@skrr-ai/cli 0.1.51 → 0.1.52

package/dist/lib/label-ref.js

@@ -33,11 +33,14 @@
  * their path.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LabelRefError = void 0;
+exports.TAG_FLAG_HELP = exports.LabelRefError = void 0;
 exports.looksLikeLabelId = looksLikeLabelId;
 exports.closestNames = closestNames;
 exports.collectLabelVocabulary = collectLabelVocabulary;
 exports.resolveLabelRefs = resolveLabelRefs;
+exports.tagsNamingLabels = tagsNamingLabels;
+exports.describeTagsNamingLabels = describeTagsNamingLabels;
+exports.tagLabelWarning = tagLabelWarning;
 const data_provider_1 = require("@skrr-ai/data-provider");
 const workspaces_1 = require("./workspaces");
 /** A canonical v4 uuid, which is what every label id is. */
@@ -171,3 +174,67 @@ async function resolveLabelRefs(refs, context) {
     }
     return resolved;
 }
+/**
+ * Help for a `--tag` flag that sits beside `--label` (OSK-12053).
+ *
+ * Tags and labels are two DIFFERENT vocabularies: a tag is any free string,
+ * stored as typed on `task.tags`; a label is declared (`skrr labels`) and is
+ * what `--label` filters, the board and the label guidance read. The flags used
+ * to be described as "Tag (repeatable)" and "Attach a task label", so a person
+ * wanting the `dogfood` label typed `--tag dogfood` on every task of a program
+ * and none of them was labelled.
+ */
+exports.TAG_FLAG_HELP = 'Free-form tag (repeatable), stored exactly as typed and never checked against anything. ' +
+    'NOT a label: to classify the task under a declared label (`labels list`), use --label.';
+/**
+ * The `--tag` values that equal a declared label's name, each paired with that
+ * label — the one case where the mistake is certain enough to say so.
+ *
+ * Best-effort by construction: it only ever feeds a WARNING, so a vocabulary
+ * that cannot be read yields no matches rather than an error, and the tags are
+ * stored as typed either way. Nothing is converted into a label implicitly —
+ * which one a person meant is theirs to say, and a warning that names the exact
+ * flag costs one retry.
+ */
+async function tagsNamingLabels(tags, context) {
+    const input = (tags ?? []).map((tag) => tag.trim()).filter(Boolean);
+    if (input.length === 0)
+        return [];
+    let vocabulary;
+    try {
+        vocabulary = await collectLabelVocabulary(context);
+    }
+    catch {
+        return [];
+    }
+    const hits = [];
+    for (const tag of input) {
+        const needle = tag.toLowerCase();
+        const label = vocabulary.find((row) => (row.name ?? '').toLowerCase() === needle);
+        if (label)
+            hits.push({ tag, label });
+    }
+    return hits;
+}
+/** The stderr line for `tagsNamingLabels` hits; an empty string when there are none. */
+function describeTagsNamingLabels(hits) {
+    if (hits.length === 0)
+        return '';
+    const names = hits.map((hit) => `"${hit.tag}"`).join(', ');
+    const flags = hits.map((hit) => `--label ${hit.label.name}`).join(' ');
+    return (`--tag ${names} ${hits.length === 1 ? 'was' : 'were'} stored as free-form ` +
+        `${hits.length === 1 ? 'tag' : 'tags'}, NOT as the declared label of the same name, ` +
+        `so a label filter will not find this task. To attach the label, pass ${flags}.`);
+}
+/**
+ * The whole `--tag` check a write command runs: the warning for tags that equal
+ * a declared label AND were not also attached through `--label` (passing both
+ * is someone doing it right). An empty string means say nothing.
+ */
+async function tagLabelWarning(tags, attachedLabelIds, context) {
+    if (!tags || tags.length === 0)
+        return '';
+    const attached = new Set(attachedLabelIds ?? []);
+    const hits = await tagsNamingLabels(tags, context);
+    return describeTagsNamingLabels(hits.filter((hit) => !attached.has(hit.label.id)));
+}

