@skrr-ai/cli 0.1.51 → 0.1.52

package/dist/lib/dedicated-machines.d.ts

@@ -111,8 +111,17 @@ export declare function describeDedicatedCheckpoint(lease: DedicatedLease | unde
  * machine to the previous image. Files under the workspace survive both.
  */
 export interface DedicatedImageStanding {
-    /** A newer image exists that has not already failed on this machine. */
+    /**
+     * A newer APPROVED image exists that has not already failed on this machine.
+     * False is not "running the latest daemon": a release no approved image
+     * carries yet is not an update this machine can move to (OSK-12153).
+     */
     updateAvailable?: boolean;
+    /**
+     * The daemon the approved image carries, when the server can say: this
+     * machine runs that image and its daemon reported a version. Null otherwise.
+     */
+    approvedImageDaemonVersion?: string | null;
     /** When the older image stops being supported; null when there is no deadline. */
     updateBy?: string | null;
     lastUpdate?: {
@@ -121,6 +130,26 @@ export interface DedicatedImageStanding {
         settledAt?: string | null;
     } | null;
 }
+/**
+ * The latest daemon release, as `show` read it from the signed release feed:
+ * a version, or why it could not be read. Never inferred from the machine.
+ */
+export type LatestDaemonRelease = {
+    version: string;
+} | {
+    error: string;
+};
+/** -1 / 0 / 1, or null when either side is not a version. */
+export declare function compareDaemonVersions(a: string, b: string): number | null;
+/**
+ * Which daemon the approved image carries against the latest daemon release
+ * (OSK-12153). `image update: current` used to be the whole answer, while the
+ * daemon on the same machine said a newer release existed: "current" means no
+ * newer APPROVED image, and a release that no approved image carries yet is not
+ * something this machine can move to. Both halves are said, and an unknown
+ * half is said to be unknown rather than left out.
+ */
+export declare function describeDedicatedDaemonRelease(image: DedicatedImageStanding, latest: LatestDaemonRelease | null | undefined): string | null;
 /** One line saying where a machine's image stands and what the owner can do. */
 export declare function describeDedicatedImageStanding(image: DedicatedImageStanding, leaseId?: string): string;
 /**
@@ -527,7 +556,9 @@ export declare function dedicatedSpendSummary(lease: DedicatedLease): string;
  */
 /** One line saying what a deletion still allows. */
 export declare function describeDedicatedDeletion(deletion: DedicatedLeaseDeletion, leaseId?: string): string;
-export declare function describeDedicatedLease(lease: DedicatedLease, harnesses?: readonly Harness[]): string[];
+export declare function describeDedicatedLease(lease: DedicatedLease, harnesses?: readonly Harness[], opts?: {
+    latestDaemonRelease?: LatestDaemonRelease | null;
+}): string[];
 /** "2026-09-30 14:00 UTC (in 17 days)" — a deadline readable without converting it. */
 export declare function formatDedicatedDeadline(value: string | null | undefined, now?: Date): string;
 /**

package/dist/lib/dedicated-machines.js

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEDICATED_FILE_MAX_BYTES = exports.DEDICATED_FILE_CHUNK_BYTES = exports.DEDICATED_EXEC_DEFAULT_TIMEOUT_MS = exports.DEDICATED_EXEC_MAX_TIMEOUT_MS = exports.DEDICATED_MACHINE_PRODUCT = exports.DEDICATED_LEASE_ACTIONS = void 0;
 exports.describeDedicatedCheckpoint = describeDedicatedCheckpoint;
+exports.compareDaemonVersions = compareDaemonVersions;
+exports.describeDedicatedDaemonRelease = describeDedicatedDaemonRelease;
 exports.describeDedicatedImageStanding = describeDedicatedImageStanding;
 exports.dedicatedRuntimeCreateInput = dedicatedRuntimeCreateInput;
 exports.isDedicatedRepositoryRef = isDedicatedRepositoryRef;
@@ -73,6 +75,52 @@ function describeDedicatedCheckpoint(lease) {
         return null;
