@skrr-ai/cli 0.1.51 → 0.1.53

package/dist/lib/agent-config.js

@@ -1,6 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.RELEASE_INSTALL_CHANNELS = exports.COMMITMENT_PERMISSION_FLAG_RETIRED = exports.REASONING_TOOL_ESCAPES = exports.COMMITMENT_RESPONSIBILITY_LEVELS = void 0;
+exports.RELEASE_INSTALL_CHANNELS = exports.RETIRED_COMMITMENT_PERMISSION_FLAGS = exports.COMMITMENT_PERMISSION_FLAG_RETIRED = exports.REASONING_TOOL_ESCAPES = exports.COMMITMENT_RESPONSIBILITY_LEVELS = void 0;
+exports.retiredCommitmentPermissionFlagMessage = retiredCommitmentPermissionFlagMessage;
+exports.deprecatedFieldsWarnings = deprecatedFieldsWarnings;
+exports.deprecatedFieldNames = deprecatedFieldNames;
 exports.parseWorkingHoursFlag = parseWorkingHoursFlag;
 exports.mergeAgentConfigFlags = mergeAgentConfigFlags;
 const prompt_1 = require("./prompt");
@@ -9,6 +12,41 @@ exports.COMMITMENT_RESPONSIBILITY_LEVELS = ['reasoning_only', 'full_ownership'];
 exports.REASONING_TOOL_ESCAPES = ['bash', 'browser'];
 /** Warning printed by the three retired Commitment permission flags (OSK-11975). */
 exports.COMMITMENT_PERMISSION_FLAG_RETIRED = "This setting no longer has any effect: Commitment runs use the agent's own permissions.";
+/** The three retired flags themselves: accepted at parse, warned on, never sent. */
+exports.RETIRED_COMMITMENT_PERMISSION_FLAGS = [
+    'reasoning-tool-escape',
+    'commitment-responsibility',
+    'commitment-responsibility-ceiling',
+];
+/**
+ * The deprecation warning ONE retired flag prints. oclif prints a
+ * `deprecated.message` verbatim, so a shared message printed the same line
+ * once per flag with nothing saying which flag each one was about (OSK-12068).
+ */
+function retiredCommitmentPermissionFlagMessage(flag) {
+    return `--${flag} is retired and was not sent. ${exports.COMMITMENT_PERMISSION_FLAG_RETIRED}`;
+}
+/**
+ * The fields the server ignored and why, from a write's `deprecatedFields`
+ * notice, one line each. Empty when the response carries none.
+ */
+function deprecatedFieldsWarnings(response) {
+    const entries = response?.deprecatedFields;
+    if (!Array.isArray(entries))
+        return [];
+    return entries
+        .filter((entry) => Boolean(entry) && typeof entry.field === 'string')
+        .map((entry) => `${entry.field}: ${entry.reason || 'ignored by the server'}`);
+}
+/** The payload keys the server reported as ignored, so they are not also called "not kept". */
+function deprecatedFieldNames(response) {
+    const entries = response?.deprecatedFields;
+    return Array.isArray(entries)
+        ? entries
+            .map((entry) => entry?.field)
+            .filter((field) => typeof field === 'string')
+        : [];
+}
 exports.RELEASE_INSTALL_CHANNELS = ['latest', 'manual'];
 /**
  * `09:00-18:00` or `09:00-18:00@America/Los_Angeles`, or a JSON object.
@@ -102,15 +140,13 @@ function mergeAgentConfigFlags(body, flags) {
     if (flags['todo-working-hours'] !== undefined) {
         parsed.todoWorkingHours = parseWorkingHoursFlag(String(flags['todo-working-hours']));
     }
-    if (flags['reasoning-tool-escape'] !== undefined) {
-        parsed.reasoningToolEscapes = flags['reasoning-tool-escape'];
-    }
-    if (flags['commitment-responsibility'] !== undefined) {
-        parsed.commitmentResponsibilityDefault = flags['commitment-responsibility'];
-    }
-    if (flags['commitment-responsibility-ceiling'] !== undefined) {
-        parsed.commitmentResponsibilityCeiling = flags['commitment-responsibility-ceiling'];
-    }
+    // `--reasoning-tool-escape`, `--commitment-responsibility` and
+    // `--commitment-responsibility-ceiling` are retired (OSK-11975) and are
+    // deliberately NOT forwarded. The server still accepts and echoes the stored
+    // fields, so sending them wrote a value nothing reads and handed it back as
+    // if it were live — and "a ceiling a commitment may not exceed" is a safety
+    // claim a person then believes (OSK-12068). The flags stay parseable so old
+    // scripts do not break; oclif prints COMMITMENT_PERMISSION_FLAG_RETIRED.
     if (flags['tool-resources'] !== undefined) {
         parsed.tool_resources = JSON.parse(String(flags['tool-resources']));
     }