package/dist/lib/login.js

@@ -31,12 +31,13 @@ const node_child_process_1 = require("node:child_process");
 const auth_core_1 = require("@skrr-ai/auth-core");
 const auth_storage_1 = require("./auth-storage");
 const config_1 = require("./config");
-const device_id_1 = require("./device-id");
+const cli_identity_1 = require("./cli-identity");
 const ssh_detect_1 = require("./ssh-detect");
 const device_code_1 = require("./device-code");
 const device_identity_1 = require("./device-identity");
 const oauthLogin_1 = require("./oauthLogin");
 const daemonBroker_1 = require("./daemonBroker");
+const daemonBrokerRefusal_1 = require("./daemonBrokerRefusal");
 /**
  * What a shell with no terminal can do instead (OSK-12117). The refusal used to
  * name only CI tokens, which is not a sign-in: an agent session asking for one
@@ -73,16 +74,16 @@ async function cliLogin(opts = {}) {
     const serverUrl = (opts.serverUrl ?? cfg.baseURL).replace(/\/+$/, '');
     const scope = opts.scope ?? 'cli';
     // Persist the cliId on first login so future refreshes present a
-    // stable device identity. Same invariant as the device-code-only
-    // path this supersedes.
-    const cliId = cfg.cliId ?? (0, device_id_1.generateCliId)();
-    if (!cfg.cliId) {
-        (0, config_1.saveConfig)({ ...cfg, cliId });
-    }
+    // stable device identity. A named profile signing in with no credential is
+    // issued its OWN id here, so the hand-off confirm below cannot retire another
+    // profile's session (OSK-12156); see `cli-identity.ts`.
+    const cliId = (0, cli_identity_1.cliIdForLogin)(cfg);
     const envForce = isTruthy(process.env.OVERSKY_FORCE_DEVICE_CODE);
     const ssh = (0, ssh_detect_1.detectSshSession)();
     /** Set when the broker was refused for a reason that WAITING fixes. */
     let brokerRateLimited = false;
+    /** Set when a live daemon answered the hand-off and refused it (OSK-12149). */
+    let brokerRefusal = null;
     // --- Daemon-as-broker pre-flight ---------------------------------------
     // When the local `oversky` daemon is already authenticated for this user
     // on this machine, the cleanest UX is no second browser flow at all:
@@ -129,7 +130,8 @@ async function cliLogin(opts = {}) {
                 };
             }
             console.log('');
-            console.log('  Authorized via the skrr background service on this computer (no browser needed).');
+            console.log('  Authorized via the skrr background service on this computer (no browser needed). ' +
+                'Stored a durable session for this profile.');
             return {
                 token: brokerResult.accessToken,
                 refreshToken: brokerResult.refreshToken,
@@ -179,6 +181,15 @@ async function cliLogin(opts = {}) {
             console.log('');
             console.log(describeBrokerBaseUrlMismatch(brokerResult, serverUrl));
         }
+        // The daemon answered and refused. Say so before whatever comes next —
+        // a browser that opens with no stated cause, or a refusal about terminals
+        // that says nothing about the daemon, both hid the real reason.
+        brokerRefusal = (0, daemonBrokerRefusal_1.describeBrokerRefusal)(brokerResult);
+        if (brokerRefusal && !(0, ssh_detect_1.isNonInteractive)()) {
+            console.log('');
+            console.log(`  Asked the local skrr service for a session first. ${brokerRefusal.headline}`);
+            console.log('  Continuing with a sign-in of this CLI’s own.');
+        }
     }
     // --- Decision tree (first match wins) ---
     //
@@ -199,7 +210,10 @@ async function cliLogin(opts = {}) {
             ? 'The skrr background service on this computer is being rate-limited while brokering logins, and this ' +
                 'shell cannot run the browser flow instead. The limit is per 15-minute window — ' +
                 `retry shortly, or sign in now with ${exports.HEADLESS_LOGIN_HINT}`
-            : `skrr login opens a browser, and this shell has no terminal to run it from. ${exports.HEADLESS_LOGIN_HINT}`);
+            : brokerRefusal
+                ? `${brokerRefusal.headline} ${brokerRefusal.remedy}\n` +
+                    `skrr login would otherwise open a browser, and this shell has no terminal to run it from. ${exports.HEADLESS_LOGIN_HINT}`
+                : `skrr login opens a browser, and this shell has no terminal to run it from. ${exports.HEADLESS_LOGIN_HINT}`);
     }
     if (ssh.detected) {
         // Device-code's "open this URL on your laptop" UX is the correct
@@ -282,9 +296,7 @@ async function cliLoginWithRefreshToken(opts) {
     // the operator retries. The refresh exchange itself is idempotent on
     // the server side (rotation is the unit of retry); writing the cliId
     // up-front never causes a server-state mismatch.
-    if (cfg.cliId !== opts.cliId) {
-        (0, config_1.saveConfig)({ ...cfg, cliId: opts.cliId });
-    }
+    (0, cli_identity_1.persistPresentedCliId)(cfg, opts.cliId);
     let pair;
     try {
         pair = await (0, auth_core_1.refreshDaemonToken)(serverUrl, opts.refreshToken, opts.cliId, {