     return (0, data_provider_1.describeMachineCheckpointOutcome)(operation.checkpoint, { action: operation.action });
 }
+function versionParts(version) {
+    const match = /^v?(\d+)\.(\d+)\.(\d+)/.exec(String(version || '').trim());
+    return match ? match.slice(1, 4).map(Number) : null;
+}
+/** -1 / 0 / 1, or null when either side is not a version. */
+function compareDaemonVersions(a, b) {
+    const left = versionParts(a);
+    const right = versionParts(b);
+    if (!left || !right)
+        return null;
+    for (let i = 0; i < 3; i += 1) {
+        if (left[i] !== right[i])
+            return left[i] < right[i] ? -1 : 1;
+    }
+    return 0;
+}
+/**
+ * Which daemon the approved image carries against the latest daemon release
+ * (OSK-12153). `image update: current` used to be the whole answer, while the
+ * daemon on the same machine said a newer release existed: "current" means no
+ * newer APPROVED image, and a release that no approved image carries yet is not
+ * something this machine can move to. Both halves are said, and an unknown
+ * half is said to be unknown rather than left out.
+ */
+function describeDedicatedDaemonRelease(image, latest) {
+    if (!latest)
+        return null;
+    const carried = image.approvedImageDaemonVersion || null;
+    const latestText = 'version' in latest
+        ? `latest release skrrd ${latest.version}`
+        : `latest release unknown (${latest.error})`;
+    if (!carried) {
+        return image.updateAvailable ? latestText : `approved image's daemon unknown · ${latestText}`;
+    }
+    if (!('version' in latest)) {
+        return `approved image carries skrrd ${carried} · ${latestText}`;
+    }
+    const compared = compareDaemonVersions(carried, latest.version);
+    if (compared === 0) {
+        return `approved image carries skrrd ${carried}, the latest release`;
+    }
+    if (compared === -1) {
+        return `approved image carries skrrd ${carried} · latest release skrrd ${latest.version} is not in an approved image yet, so there is nothing to update to`;
+    }
+    return `approved image carries skrrd ${carried} · ${latestText}`;
+}
 /** One line saying where a machine's image stands and what the owner can do. */
 function describeDedicatedImageStanding(image, leaseId) {
     const last = image.lastUpdate;
@@ -547,7 +595,7 @@ function describeDedicatedDeletion(deletion, leaseId) {
     }
     return 'nothing to restore; every copy is deleted when the window closes';
 }
-function describeDedicatedLease(lease, harnesses = []) {
+function describeDedicatedLease(lease, harnesses = [], opts = {}) {
     const lines = [dedicatedLeaseDisplayName(lease)];
     const row = (label, value) => {
         if (value === undefined || value === null || value === '')
@@ -584,6 +632,7 @@ function describeDedicatedLease(lease, harnesses = []) {
     row('image', image);
     if (lease.health?.image) {
         row('image update', describeDedicatedImageStanding(lease.health.image, dedicatedLeaseId(lease)));
+        row('image daemon', describeDedicatedDaemonRelease(lease.health.image, opts.latestDaemonRelease));
     }
     if (lease.daemon?.version || lease.daemon?.lastHeartbeatAt) {
         row('daemon', [

package/dist/lib/delegated-cli.js

@@ -260,6 +260,22 @@ async function fetchDelegatedCliCredential(env = process.env, options = {}) {
             const body = (await res.json().catch(() => null));
             if (res.status === 403 && body?.code === 'DELEGATED_CLI_CAPABILITY_REJECTED')
                 return null;
+            if ((res.status === 503 || body?.code === 'DELEGATED_CLI_CREDENTIAL_UNAVAILABLE') &&
+                (typeof body?.upstreamCode === 'string' || typeof body?.upstreamStatus === 'number')) {
+                // The daemon named the server's refusal of its own mint (OSK-12151):
+                // say that, with the code, rather than guess at three possible causes.