package/dist/lib/agentic-stream.d.ts

@@ -299,7 +299,7 @@ export type SeqGap = {
  * `service` envelopes that carry a `notice` — words for the person, not
  * diagnostics — projected as `session.notice` events. Today the only notice is
  * `harness-session-reset`: the local harness could not resume its previous
- * session and began a new one, so its local working context is gone.
+ * session and began a new one, which does not see earlier turns (OSK-12155).
  */
 export declare function projectSessionNotices(envelopes: unknown[]): AgenticStreamEvent[];
 export declare function detectSeqGap(highestApplied: number, incoming: number): SeqGap | null;
@@ -346,6 +346,11 @@ export declare class AgenticStreamClient {
      * repeat count varies run to run and cannot be inferred by a consumer.
      */
     private readonly seenLifecycle;
+    /**
+     * Whether this client's transport has dropped since it first connected. Until
+     * it has, every `session:join` it sends declares a FIRST join (OSK-12124).
+     */
+    private transportDropped;
     /** `call` → tool name, so a daemon `tool-call-end` can be named (OSK-7730). */
     private readonly toolNamesByCall;
     /** `permission-ask` requestId → tool name, to name its resolution (OSK-12113). */
@@ -373,6 +378,21 @@ export declare class AgenticStreamClient {
     settledResult(): AgenticStreamResult | null;
     constructor(options: AgenticStreamOptions);
     run(): Promise<AgenticStreamResult>;
+    /**
+     * The `session:join` payload.
+     *
+     * This client learns its session id from the HTTP acceptance and only then
+     * connects, while a daemon turn publishes its `session:init` at once. The
+     * server drops buffered frames older than the socket's connect time — right
+     * for a RE-connect, which already rendered them, and wrong here, where they
+     * were never seen: `run.started` (the dispatched mode and its source) never
+     * reached a daemon turn's stream (OSK-12124). `firstJoin` says so, and the
+     * server then replays the pre-connect lifecycle frames. Both joins of the
+     * first connection carry it, because the server's replay drains the shared
+     * buffer and either join may be the one that reaches it first; the stream's
+     * own lifecycle dedupe absorbs the overlap. After a drop it is not sent.
+     */
+    private sessionJoinPayload;
     /**
      * (Re)start the silence watchdog that asks the durable record what happened.
      *

package/dist/lib/agentic-stream.js

@@ -280,9 +280,14 @@ function describePermissionDecider(ev) {
                 ? `the ${mode} permission mode (nobody was asked)`
                 : "the session's permission mode (nobody was asked)";
         case 'policy':
-            return ev.by === 'server'
-                ? 'the unattended-run policy (nobody could be asked)'
-                : 'a runtime policy (nobody was asked)';
+            if (ev.by === 'server')
+                return 'the unattended-run policy (nobody could be asked)';
+            // A client that denied on its own because it could not ask anyone — the
+            // skrr CLI without --approve-tools, say (OSK-12113).
+            if (typeof ev.surface === 'string' && SURFACE_LABELS[ev.surface]) {
+                return `${SURFACE_LABELS[ev.surface]}, which had nobody to ask (nobody was asked)`;
+            }
+            return 'a runtime policy (nobody was asked)';
         case 'session-grant':
             return 'an earlier "allow for this session"';
         case 'person': {
@@ -421,7 +426,7 @@ function jitteredRetryDelay(retryAfterMs, random = Math.random) {
  * `service` envelopes that carry a `notice` — words for the person, not
  * diagnostics — projected as `session.notice` events. Today the only notice is
  * `harness-session-reset`: the local harness could not resume its previous
- * session and began a new one, so its local working context is gone.
+ * session and began a new one, which does not see earlier turns (OSK-12155).
  */
 function projectSessionNotices(envelopes) {
     const out = [];
@@ -520,6 +525,11 @@ class AgenticStreamClient {
      * repeat count varies run to run and cannot be inferred by a consumer.
      */
     seenLifecycle = new Set();
+    /**
+     * Whether this client's transport has dropped since it first connected. Until
+     * it has, every `session:join` it sends declares a FIRST join (OSK-12124).
+     */
+    transportDropped = false;
     /** `call` → tool name, so a daemon `tool-call-end` can be named (OSK-7730). */
     toolNamesByCall = new Map();
     /** `permission-ask` requestId → tool name, to name its resolution (OSK-12113). */
@@ -581,11 +591,30 @@ class AgenticStreamClient {
         // the result instead of awaiting an attach nobody is still attempting.
         if (this.settled || this.closed || !this.socket)
             return result;
-        this.socket.emit('session:join', { sessionId: this.options.sessionId });
+        this.socket.emit('session:join', this.sessionJoinPayload());
         this.emit({ type: 'session.joined', sessionId: this.options.sessionId });
         this.armIdleProbe();
         return result;
     }
+    /**
+     * The `session:join` payload.
+     *
+     * This client learns its session id from the HTTP acceptance and only then
+     * connects, while a daemon turn publishes its `session:init` at once. The
+     * server drops buffered frames older than the socket's connect time — right
+     * for a RE-connect, which already rendered them, and wrong here, where they
+     * were never seen: `run.started` (the dispatched mode and its source) never
+     * reached a daemon turn's stream (OSK-12124). `firstJoin` says so, and the
+     * server then replays the pre-connect lifecycle frames. Both joins of the
+     * first connection carry it, because the server's replay drains the shared
+     * buffer and either join may be the one that reaches it first; the stream's
+     * own lifecycle dedupe absorbs the overlap. After a drop it is not sent.
+     */
+    sessionJoinPayload() {
+        return this.transportDropped
+            ? { sessionId: this.options.sessionId }
+            : { sessionId: this.options.sessionId, firstJoin: true };
+    }
     /**
      * (Re)start the silence watchdog that asks the durable record what happened.
      *
@@ -726,10 +755,11 @@ class AgenticStreamClient {
         const socket = this.socket;
         const match = (event) => !event.sessionId || event.sessionId === this.options.sessionId;
         socket.on('connect', () => {
-            socket.emit('session:join', { sessionId: this.options.sessionId });
+            socket.emit('session:join', this.sessionJoinPayload());
             this.emit({ type: 'transport.connected', sessionId: this.options.sessionId });
         });
         socket.on('disconnect', (reason) => {
+            this.transportDropped = true;
             if (this.settled)
                 return;
             this.emit({ type: 'transport.disconnected', sessionId: this.options.sessionId, reason });
@@ -913,6 +943,10 @@ class AgenticStreamClient {
                     toolUseId: event.toolUseId,
                     toolName: event.toolName,
                     reason: 'CLI was not started with --approve-tools',
+                    // Nobody was asked: this client could not put the prompt to anyone.
+                    // The server records it as a policy decision, not a person's
+                    // (OSK-12113) — it used to read "a person on the skrr CLI".
+                    automatic: true,
                 });
             }
             this.emit({ ...event, type: 'permission.denied', reason: 'noninteractive_or_not_enabled' });

