@skrr-ai/cli 0.1.51 → 0.1.53

package/dist/lib/daemonBrokerRefusal.js

@@ -0,0 +1,127 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isAnsweredBrokerRefusal = isAnsweredBrokerRefusal;
+exports.describeBrokerRefusal = describeBrokerRefusal;
+/**
+ * True when a daemon ANSWERED the hand-off and refused it — as opposed to no
+ * daemon being there to ask (`no_bootstrap`, a stale descriptor nobody listens
+ * behind). This is the case the CLI must explain rather than reduce to "Not
+ * signed in": the person has a daemon, it said something specific, and that
+ * decides whether `skrr login` would even help.
+ */
+function isAnsweredBrokerRefusal(outcome) {
+    switch (outcome.reason) {
+        case 'no_bootstrap':
+        case 'bootstrap_parse':
+        case 'network':
+            return false;
+        case 'stale_bootstrap':
+            // A bare 401 is the daemon refusing a descriptor secret that rotated;
+            // re-reading the file next time heals it. A coded one is a real answer.
+            return Boolean(outcome.code);
+        default:
+            return true;
+    }
+}
+/** Codes whose repair is signing the DAEMON in again (laptop only). */
+const DAEMON_RELOGIN_CODES = new Set([
+    'DEVICE_PROOF_PIN_MISMATCH',
+    'SESSION_REVOKED',
+    'PRINCIPAL_UNRESOLVED',
+    'DAEMON_NOT_AUTHED',
+]);
+/** Codes whose repair is time. */
+const TRANSIENT_CODES = new Set([
+    'DEVICE_PROOF_VERIFY_UNAVAILABLE',
+    'SERVICE_UNAVAILABLE',
+    'HANDOFF_RATE_LIMITED',
+    'RATE_LIMITED',
+    'UPSTREAM_UNREACHABLE',
+]);
+function statusAndCode(f) {
+    const parts = [typeof f.status === 'number' ? `HTTP ${f.status}` : '', f.code ?? ''].filter(Boolean);
+    return parts.length > 0 ? ` (${parts.join(' ')})` : '';
+}
+function sentence(detail) {
+    const d = (detail ?? '').trim();
+    if (!d)
+        return '';
+    return /[.!?]$/.test(d) ? ` ${d}` : ` ${d}.`;
+}
+/**
+ * Describe a broker failure for a person, or null when there is nothing to
+ * say: no daemon was there to ask, or the failure already has its own message
+ * (`base_url_mismatch`, `rate_limited`).
+ */
+function describeBrokerRefusal(failure, bin = 'skrr') {
+    if (!isAnsweredBrokerRefusal(failure))
+        return null;
+    if (failure.reason === 'base_url_mismatch' || failure.reason === 'rate_limited')
+        return null;
+    const dedicatedGuest = failure.dedicatedGuest === true;
+    const code = failure.code ?? '';
+    const who = dedicatedGuest
+        ? `This Dedicated Runtime's skrr service${failure.daemonId ? ` (daemon ${failure.daemonId})` : ''}`
+        : 'The skrr background service on this computer';
+    const refusal = failure.reason === 'timeout'
+        ? `${who} did not answer the sign-in hand-off in time.`
+        : failure.refusedBy === 'server' || failure.reason === 'upstream_refused'
+            ? `${who} asked the skrr server for a credential for this CLI, and the server refused${statusAndCode(failure)}.${sentence(failure.detail)}`
+            : `${who} could not hand this CLI a credential${statusAndCode(failure)}.${sentence(failure.detail)}`;
+    const transient = failure.reason === 'timeout' ||
+        TRANSIENT_CODES.has(code) ||
+        (failure.reason === 'server_error' && !DAEMON_RELOGIN_CODES.has(code));
+    let remedy;
+    if (dedicatedGuest) {
+        // Nobody signs in on a guest: the daemon's credential comes from the
+        // machine's attested bootstrap, and a tenant `skrr login` would only put a
+        // personal credential on a shared machine. Name the machine instead.
+        remedy = transient
+            ? 'This is usually temporary; retry in a minute. Nobody signs in on a Dedicated Runtime — ' +
+                `if it persists, check the machine from your own computer with \`${bin} machines dedicated health-check <lease-id>\` ` +
+                `(\`${bin} machines dedicated list\` shows the lease id).`
+            : 'Nobody signs in on a Dedicated Runtime: its daemon holds the account. From your own computer, run ' +
+                `\`${bin} machines dedicated health-check <lease-id>\` (\`${bin} machines dedicated list\` shows the lease id), ` +
+                `and \`${bin} machines dedicated restart <lease-id>\` if the hand-off stays refused.`;
+    }
+    else if (code === 'DEVICE_PROOF_PIN_MISMATCH') {
+        remedy =
+            `Run \`${bin} daemon login\` to sign the background service in again — an interactive daemon login re-pins its device key — then retry. ` +
+                `\`${bin} login\` signs this CLI in on its own instead.`;
+    }
+    else if (DAEMON_RELOGIN_CODES.has(code) || failure.reason === 'daemon_not_authed') {
+        remedy =
+            `Run \`${bin} daemon login\` to sign the background service in again, then retry. ` +
+                `\`${bin} login\` signs this CLI in on its own instead.`;
+    }
+    else if (failure.reason === 'ci_token_refused') {
+        remedy =
+            `The background service is signed in with a CI token, which cannot sign a person in. Use \`${bin} login\`, ` +
+                `or \`${bin} create-token\` for a CI credential.`;
+    }
+    else if (transient) {
+        remedy =
+            `This is usually temporary; retry in a minute. \`${bin} daemon status\` and \`${bin} daemon logs\` show the service's side, ` +
+                `and \`${bin} login\` signs this CLI in without it.`;
+    }
+    else {
+        remedy =
+            `\`${bin} daemon status\` and \`${bin} daemon logs\` show the service's side. ` +
+                `\`${bin} login\` signs this CLI in without it.`;
+    }
+    return {
+        headline: refusal,
+        remedy,
+        transient,
+        dedicatedGuest,
+        broker: {
+            reason: failure.reason,
+            ...(failure.refusedBy ? { refusedBy: failure.refusedBy } : {}),
+            ...(typeof failure.status === 'number' ? { status: failure.status } : {}),
+            ...(failure.code ? { code: failure.code } : {}),
+            ...(failure.detail ? { detail: failure.detail } : {}),
+            ...(failure.descriptorPath ? { descriptorPath: failure.descriptorPath } : {}),
+            ...(failure.daemonId ? { daemonId: failure.daemonId } : {}),
+        },
+    };
+}