+                const named = [
+                    typeof body?.upstreamStatus === 'number' ? `HTTP ${body.upstreamStatus}` : '',
+                    typeof body?.upstreamCode === 'string' ? body.upstreamCode : '',
+                ]
+                    .filter(Boolean)
+                    .join(' ');
+                // The daemon's `message` already names the refusal; fall back to the
+                // status and code when an older daemon sent none.
+                throw new Error(typeof body?.message === 'string' && body.message
+                    ? `the daemon's delegated CLI broker could not mint a credential: ${body.message}`
+                    : `the skrr server refused the daemon's request for this session's credential (${named}).`);
+            }
             if (res.status === 503 || body?.code === 'DELEGATED_CLI_CREDENTIAL_UNAVAILABLE') {
                 throw new Error(`the daemon's delegated CLI broker is alive but cannot mint a credential ` +
                     `(HTTP ${res.status}). The daemon cannot reach the auth upstream, holds ` +

package/dist/lib/first-party-harness-broker.js

@@ -73,6 +73,7 @@ const api_fetch_1 = require("./api-fetch");
 const auth_storage_1 = require("./auth-storage");
 const auth_core_init_1 = require("./auth-core-init");
 const config_1 = require("./config");
+const cli_id_1 = require("./cli-id");
 const cred_envelope_1 = require("./cred-envelope");
 const device_id_1 = require("./device-id");
 const first_party_harness_1 = require("./first-party-harness");
@@ -859,9 +860,10 @@ function hasLocalCredential() {
 /**
  * This installation's runtime id.
  *
- * Persisted at first login as `cliId`; regenerated deterministically when absent
- * (same hostname+user always yields the same value), matching `daemonBroker.ts`
- * and `refresh.ts`. Normalized to the `cli_` namespace the server requires,
+ * The id login and refresh present, read through `resolveCliId` (a named
+ * profile may have its own, OSK-12156); regenerated deterministically as the
+ * machine id when nothing is stored (same hostname+user always yields the same
+ * value). Normalized to the `cli_` namespace the server requires,
  * because `OVERSKY_CLI_ID` is overlaid verbatim with no format check and a
  * hand-set value would otherwise come back as an opaque
  * `runtime-id-namespace-mismatch`.
@@ -869,7 +871,7 @@ function hasLocalCredential() {
 function localRuntimeId() {
     const configured = (() => {
         try {
-            return (0, config_1.loadConfig)().cliId?.trim();
+            return (0, cli_id_1.resolveCliId)((0, config_1.loadConfig)());
         }
         catch {
             return undefined;

package/dist/lib/keychain.d.ts

@@ -11,6 +11,19 @@ export declare function setActiveProfile(profile: string): void;
  */
 export declare function isProfileResolved(): boolean;
 export declare function getActiveProfile(): string;
+/** The resolved config root this process's credentials belong to. */
+export declare function resolvedConfigRoot(): string;
+/** Is `root` this account's default skrr root, the owner of the legacy slot? */
+export declare function isDefaultConfigRoot(root?: string): boolean;
+/** A slot other than this root's own. */
+export type ForeignSlot = {
+    kind: 'legacy';
+} | {
+    kind: 'displaced';
+    cliId: string;
+};
+/** True when this root's own slot IS the historical profile-only slot. */
+export declare function isLegacySlotCurrent(): boolean;
 /** @internal exposed for tests / diagnostics. */
 export declare function __currentServiceForTest(): string;
 /**
@@ -47,6 +60,32 @@ export declare function readServerOrigin(): string | null;
 export declare function writeServerOrigin(origin: string): boolean;
 /** Remove the issuing-origin companion slot. */
 export declare function deleteServerOrigin(): void;
+/** Raw owner record (`{configRoot, cliId}` JSON) of this root's own slot. */
+export declare function readOwner(): string | null;
+export declare function writeOwner(owner: string): boolean;
+export declare function deleteOwner(): void;
+/** Every value a CLI bundle keeps in the Keychain, read from one service. */
+export interface KeychainBundleSlots {
+    token: KeychainEntry;
+    refresh: KeychainEntry | null;
+    serverOrigin: string | null;
+    owner: string | null;
+}
+/**
+ * Read a whole bundle from a slot this root does not own (the legacy slot, or a
+ * displaced one). The caller decides whether it is ours; nothing here rewrites
+ * a slot on another config's behalf.