package/dist/lib/oauthLogin.js

@@ -44,7 +44,7 @@ const node_http_1 = __importDefault(require("node:http"));
 const node_child_process_1 = require("node:child_process");
 const auth_storage_1 = require("./auth-storage");
 const config_1 = require("./config");
-const device_id_1 = require("./device-id");
+const cli_identity_1 = require("./cli-identity");
 const publicEndpoints_generated_1 = require("./publicEndpoints.generated");
 // ---------------------------------------------------------------------------
 // PKCE helpers
@@ -272,13 +272,7 @@ async function runOAuthLogin(opts) {
         });
     // Resolve cliId — explicit override wins; otherwise persist on disk
     // so subsequent refreshes present the same device identity.
-    let cliId = opts?.cliId;
-    if (!cliId) {
-        cliId = cfg.cliId ?? (0, device_id_1.generateCliId)();
-        if (!cfg.cliId) {
-            (0, config_1.saveConfig)({ ...cfg, cliId });
-        }
-    }
+    const cliId = opts?.cliId ?? (0, cli_identity_1.cliIdForLogin)(cfg);
     const { codeVerifier, codeChallenge } = generatePkce();
     const state = generateState();
     return new Promise((resolve) => {

package/dist/lib/refresh.js

@@ -27,6 +27,7 @@ Object.defineProperty(exports, "PermanentAuthFailure", { enumerable: true, get:
 Object.defineProperty(exports, "TransientAuthFailure", { enumerable: true, get: function () { return auth_core_1.TransientAuthFailure; } });
 const auth_storage_1 = require("./auth-storage");
 const config_1 = require("./config");
+const cli_id_1 = require("./cli-id");
 const credential_resolver_1 = require("./credential-resolver");
 const device_identity_1 = require("./device-identity");
 exports.CLI_REFRESH_EARLY_MS = 5 * 60 * 1000;
@@ -182,7 +183,10 @@ async function ensureFreshCliCredential(opts = {}) {
  */
 async function refreshCliToken() {
     const cfg = (0, config_1.loadConfig)();
-    if (!cfg.cliId) {
+    // The id the stored credential was minted under — the machine id, or this
+    // profile's own (OSK-12156). One resolver, so refresh cannot disagree with login.
+    const cliId = (0, cli_id_1.resolveCliId)(cfg);
+    if (!cliId) {
         throw new CliRefreshUnavailableError('No CLI identity persisted (cliId). Run `skrr login` to initialize.');
     }
     const origin = getCliOrigin();
@@ -195,7 +199,7 @@ async function refreshCliToken() {
         if (!bundle?.refreshToken) {
             throw new CliRefreshUnavailableError('No refresh token available — sign in with `skrr login`.');
         }
-        const pair = await (0, auth_core_1.refreshDaemonToken)(serverUrl, bundle.refreshToken, cfg.cliId, 
+        const pair = await (0, auth_core_1.refreshDaemonToken)(serverUrl, bundle.refreshToken, cliId, 
         // L11 Phase 3 — attach a device-identity proof to every refresh.
         // The signer returns null when device identity isn't initialized
         // (Phase 1 binary, KEK rotation hot path), and the server's lenient