package/dist/lib/dedicated-machines.d.ts

@@ -111,8 +111,22 @@ export declare function describeDedicatedCheckpoint(lease: DedicatedLease | unde
  * machine to the previous image. Files under the workspace survive both.
  */
 export interface DedicatedImageStanding {
-    /** A newer image exists that has not already failed on this machine. */
+    /**
+     * A newer APPROVED image exists that has not already failed on this machine.
+     * False is not "running the latest daemon": a release no approved image
+     * carries yet is not an update this machine can move to (OSK-12153).
+     */
     updateAvailable?: boolean;
+    /**
+     * The daemon the approved image carries, when the server can say: this
+     * machine runs that image and its daemon reported a version. Null otherwise.
+     */
+    approvedImageDaemonVersion?: string | null;
+    /**
+     * Why `approvedImageDaemonVersion` is null, from a closed server vocabulary.
+     * Absent from a server older than this field.
+     */
+    approvedImageDaemonUnknownReason?: 'image_superseded' | 'approval_unreadable' | 'daemon_unreported' | null;
     /** When the older image stops being supported; null when there is no deadline. */
     updateBy?: string | null;
     lastUpdate?: {
@@ -121,8 +135,41 @@ export interface DedicatedImageStanding {
         settledAt?: string | null;
     } | null;
 }
-/** One line saying where a machine's image stands and what the owner can do. */
-export declare function describeDedicatedImageStanding(image: DedicatedImageStanding, leaseId?: string): string;
+/**
+ * The latest daemon release, as `show` read it from the signed release feed:
+ * a version, or why it could not be read. Never inferred from the machine.
+ */
+export type LatestDaemonRelease = {
+    version: string;
+} | {
+    error: string;
+};
+/** -1 / 0 / 1, or null when either side is not a version. */
+export declare function compareDaemonVersions(a: string, b: string): number | null;
+/**
+ * Which daemon the approved image carries against the latest daemon release
+ * (OSK-12153). `image update: current` used to be the whole answer, while the
+ * daemon on the same machine said a newer release existed: "current" means no
+ * newer APPROVED image, and a release that no approved image carries yet is not
+ * something this machine can move to. Both halves are said, and an unknown
+ * half is said to be unknown rather than left out.
+ */
+export declare function describeDedicatedDaemonRelease(image: DedicatedImageStanding, latest: LatestDaemonRelease | null | undefined): string | null;
+/**
+ * One line saying where a machine's image stands and what the owner can do.
+ *
+ * "current" is claimed only when it is KNOWN: no newer approved image AND this
+ * machine's own daemon is at the latest release (OSK-12153). A guest never
+ * updates its own daemon, so "no newer approved image" beside a daemon that is
+ * behind the latest release is a different — and worse — state than "current",
+ * and the line says so instead of collapsing toward the reassuring reading.
+ * With the release feed unread, or no daemon version, it says only what is
+ * known: there is no newer approved image.
+ */
+export declare function describeDedicatedImageStanding(image: DedicatedImageStanding, leaseId?: string, opts?: {
+    daemonVersion?: string | null;
+    latestDaemonRelease?: LatestDaemonRelease | null;
+}): string;
 /**
  * A deleted workspace: restorable into a new machine until `recoverableUntil`,
  * then every copy is deleted and `completedAt` records it. `withheld`: an unpaid
@@ -527,7 +574,9 @@ export declare function dedicatedSpendSummary(lease: DedicatedLease): string;
  */
 /** One line saying what a deletion still allows. */
 export declare function describeDedicatedDeletion(deletion: DedicatedLeaseDeletion, leaseId?: string): string;
-export declare function describeDedicatedLease(lease: DedicatedLease, harnesses?: readonly Harness[]): string[];
+export declare function describeDedicatedLease(lease: DedicatedLease, harnesses?: readonly Harness[], opts?: {
+    latestDaemonRelease?: LatestDaemonRelease | null;
+}): string[];
 /** "2026-09-30 14:00 UTC (in 17 days)" — a deadline readable without converting it. */
 export declare function formatDedicatedDeadline(value: string | null | undefined, now?: Date): string;
 /**