+ */
+export declare function readBundleAt(slot: ForeignSlot): KeychainBundleSlots | null;
+/**
+ * Copy every item of one slot to another BYTE FOR BYTE (the displacement
+ * rescue). Raw on purpose: the secret items may be sealed under the owning
+ * config's envelope key, and re-sealing them under ours would make the copy
+ * unreadable to the one config it exists for.
+ */
+export declare function copyBundle(from: ForeignSlot, to: ForeignSlot): boolean;
+/** Remove every CLI item under a slot this root does not own. The caller proves ownership. */
+export declare function deleteAllAt(slot: ForeignSlot): void;
 export declare function deleteToken(): void;
 export declare function deleteRefreshToken(): void;
 /**

package/dist/lib/keychain.js

@@ -1,9 +1,45 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_PROFILE = void 0;
 exports.setActiveProfile = setActiveProfile;
 exports.isProfileResolved = isProfileResolved;
 exports.getActiveProfile = getActiveProfile;
+exports.resolvedConfigRoot = resolvedConfigRoot;
+exports.isDefaultConfigRoot = isDefaultConfigRoot;
+exports.isLegacySlotCurrent = isLegacySlotCurrent;
 exports.__currentServiceForTest = __currentServiceForTest;
 exports.isAvailable = isAvailable;
 exports.resetAvailability = resetAvailability;
@@ -14,6 +50,12 @@ exports.writeRefreshToken = writeRefreshToken;
 exports.readServerOrigin = readServerOrigin;
 exports.writeServerOrigin = writeServerOrigin;
 exports.deleteServerOrigin = deleteServerOrigin;
+exports.readOwner = readOwner;
+exports.writeOwner = writeOwner;
+exports.deleteOwner = deleteOwner;
+exports.readBundleAt = readBundleAt;
+exports.copyBundle = copyBundle;
+exports.deleteAllAt = deleteAllAt;
 exports.deleteToken = deleteToken;
 exports.deleteRefreshToken = deleteRefreshToken;
 exports.deleteLegacyBrandEntries = deleteLegacyBrandEntries;
@@ -42,11 +84,39 @@ exports.resolveProfileFromArgv = resolveProfileFromArgv;
  *   account = "cli-refresh"           → refresh JWT
  *   account = "cli-refresh-expires"   → epoch ms expiry, optional
  *   account = "cli-server-origin"     → issuing API origin (non-secret)
+ *   account = "cli-owner"             → JSON {configRoot, cliId} of the config
+ *                                       that wrote this bundle (non-secret)
+ *
+ * OSK-12135 — the slot is namespaced by CONFIG ROOT as well as profile. The
+ * login Keychain is one per macOS user, but the CLI identity (`cliId`) lives in
+ * the config root, so a second skrr setup on the same Mac (a different HOME or
+ * `SKRR_CONFIG_DIR`) with the same profile name used to write into this
+ * profile's slot, and the next refresh presented a token bound to the other
+ * setup's `cliId` (`stored=cli_devin_dogfood presented=cli_81ff3efd4ff8`).
+ *
+ *   - The account's DEFAULT root (`<passwd home>/.skrr`) keeps the historical
+ *     service name `ai.skrr.cli.<profile>`, so a normal single-config machine
+ *     reads exactly the slot it always has — no migration, no re-login, and an
+ *     older skrr binary sharing that config keeps interoperating.
