream (OSK-12124). `firstJoin` says so, and the
+     * server then replays the pre-connect lifecycle frames. Both joins of the
+     * first connection carry it, because the server's replay drains the shared
+     * buffer and either join may be the one that reaches it first; the stream's
+     * own lifecycle dedupe absorbs the overlap. After a drop it is not sent.
+     */
+    private sessionJoinPayload;
     /**
      * (Re)start the silence watchdog that asks the durable record what happened.
      *

package/dist/lib/agentic-stream.js

@@ -280,9 +280,14 @@ function describePermissionDecider(ev) {
                 ? `the ${mode} permission mode (nobody was asked)`
                 : "the session's permission mode (nobody was asked)";
         case 'policy':
-            return ev.by === 'server'
-                ? 'the unattended-run policy (nobody could be asked)'
-                : 'a runtime policy (nobody was asked)';
+            if (ev.by === 'server')
+                return 'the unattended-run policy (nobody could be asked)';
+            // A client that denied on its own because it could not ask anyone — the
+            // skrr CLI without --approve-tools, say (OSK-12113).
+            if (typeof ev.surface === 'string' && SURFACE_LABELS[ev.surface]) {
+                return `${SURFACE_LABELS[ev.surface]}, which had nobody to ask (nobody was asked)`;
+            }
+            return 'a runtime policy (nobody was asked)';
         case 'session-grant':
             return 'an earlier "allow for this session"';
         case 'person': {
@@ -520,6 +525,11 @@ class AgenticStreamClient {
      * repeat count varies run to run and cannot be inferred by a consumer.
      */
     seenLifecycle = new Set();
+    /**
+     * Whether this client's transport has dropped since it first connected. Until
+     * it has, every `session:join` it sends declares a FIRST join (OSK-12124).
+     */
+    transportDropped = false;
     /** `call` → tool name, so a daemon `tool-call-end` can be named (OSK-7730). */
     toolNamesByCall = new Map();
     /** `permission-ask` requestId → tool name, to name its resolution (OSK-12113). */
@@ -581,11 +591,30 @@ class AgenticStreamClient {
         // the result instead of awaiting an attach nobody is still attempting.
         if (this.settled || this.closed || !this.socket)
             return result;
-        this.socket.emit('session:join', { sessionId: this.options.sessionId });
+        this.socket.emit('session:join', this.sessionJoinPayload());
         this.emit({ type: 'session.joined', sessionId: this.options.sessionId });
         this.armIdleProbe();
         return result;
     }
+    /**
+     * The `session:join` payload.
+     *
+     * This client learns its session id from the HTTP acceptance and only then
+     * connects, while a daemon turn publishes its `session:init` at once. The
+     * server drops buffered frames older than the socket's connect time — right
+     * for a RE-connect, which already rendered them, and wrong here, where they
+     * were never seen: `run.started` (the dispatched mode and its source) never
+     * reached a daemon turn's stream (OSK-12124). `firstJoin` says so, and the
+     * server then replays the pre-connect lifecycle frames. Both joins of the
+     * first connection carry it, because the server's replay drains the shared
+     * buffer and either join may be the one that reaches it first; the stream's
+     * own lifecycle dedupe absorbs the overlap. After a drop it is not sent.
+     */
+    sessionJoinPayload() {
+        return this.transportDropped
+            ? { sessionId: this.options.sessionId }
+            : { sessionId: this.options.sessionId, firstJoin: true };
+    }
     /**
      * (Re)start the silence watchdog that asks the durable record what happened.
      *
@@ -726,10 +755,11 @@ class AgenticStreamClient {
         const socket = this.socket;
         const match = (event) => !event.sessionId || event.sessionId === this.options.sessionId;
         socket.on('connect', () => {
-            socket.emit('session:join', { sessionId: this.options.sessionId });
+            socket.emit('session:join', this.sessionJoinPayload());
             this.emit({ type: 'transport.connected', sessionId: this.options.sessionId });
         });
         socket.on('disconnect', (reason) => {
+            this.transportDropped = true;
             if (this.settled)
                 return;
             this.emit({ type: 'transport.disconnected', sessionId: this.options.sessionId, reason });
@@ -913,6 +943,10 @@ class AgenticStreamClient {
                     toolUseId: event.toolUseId,
                     toolName: event.toolName,
                     reason: 'CLI was not started with --approve-tools',
+                    // Nobody was asked: this client could not put the prompt to anyone.
+                    // The server records it as a policy decision, not a person's
+                    // (OSK-12113) — it used to read "a person on the skrr CLI".
+                    automatic: true,
                 });
             }
             this.emit({ ...event, type: 'permission.denied', reason: 'noninteractive_or_not_enabled' });

package/dist/lib/auth-failure.js

@@ -33,7 +33,10 @@ function describeRefreshRefusal(refusal, opts) {
     // configuration on this machine (a different HOME or config dir sharing the
     // same login Keychain) can write this profile's credential under its own ID.
     // Observed: a token minted for `cli_devin_dogfood` sitting in the default
-    // profile's slot.
+    // profile's slot. Since OSK-12135 the slot is namespaced by config root and a
+    // read refuses a bundle bound to another cliId before presenting it, so this
+    // is now reached only when the server's binding disagrees with a token that
+    // carries no readable `did`.
     if (/bound to a different daemon/i.test(message)) {
         return {
             code,

package/dist/lib/auth-storage.d.ts

@@ -6,14 +6,33 @@ export interface AuthBundle {
     refreshExpiresAt?: number;
     /** Normalized API origin that issued this access/refresh pair. */
     serverOrigin?: string;
+    /**
+     * The config that wrote this bundle, as stored. Filled on write from the
+     * current config; callers never need to set it.
+     */
+    owner?: CredentialOwner;
+}
+/** Which skrr config a credential belongs to. */
+export interface CredentialOwner {
+    /** Resolved config root (`~/.skrr`, or the `SKRR_CONFIG_DIR` override). */
+    configRoot?: string;
+    /** The CLI identity the server bound the refresh family to. */
+    cliId?: string;
 }
 export type CredentialOriginStatus = 'none' | 'unchecked' | 'matched' | 'unbound' | 'mismatch';
+/** `foreign`: the stored bundle belongs to another skrr config and was not used. */
+export type CredentialOwnerStatus = 'foreign';
 export interface ReadResult {
     bundle: AuthBundle | null;
     backend: AuthBackend;
     originStatus?: CredentialOriginStatus;
     storedServerOrigin?: string;
     expectedServerOrigin?: string;
+    ownerStatus?: CredentialOwnerStatus;
+    /** For `foreign`: who the stored bundle belongs to. */
+    storedOwner?: CredentialOwner;
+    /** For `foreign`: who this process is. */
+    expectedOwner?: CredentialOwner;
 }
 export interface WriteOptions {
     /** Bind/overwrite the bundle's issuing origin. Invalid origins are rejected. */
@@ -47,6 +66,11 @@ export declare function deleteFileBackend(): void;
  * function returns whatever is persisted.
  */
 export declare function readFromBackend(expectedServerOrigin?: string): ReadResult;
+/**
+ * One sentence naming whose credential was refused and why, for the surfaces
+ * that explain an absent sign-in (BaseCommand, `skrr doctor`).
+ */
+export declare function describeForeignCredential(result: ReadResult): string | null;
 export declare function writeToBackend(bundle: AuthBundle, options?: WriteOptions): AuthBackend;
 /**
  * Clear both backends. Called on `skrr logout` (and internally during