package/dist/lib/tasks.js

@@ -587,14 +587,24 @@ async function resolveTaskCreateScope(payload, opts = {}) {
             payload.spaceId = parentSpaceId;
     }
     const projectId = stringValue(payload.projectId);
-    if (projectId && !stringValue(payload.spaceId)) {
+    // A Mongo `_id` is resolved even beside --space: the server addresses a
+    // project by its `id` or its ref only, so passing the `_id` through would
+    // fail there with less to say about it (OSK-12054).
+    if (projectId && (!stringValue(payload.spaceId) || looksLikeStorageId(projectId))) {
         const project = await getCachedProject(projectId, opts.projectCache);
         resolution.project = project;
-        const projectSpaceId = stringValue(project.spaceId);
-        if (!projectSpaceId) {
-            throw new Error(`Project ${projectId} did not return an owning space`);
+        // Accepting a second spelling obliges returning the canonical one: the
+        // write carries `id`, never whatever the caller happened to paste.
+        const canonicalId = stringValue(project.id);
+        if (canonicalId && canonicalId !== projectId)
+            payload.projectId = canonicalId;
+        if (!stringValue(payload.spaceId)) {
+            const projectSpaceId = stringValue(project.spaceId);
+            if (!projectSpaceId) {
+                throw new Error(`Project ${projectId} did not return an owning space`);
+            }
+            payload.spaceId = projectSpaceId;
         }
-        payload.spaceId = projectSpaceId;
     }
     return resolution;
 }
@@ -894,21 +904,36 @@ async function getCachedTask(taskIdValue, cache) {
     }
     return cache.get(taskIdValue);
 }
+/** A 24-hex Mongo ObjectId — the storage `_id` entity JSON prints beside `id`. */
+const STORAGE_ID_RE = /^[0-9a-f]{24}$/i;
+function looksLikeStorageId(value) {
+    return STORAGE_ID_RE.test(value);
+}
+/**
+ * Entity JSON prints both `id` (canonical) and `_id` (storage) with nothing
+ * saying which one commands take, so a pasted `_id` is accepted as the same
+ * project rather than refused as unknown (OSK-12054). The caller then writes
+ * the canonical `id` — see `resolveTaskCreateScope`.
+ */
+function projectMatchesId(project, ref) {
+    return String(project.id ?? '') === ref || String(project._id ?? '') === ref;
+}
 async function getCachedProject(projectId, cache) {
     const load = async () => {
         const filtered = await projects_1.projectApi.search({ q: projectId, limit: 20 });
-        let exact = (0, projects_1.projectsFrom)(filtered).filter((project) => String(project.id ?? project._id ?? '') === projectId);
+        let exact = (0, projects_1.projectsFrom)(filtered).filter((project) => projectMatchesId(project, projectId));
         // The cross-space endpoint's `q` contract covers title/description/ref,
         // not UUID. Fall back to the bounded visible project catalog so canonical
         // IDs still resolve without inventing a second project read endpoint.
         if (exact.length === 0) {
             const catalog = await projects_1.projectApi.search({ limit: 200 });
-            exact = (0, projects_1.projectsFrom)(catalog).filter((project) => String(project.id ?? project._id ?? '') === projectId);
+            exact = (0, projects_1.projectsFrom)(catalog).filter((project) => projectMatchesId(project, projectId));
         }
         if (exact.length !== 1) {
             throw new Error(exact.length > 1
                 ? `Project id ${projectId} matched multiple projects`
-                : `Project id ${projectId} was not found; pass a canonical project id or add --space`);
+                : `Project ${projectId} was not found among the projects you can see. Pass the ` +
+                    "project's `id` (the uuid `projects list` prints), or its ref (OSK-P-5) together with --space");
         }
         return exact[0];
     };