+ *   - Any other root writes `ai.skrr.cli.<profile>.root-<sha256(root)[:12]>`,
+ *     a region no other root can name. It may READ the legacy slot as a
+ *     migration, and only when that bundle positively belongs to it (see
+ *     `auth-storage.ts`).
+ *   - `ai.skrr.cli.<profile>.cli-<cliId>` holds a credential the default root
+ *     DISPLACED from its own slot because an older binary of another config
+ *     wrote it there. It is keyed by the identity the server bound it to, so
+ *     only that config can adopt it, and a login destroys nobody's credential.
+ *
+ * The passwd home (not `$HOME`) defines "default", because a setup that swaps
+ * `$HOME` is exactly the second config this protects against.
  *
  * On non-darwin (Linux/CI) every function is a no-op / null-return so the
  * caller cleanly falls back to the file-based `cli-auth.json` backend.
  */
 const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = require("node:crypto");
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
 const cred_envelope_1 = require("./cred-envelope");
 const auth_core_1 = require("@skrr-ai/auth-core");
 /** Service-name prefix. Always followed by `.<profile>`. */
@@ -58,6 +128,7 @@ const ACCOUNT_EXPIRES = 'cli-token-expires';
 const ACCOUNT_REFRESH = 'cli-refresh';
 const ACCOUNT_REFRESH_EXPIRES = 'cli-refresh-expires';
 const ACCOUNT_SERVER_ORIGIN = 'cli-server-origin';
+const ACCOUNT_OWNER = 'cli-owner';
 /** macOS `security` exit code when the requested item does not exist. */
 const SECURITY_ITEM_NOT_FOUND = 44;
 /** Cached availability — probed once at first call. */
@@ -95,9 +166,55 @@ function isProfileResolved() {
 function getActiveProfile() {
     return _activeProfile;
 }
-function currentService() {
+/** The resolved config root this process's credentials belong to. */
+function resolvedConfigRoot() {
+    return path.resolve((0, auth_core_1.resolveConfigRoot)());
+}
+/**
+ * The account's home from the user database, NOT `$HOME`. A second skrr setup
+ * that swaps `$HOME` must not count as the default root, or it would share the
+ * historical slot with the real one — the incident this namespacing exists for.
+ */
+function accountHome() {
+    try {
+        const home = os.userInfo().homedir;
+        if (home)
+            return home;
+    }
+    catch {
+        /* no passwd entry (some containers) — fall through */
+    }
+    return os.homedir();
+}
+/** Is `root` this account's default skrr root, the owner of the legacy slot? */
+function isDefaultConfigRoot(root = resolvedConfigRoot()) {
+    return path.resolve(root) === path.resolve(accountHome(), '.skrr');
+}
+function legacyService() {
     return `${SERVICE_BASE}.${_activeProfile}`;
 }
+function currentService() {
+    const root = resolvedConfigRoot();
+    if (isDefaultConfigRoot(root))
+        return legacyService();
+    const digest = (0, node_crypto_1.createHash)('sha256').update(root).digest('hex').slice(0, 12);
+    return `${legacyService()}.root-${digest}`;
+}
+function displacedService(cliId) {
+    // A cliId is `cli_<hex>` in practice; anything else is hashed so the service
+    // name never carries characters `security -i` quoting has to worry about.
+    const safe = /^[A-Za-z0-9_-]{1,64}$/.test(cliId)
+        ? cliId
+        : (0, node_crypto_1.createHash)('sha256').update(cliId).digest('hex').slice(0, 16);
+    return `${legacyService()}.cli-${safe}`;
+}
+function serviceForSlot(slot) {
+    return slot.kind === 'legacy' ? legacyService() : displacedService(slot.cliId);
+}
+/** True when this root's own slot IS the historical profile-only slot. */
+function isLegacySlotCurrent() {
+    return currentService() === legacyService();
+}
 /** @internal exposed for tests / diagnostics. */
 function __currentServiceForTest() {
     return currentService();
@@ -140,7 +257,11 @@ function resetAvailability() {
 function isSecretAccount(account) {
     return account === ACCOUNT_TOKEN || account === ACCOUNT_REFRESH;
 }
-function readSlot(account, service = currentService()) {
+/**
+ * `raw` returns the stored string exactly, with no envelope transform — for
+ * copying another config's item, which may be sealed under a key we lack.