package/dist/lib/dedicated-machines.js

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEDICATED_FILE_MAX_BYTES = exports.DEDICATED_FILE_CHUNK_BYTES = exports.DEDICATED_EXEC_DEFAULT_TIMEOUT_MS = exports.DEDICATED_EXEC_MAX_TIMEOUT_MS = exports.DEDICATED_MACHINE_PRODUCT = exports.DEDICATED_LEASE_ACTIONS = void 0;
 exports.describeDedicatedCheckpoint = describeDedicatedCheckpoint;
+exports.compareDaemonVersions = compareDaemonVersions;
+exports.describeDedicatedDaemonRelease = describeDedicatedDaemonRelease;
 exports.describeDedicatedImageStanding = describeDedicatedImageStanding;
 exports.dedicatedRuntimeCreateInput = dedicatedRuntimeCreateInput;
 exports.isDedicatedRepositoryRef = isDedicatedRepositoryRef;
@@ -73,8 +75,81 @@ function describeDedicatedCheckpoint(lease) {
         return null;
     return (0, data_provider_1.describeMachineCheckpointOutcome)(operation.checkpoint, { action: operation.action });
 }
-/** One line saying where a machine's image stands and what the owner can do. */
-function describeDedicatedImageStanding(image, leaseId) {
+function versionParts(version) {
+    const match = /^v?(\d+)\.(\d+)\.(\d+)/.exec(String(version || '').trim());
+    return match ? match.slice(1, 4).map(Number) : null;
+}
+/** -1 / 0 / 1, or null when either side is not a version. */
+function compareDaemonVersions(a, b) {
+    const left = versionParts(a);
+    const right = versionParts(b);
+    if (!left || !right)
+        return null;
+    for (let i = 0; i < 3; i += 1) {
+        if (left[i] !== right[i])
+            return left[i] < right[i] ? -1 : 1;
+    }
+    return 0;
+}
+/**
+ * Which daemon the approved image carries against the latest daemon release
+ * (OSK-12153). `image update: current` used to be the whole answer, while the
+ * daemon on the same machine said a newer release existed: "current" means no
+ * newer APPROVED image, and a release that no approved image carries yet is not
+ * something this machine can move to. Both halves are said, and an unknown
+ * half is said to be unknown rather than left out.
+ */
+function describeDedicatedDaemonRelease(image, latest) {
+    if (!latest)
+        return null;
+    const carried = image.approvedImageDaemonVersion || null;
+    const latestText = 'version' in latest
+        ? `latest release skrrd ${latest.version}`
+        : `latest release unknown (${latest.error})`;
+    if (!carried) {
+        return `${approvedImageDaemonUnknownText(image)} · ${latestText}`;
+    }
+    if (!('version' in latest)) {
+        return `approved image carries skrrd ${carried} · ${latestText}`;
+    }
+    const compared = compareDaemonVersions(carried, latest.version);
+    if (compared === 0) {
+        return `approved image carries skrrd ${carried}, the latest release`;
+    }
+    if (compared === -1) {
+        return `approved image carries skrrd ${carried} · latest release skrrd ${latest.version} is not in an approved image yet, so there is nothing to update to`;
+    }
+    return `approved image carries skrrd ${carried} · ${latestText}`;
+}
+/**
+ * Why the server could not say which daemon the approved image carries, in
+ * words an owner can act on (OSK-12153). A bare "unknown" named no cause and no
+ * next step.
+ */
+function approvedImageDaemonUnknownText(image) {
+    switch (image.approvedImageDaemonUnknownReason) {
+        case 'image_superseded':
+            return 'this machine runs an older image than the approved one, so which skrrd the approved image carries is seen once it moves onto it';