package/dist/lib/auth-failure.js

@@ -33,7 +33,10 @@ function describeRefreshRefusal(refusal, opts) {
     // configuration on this machine (a different HOME or config dir sharing the
     // same login Keychain) can write this profile's credential under its own ID.
     // Observed: a token minted for `cli_devin_dogfood` sitting in the default
-    // profile's slot.
+    // profile's slot. Since OSK-12135 the slot is namespaced by config root and a
+    // read refuses a bundle bound to another cliId before presenting it, so this
+    // is now reached only when the server's binding disagrees with a token that
+    // carries no readable `did`.
     if (/bound to a different daemon/i.test(message)) {
         return {
             code,

package/dist/lib/auth-storage.d.ts

@@ -6,14 +6,33 @@ export interface AuthBundle {
     refreshExpiresAt?: number;
     /** Normalized API origin that issued this access/refresh pair. */
     serverOrigin?: string;
+    /**
+     * The config that wrote this bundle, as stored. Filled on write from the
+     * current config; callers never need to set it.
+     */
+    owner?: CredentialOwner;
+}
+/** Which skrr config a credential belongs to. */
+export interface CredentialOwner {
+    /** Resolved config root (`~/.skrr`, or the `SKRR_CONFIG_DIR` override). */
+    configRoot?: string;
+    /** The CLI identity the server bound the refresh family to. */
+    cliId?: string;
 }
 export type CredentialOriginStatus = 'none' | 'unchecked' | 'matched' | 'unbound' | 'mismatch';
+/** `foreign`: the stored bundle belongs to another skrr config and was not used. */
+export type CredentialOwnerStatus = 'foreign';
 export interface ReadResult {
     bundle: AuthBundle | null;
     backend: AuthBackend;
     originStatus?: CredentialOriginStatus;
     storedServerOrigin?: string;
     expectedServerOrigin?: string;
+    ownerStatus?: CredentialOwnerStatus;
+    /** For `foreign`: who the stored bundle belongs to. */
+    storedOwner?: CredentialOwner;
+    /** For `foreign`: who this process is. */
+    expectedOwner?: CredentialOwner;
 }
 export interface WriteOptions {
     /** Bind/overwrite the bundle's issuing origin. Invalid origins are rejected. */
@@ -47,6 +66,11 @@ export declare function deleteFileBackend(): void;
  * function returns whatever is persisted.
  */
 export declare function readFromBackend(expectedServerOrigin?: string): ReadResult;
+/**
+ * One sentence naming whose credential was refused and why, for the surfaces
+ * that explain an absent sign-in (BaseCommand, `skrr doctor`).
+ */
+export declare function describeForeignCredential(result: ReadResult): string | null;
 export declare function writeToBackend(bundle: AuthBundle, options?: WriteOptions): AuthBackend;
 /**
  * Clear both backends. Called on `skrr logout` (and internally during