+ */
+function readSlot(account, service = currentService(), raw_ = false) {
     let raw;
     try {
         const out = (0, node_child_process_1.execFileSync)('security', ['find-generic-password', '-s', service, '-a', account, '-w'], { stdio: ['ignore', 'pipe', 'ignore'], encoding: 'utf-8' });
@@ -161,7 +282,7 @@ function readSlot(account, service = currentService()) {
         }
         return null;
     }
-    if (!isSecretAccount(account))
+    if (raw_ || !isSecretAccount(account))
         return raw;
     // L12 — route secret slots through the envelope.
     // - Envelope on disk + path active → returns plaintext.
@@ -172,7 +293,10 @@ function readSlot(account, service = currentService()) {
     const result = (0, cred_envelope_1.maybeDecryptOnRead)(raw);
     if (result.plaintext === null)
         return null;
-    if (result.needsMigration) {
+    // Only this root's OWN slot is upgraded. A slot read as a migration source may
+    // belong to another config, whose envelope key this process does not hold —
+    // sealing it under ours would make it unreadable to its owner (OSK-12135).
+    if (result.needsMigration && service === currentService()) {
         // Best-effort upgrade — a failure here doesn't break the read; the
         // slot just stays plaintext and we'll try again on the next read.
         try {
@@ -191,11 +315,11 @@ function readSlot(account, service = currentService()) {
 function quoteForSecurityInteractive(v) {
     return '"' + v.replace(/\\/g, '\\\\').replace(/"/g, '\\"') + '"';
 }
-function writeSlot(account, value, service = currentService()) {
+function writeSlot(account, value, service = currentService(), raw = false) {
     try {
         // L12 — wrap secret-bearing slots through the envelope when active.
-        // Empty / non-secret slots are passthrough.
-        const wireValue = isSecretAccount(account) ? (0, cred_envelope_1.maybeEncryptForWrite)(value) : value;
+        // Empty / non-secret slots are passthrough, and so is a raw copy.
+        const wireValue = !raw && isSecretAccount(account) ? (0, cred_envelope_1.maybeEncryptForWrite)(value) : value;
         // -i reads commands from stdin so the JWT never appears in argv (it
         // would otherwise be visible to same-UID `ps` observers). -U updates
         // in place instead of failing with "item already exists".
@@ -231,13 +355,11 @@ function deleteSlot(account, service = currentService()) {
         }
     }
 }
-function readToken() {
-    if (!isAvailable())
-        return null;
-    const token = readSlot(ACCOUNT_TOKEN);
+function readEntryAt(service, account, expiresAccount) {
+    const token = readSlot(account, service);
     if (!token)
         return null;
-    const expiresRaw = readSlot(ACCOUNT_EXPIRES);
+    const expiresRaw = readSlot(expiresAccount, service);
     let expiresAt;
     if (expiresRaw) {
         const parsed = Number.parseInt(expiresRaw, 10);
@@ -246,51 +368,41 @@ function readToken() {
     }
     return expiresAt !== undefined ? { token, expiresAt } : { token };
 }
-function writeToken(token, expiresAt) {
-    if (!isAvailable())
-        return false;
-    if (!token)
-        return false;
-    if (!writeSlot(ACCOUNT_TOKEN, token))
+function writeEntryAt(service, account, expiresAccount, token, expiresAt) {
+    if (!writeSlot(account, token, service))
         return false;
     if (expiresAt && Number.isFinite(expiresAt)) {
-        writeSlot(ACCOUNT_EXPIRES, String(Math.trunc(expiresAt)));
+        writeSlot(expiresAccount, String(Math.trunc(expiresAt)), service);
     }
     else {
         // Stale expiry from a prior write would lie about the token's lifetime.