+        case 'approval_unreadable':
+            return "the server cannot compare this machine's image with the approved one, so it cannot say which skrrd the approved image carries";
+        case 'daemon_unreported':
+            return 'this machine runs the approved image, but its daemon has not reported a version yet';
+        default:
+            return 'the server did not say which skrrd the approved image carries';
+    }
+}
+/**
+ * One line saying where a machine's image stands and what the owner can do.
+ *
+ * "current" is claimed only when it is KNOWN: no newer approved image AND this
+ * machine's own daemon is at the latest release (OSK-12153). A guest never
+ * updates its own daemon, so "no newer approved image" beside a daemon that is
+ * behind the latest release is a different — and worse — state than "current",
+ * and the line says so instead of collapsing toward the reassuring reading.
+ * With the release feed unread, or no daemon version, it says only what is
+ * known: there is no newer approved image.
+ */
+function describeDedicatedImageStanding(image, leaseId, opts = {}) {
     const last = image.lastUpdate;
     if (last?.status === 'applying') {
         return `moving onto the current image${last.startedAt ? ` since ${last.startedAt}` : ''}; files are kept`;
@@ -93,7 +168,18 @@ function describeDedicatedImageStanding(image, leaseId) {
         parts.push('the last image update did not complete on either image; files are kept');
     }
     else {
-        parts.push('current');
+        const here = String(opts.daemonVersion || '').trim();
+        const latest = opts.latestDaemonRelease;
+        const compared = here && latest && 'version' in latest ? compareDaemonVersions(here, latest.version) : null;
+        if (compared === -1 && latest && 'version' in latest) {
+            parts.push(`no newer approved image, but this machine's skrrd ${here} is behind the latest release ${latest.version}`);
+        }
+        else if (compared !== null) {
+            parts.push('current');
+        }
+        else {
+            parts.push('no newer approved image');
+        }
     }
     if (last?.status === 'succeeded' && last.settledAt)
         parts.push(`updated ${last.settledAt}`);
@@ -547,7 +633,7 @@ function describeDedicatedDeletion(deletion, leaseId) {
     }
     return 'nothing to restore; every copy is deleted when the window closes';
 }
-function describeDedicatedLease(lease, harnesses = []) {
+function describeDedicatedLease(lease, harnesses = [], opts = {}) {
     const lines = [dedicatedLeaseDisplayName(lease)];
     const row = (label, value) => {
         if (value === undefined || value === null || value === '')
@@ -583,7 +669,11 @@ function describeDedicatedLease(lease, harnesses = []) {
     const image = [resources.imageVersion || lease.daemon?.imageVersion].filter(Boolean).join('');
     row('image', image);
     if (lease.health?.image) {
-        row('image update', describeDedicatedImageStanding(lease.health.image, dedicatedLeaseId(lease)));
+        row('image update', describeDedicatedImageStanding(lease.health.image, dedicatedLeaseId(lease), {
+            daemonVersion: lease.daemon?.version,
+            latestDaemonRelease: opts.latestDaemonRelease,
+        }));
+        row('image daemon', describeDedicatedDaemonRelease(lease.health.image, opts.latestDaemonRelease));
     }
     if (lease.daemon?.version || lease.daemon?.lastHeartbeatAt) {
         row('daemon', [