-        deleteSlot(ACCOUNT_EXPIRES);
+        deleteSlot(expiresAccount, service);
     }
     return true;
 }
-function readRefreshToken() {
+function readToken() {
     if (!isAvailable())
         return null;
-    const token = readSlot(ACCOUNT_REFRESH);
+    return readEntryAt(currentService(), ACCOUNT_TOKEN, ACCOUNT_EXPIRES);
+}
+function writeToken(token, expiresAt) {
+    if (!isAvailable())
+        return false;
     if (!token)
+        return false;
+    return writeEntryAt(currentService(), ACCOUNT_TOKEN, ACCOUNT_EXPIRES, token, expiresAt);
+}
+function readRefreshToken() {
+    if (!isAvailable())
         return null;
-    const expiresRaw = readSlot(ACCOUNT_REFRESH_EXPIRES);
-    let expiresAt;
-    if (expiresRaw) {
-        const parsed = Number.parseInt(expiresRaw, 10);
-        if (Number.isFinite(parsed) && parsed > 0)
-            expiresAt = parsed;
-    }
-    return expiresAt !== undefined ? { token, expiresAt } : { token };
+    return readEntryAt(currentService(), ACCOUNT_REFRESH, ACCOUNT_REFRESH_EXPIRES);
 }
 function writeRefreshToken(token, expiresAt) {
     if (!isAvailable())
         return false;
     if (!token)
         return false;
-    if (!writeSlot(ACCOUNT_REFRESH, token))
-        return false;
-    if (expiresAt && Number.isFinite(expiresAt)) {
-        writeSlot(ACCOUNT_REFRESH_EXPIRES, String(Math.trunc(expiresAt)));
-    }
-    else {
-        deleteSlot(ACCOUNT_REFRESH_EXPIRES);
-    }
-    return true;
+    return writeEntryAt(currentService(), ACCOUNT_REFRESH, ACCOUNT_REFRESH_EXPIRES, token, expiresAt);
 }
 /**
  * Read the API origin that issued the active token bundle.
@@ -321,6 +433,82 @@ function deleteServerOrigin() {
         return;
     deleteSlot(ACCOUNT_SERVER_ORIGIN);
 }
+/** Raw owner record (`{configRoot, cliId}` JSON) of this root's own slot. */
+function readOwner() {
+    if (!isAvailable())
+        return null;
+    const value = readSlot(ACCOUNT_OWNER);
+    return value && value.length > 0 ? value : null;
+}
+function writeOwner(owner) {
+    if (!isAvailable())
+        return false;
+    if (!owner)
+        return false;
+    return writeSlot(ACCOUNT_OWNER, owner);
+}
+function deleteOwner() {
+    if (!isAvailable())
+        return;
+    deleteSlot(ACCOUNT_OWNER);
+}
+/**
+ * Read a whole bundle from a slot this root does not own (the legacy slot, or a
+ * displaced one). The caller decides whether it is ours; nothing here rewrites
+ * a slot on another config's behalf.
+ */
+function readBundleAt(slot) {
+    if (!isAvailable())
+        return null;
+    const service = serviceForSlot(slot);
+    const token = readEntryAt(service, ACCOUNT_TOKEN, ACCOUNT_EXPIRES);
+    if (!token)
+        return null;
+    return {
+        token,
+        refresh: readEntryAt(service, ACCOUNT_REFRESH, ACCOUNT_REFRESH_EXPIRES),
+        serverOrigin: readSlot(ACCOUNT_SERVER_ORIGIN, service) || null,
+        owner: readSlot(ACCOUNT_OWNER, service) || null,
+    };
+}
+const BUNDLE_ACCOUNTS = [
+    ACCOUNT_TOKEN,
+    ACCOUNT_EXPIRES,
+    ACCOUNT_REFRESH,
+    ACCOUNT_REFRESH_EXPIRES,
+    ACCOUNT_SERVER_ORIGIN,
+    ACCOUNT_OWNER,
+];
+/**
+ * Copy every item of one slot to another BYTE FOR BYTE (the displacement
+ * rescue). Raw on purpose: the secret items may be sealed under the owning
+ * config's envelope key, and re-sealing them under ours would make the copy
+ * unreadable to the one config it exists for.
+ */
+function copyBundle(from, to) {
+    if (!isAvailable())
+        return false;
+    const source = serviceForSlot(from);
+    const target = serviceForSlot(to);
+    if (readSlot(ACCOUNT_TOKEN, source, true) === null)
+        return false;
+    for (const account of BUNDLE_ACCOUNTS) {
+        const value = readSlot(account, source, true);
+        if (value === null)
+            deleteSlot(account, target);
+        else if (!writeSlot(account, value, target, true))
+            return false;
+    }
+    return true;
+}
+/** Remove every CLI item under a slot this root does not own. The caller proves ownership. */
+function deleteAllAt(slot) {
+    if (!isAvailable())
+        return;
+    const service = serviceForSlot(slot);
+    for (const account of BUNDLE_ACCOUNTS)
+        deleteSlot(account, service);
+}
 function deleteToken() {
     if (!isAvailable())
         return;
@@ -423,6 +611,7 @@ function deleteAll() {
     deleteToken();
     deleteRefreshToken();
     deleteServerOrigin();
+    deleteOwner();
 }
 /**
  * Pull `--profile` out of raw argv.

package/dist/lib/label-ref.d.ts

@@ -102,3 +102,37 @@ export declare class LabelRefError extends Error {
  * label ends up attached to a year of work.
  */
 export declare function resolveLabelRefs(refs: string[] | undefined, context: LabelRefContext): Promise<string[]>;
+/**
+ * Help for a `--tag` flag that sits beside `--label` (OSK-12053).
+ *
+ * Tags and labels are two DIFFERENT vocabularies: a tag is any free string,
+ * stored as typed on `task.tags`; a label is declared (`skrr labels`) and is
+ * what `--label` filters, the board and the label guidance read. The flags used
+ * to be described as "Tag (repeatable)" and "Attach a task label", so a person
+ * wanting the `dogfood` label typed `--tag dogfood` on every task of a program
+ * and none of them was labelled.
+ */
+export declare const TAG_FLAG_HELP: string;
+export interface TagNamingLabel {
+    tag: string;
+    label: LabelRow;
+}
+/**
+ * The `--tag` values that equal a declared label's name, each paired with that
+ * label — the one case where the mistake is certain enough to say so.
+ *
+ * Best-effort by construction: it only ever feeds a WARNING, so a vocabulary
+ * that cannot be read yields no matches rather than an error, and the tags are
+ * stored as typed either way. Nothing is converted into a label implicitly —
+ * which one a person meant is theirs to say, and a warning that names the exact
+ * flag costs one retry.
+ */
+export declare function tagsNamingLabels(tags: string[] | undefined, context: LabelVocabularyContext): Promise<TagNamingLabel[]>;
+/** The stderr line for `tagsNamingLabels` hits; an empty string when there are none. */
+export declare function describeTagsNamingLabels(hits: TagNamingLabel[]): string;
+/**
+ * The whole `--tag` check a write command runs: the warning for tags that equal
+ * a declared label AND were not also attached through `--label` (passing both
+ * is someone doing it right). An empty string means say nothing.
+ */
+export declare function tagLabelWarning(tags: string[] | undefined, attachedLabelIds: string[] | undefined, context: LabelVocabularyContext): Promise<string>;