package/dist/lib/delegated-cli.js

@@ -260,6 +260,22 @@ async function fetchDelegatedCliCredential(env = process.env, options = {}) {
             const body = (await res.json().catch(() => null));
             if (res.status === 403 && body?.code === 'DELEGATED_CLI_CAPABILITY_REJECTED')
                 return null;
+            if ((res.status === 503 || body?.code === 'DELEGATED_CLI_CREDENTIAL_UNAVAILABLE') &&
+                (typeof body?.upstreamCode === 'string' || typeof body?.upstreamStatus === 'number')) {
+                // The daemon named the server's refusal of its own mint (OSK-12151):
+                // say that, with the code, rather than guess at three possible causes.
+                const named = [
+                    typeof body?.upstreamStatus === 'number' ? `HTTP ${body.upstreamStatus}` : '',
+                    typeof body?.upstreamCode === 'string' ? body.upstreamCode : '',
+                ]
+                    .filter(Boolean)
+                    .join(' ');
+                // The daemon's `message` already names the refusal; fall back to the
+                // status and code when an older daemon sent none.
+                throw new Error(typeof body?.message === 'string' && body.message
+                    ? `the daemon's delegated CLI broker could not mint a credential: ${body.message}`
+                    : `the skrr server refused the daemon's request for this session's credential (${named}).`);
+            }
             if (res.status === 503 || body?.code === 'DELEGATED_CLI_CREDENTIAL_UNAVAILABLE') {
                 throw new Error(`the daemon's delegated CLI broker is alive but cannot mint a credential ` +
                     `(HTTP ${res.status}). The daemon cannot reach the auth upstream, holds ` +

package/dist/lib/first-party-harness-broker.js

@@ -73,6 +73,7 @@ const api_fetch_1 = require("./api-fetch");
 const auth_storage_1 = require("./auth-storage");
 const auth_core_init_1 = require("./auth-core-init");
 const config_1 = require("./config");
+const cli_id_1 = require("./cli-id");
 const cred_envelope_1 = require("./cred-envelope");
 const device_id_1 = require("./device-id");
 const first_party_harness_1 = require("./first-party-harness");
@@ -859,9 +860,10 @@ function hasLocalCredential() {
 /**
  * This installation's runtime id.
  *
- * Persisted at first login as `cliId`; regenerated deterministically when absent
- * (same hostname+user always yields the same value), matching `daemonBroker.ts`
- * and `refresh.ts`. Normalized to the `cli_` namespace the server requires,
+ * The id login and refresh present, read through `resolveCliId` (a named
+ * profile may have its own, OSK-12156); regenerated deterministically as the
+ * machine id when nothing is stored (same hostname+user always yields the same
+ * value). Normalized to the `cli_` namespace the server requires,
  * because `OVERSKY_CLI_ID` is overlaid verbatim with no format check and a
  * hand-set value would otherwise come back as an opaque
  * `runtime-id-namespace-mismatch`.
@@ -869,7 +871,7 @@ function hasLocalCredential() {
 function localRuntimeId() {
     const configured = (() => {
         try {
-            return (0, config_1.loadConfig)().cliId?.trim();
+            return (0, cli_id_1.resolveCliId)((0, config_1.loadConfig)());
         }
         catch {
             return undefined;

package/dist/lib/keychain.d.ts

@@ -11,6 +11,19 @@ export declare function setActiveProfile(profile: string): void;
  */
 export declare function isProfileResolved(): boolean;
 export declare function getActiveProfile(): string;
+/** The resolved config root this process's credentials belong to. */
+export declare function resolvedConfigRoot(): string;
+/** Is `root` this account's default skrr root, the owner of the legacy slot? */
+export declare function isDefaultConfigRoot(root?: string): boolean;
+/** A slot other than this root's own. */
+export type ForeignSlot = {
+    kind: 'legacy';
+} | {
+    kind: 'displaced';
+    cliId: string;
+};
+/** True when this root's own slot IS the historical profile-only slot. */
+export declare function isLegacySlotCurrent(): boolean;
 /** @internal exposed for tests / diagnostics. */
 export declare function __currentServiceForTest(): string;
 /**
@@ -47,6 +60,32 @@ export declare function readServerOrigin(): string | null;
 export declare function writeServerOrigin(origin: string): boolean;
 /** Remove the issuing-origin companion slot. */
 export declare function deleteServerOrigin(): void;
+/** Raw owner record (`{configRoot, cliId}` JSON) of this root's own slot. */
+export declare function readOwner(): string | null;
+export declare function writeOwner(owner: string): boolean;
+export declare function deleteOwner(): void;
+/** Every value a CLI bundle keeps in the Keychain, read from one service. */
+export interface KeychainBundleSlots {
+    token: KeychainEntry;
+    refresh: KeychainEntry | null;
+    serverOrigin: string | null;
+    owner: string | null;
+}
+/**
+ * Read a whole bundle from a slot this root does not own (the legacy slot, or a
+ * displaced one). The caller decides whether it is ours; nothing here rewrites
+ * a slot on another config's behalf.
+ */
+export declare function readBundleAt(slot: ForeignSlot): KeychainBundleSlots | null;
+/**
+ * Copy every item of one slot to another BYTE FOR BYTE (the displacement
+ * rescue). Raw on purpose: the secret items may be sealed under the owning
+ * config's envelope key, and re-sealing them under ours would make the copy
+ * unreadable to the one config it exists for.
+ */
+export declare function copyBundle(from: ForeignSlot, to: ForeignSlot): boolean;
+/** Remove every CLI item under a slot this root does not own. The caller proves ownership. */
+export declare function deleteAllAt(slot: ForeignSlot): void;
 export declare function deleteToken(): void;
 export declare function deleteRefreshToken(): void;
 /**