@skrr-ai/cli 0.1.51 → 0.1.53

package/dist/lib/keychain.js

@@ -1,9 +1,45 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_PROFILE = void 0;
 exports.setActiveProfile = setActiveProfile;
 exports.isProfileResolved = isProfileResolved;
 exports.getActiveProfile = getActiveProfile;
+exports.resolvedConfigRoot = resolvedConfigRoot;
+exports.isDefaultConfigRoot = isDefaultConfigRoot;
+exports.isLegacySlotCurrent = isLegacySlotCurrent;
 exports.__currentServiceForTest = __currentServiceForTest;
 exports.isAvailable = isAvailable;
 exports.resetAvailability = resetAvailability;
@@ -14,6 +50,12 @@ exports.writeRefreshToken = writeRefreshToken;
 exports.readServerOrigin = readServerOrigin;
 exports.writeServerOrigin = writeServerOrigin;
 exports.deleteServerOrigin = deleteServerOrigin;
+exports.readOwner = readOwner;
+exports.writeOwner = writeOwner;
+exports.deleteOwner = deleteOwner;
+exports.readBundleAt = readBundleAt;
+exports.copyBundle = copyBundle;
+exports.deleteAllAt = deleteAllAt;
 exports.deleteToken = deleteToken;
 exports.deleteRefreshToken = deleteRefreshToken;
 exports.deleteLegacyBrandEntries = deleteLegacyBrandEntries;
@@ -42,11 +84,39 @@ exports.resolveProfileFromArgv = resolveProfileFromArgv;
  *   account = "cli-refresh"           → refresh JWT
  *   account = "cli-refresh-expires"   → epoch ms expiry, optional
  *   account = "cli-server-origin"     → issuing API origin (non-secret)
+ *   account = "cli-owner"             → JSON {configRoot, cliId} of the config
+ *                                       that wrote this bundle (non-secret)
+ *
+ * OSK-12135 — the slot is namespaced by CONFIG ROOT as well as profile. The
+ * login Keychain is one per macOS user, but the CLI identity (`cliId`) lives in
+ * the config root, so a second skrr setup on the same Mac (a different HOME or
+ * `SKRR_CONFIG_DIR`) with the same profile name used to write into this
+ * profile's slot, and the next refresh presented a token bound to the other
+ * setup's `cliId` (`stored=cli_devin_dogfood presented=cli_81ff3efd4ff8`).
+ *
+ *   - The account's DEFAULT root (`<passwd home>/.skrr`) keeps the historical
+ *     service name `ai.skrr.cli.<profile>`, so a normal single-config machine
+ *     reads exactly the slot it always has — no migration, no re-login, and an
+ *     older skrr binary sharing that config keeps interoperating.
+ *   - Any other root writes `ai.skrr.cli.<profile>.root-<sha256(root)[:12]>`,
+ *     a region no other root can name. It may READ the legacy slot as a
+ *     migration, and only when that bundle positively belongs to it (see
+ *     `auth-storage.ts`).
+ *   - `ai.skrr.cli.<profile>.cli-<cliId>` holds a credential the default root
+ *     DISPLACED from its own slot because an older binary of another config
+ *     wrote it there. It is keyed by the identity the server bound it to, so
+ *     only that config can adopt it, and a login destroys nobody's credential.
+ *
+ * The passwd home (not `$HOME`) defines "default", because a setup that swaps
+ * `$HOME` is exactly the second config this protects against.
  *
  * On non-darwin (Linux/CI) every function is a no-op / null-return so the
  * caller cleanly falls back to the file-based `cli-auth.json` backend.
  */
 const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = require("node:crypto");
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
 const cred_envelope_1 = require("./cred-envelope");
 const auth_core_1 = require("@skrr-ai/auth-core");
 /** Service-name prefix. Always followed by `.<profile>`. */
@@ -58,6 +128,7 @@ const ACCOUNT_EXPIRES = 'cli-token-expires';
 const ACCOUNT_REFRESH = 'cli-refresh';
 const ACCOUNT_REFRESH_EXPIRES = 'cli-refresh-expires';
 const ACCOUNT_SERVER_ORIGIN = 'cli-server-origin';
+const ACCOUNT_OWNER = 'cli-owner';
 /** macOS `security` exit code when the requested item does not exist. */
 const SECURITY_ITEM_NOT_FOUND = 44;
 /** Cached availability — probed once at first call. */
@@ -95,9 +166,55 @@ function isProfileResolved() {
 function getActiveProfile() {
     return _activeProfile;
 }
-function currentService() {
+/** The resolved config root this process's credentials belong to. */
+function resolvedConfigRoot() {
+    return path.resolve((0, auth_core_1.resolveConfigRoot)());
+}
+/**
+ * The account's home from the user database, NOT `$HOME`. A second skrr setup
+ * that swaps `$HOME` must not count as the default root, or it would share the
+ * historical slot with the real one — the incident this namespacing exists for.
+ */
+function accountHome() {
+    try {
+        const home = os.userInfo().homedir;
+        if (home)
+            return home;
+    }
+    catch {
+        /* no passwd entry (some containers) — fall through */
+    }
+    return os.homedir();
+}
+/** Is `root` this account's default skrr root, the owner of the legacy slot? */
+function isDefaultConfigRoot(root = resolvedConfigRoot()) {
+    return path.resolve(root) === path.resolve(accountHome(), '.skrr');
+}
+function legacyService() {
     return `${SERVICE_BASE}.${_activeProfile}`;
 }
+function currentService() {
+    const root = resolvedConfigRoot();
+    if (isDefaultConfigRoot(root))
+        return legacyService();
+    const digest = (0, node_crypto_1.createHash)('sha256').update(root).digest('hex').slice(0, 12);
+    return `${legacyService()}.root-${digest}`;
+}
+function displacedService(cliId) {
+    // A cliId is `cli_<hex>` in practice; anything else is hashed so the service
+    // name never carries characters `security -i` quoting has to worry about.
+    const safe = /^[A-Za-z0-9_-]{1,64}$/.test(cliId)
+        ? cliId
+        : (0, node_crypto_1.createHash)('sha256').update(cliId).digest('hex').slice(0, 16);
+    return `${legacyService()}.cli-${safe}`;
+}
+function serviceForSlot(slot) {
+    return slot.kind === 'legacy' ? legacyService() : displacedService(slot.cliId);
+}
+/** True when this root's own slot IS the historical profile-only slot. */
+function isLegacySlotCurrent() {
+    return currentService() === legacyService();
+}
 /** @internal exposed for tests / diagnostics. */
 function __currentServiceForTest() {
     return currentService();
@@ -140,7 +257,11 @@ function resetAvailability() {
 function isSecretAccount(account) {
     return account === ACCOUNT_TOKEN || account === ACCOUNT_REFRESH;
 }
-function readSlot(account, service = currentService()) {
+/**
+ * `raw` returns the stored string exactly, with no envelope transform — for
+ * copying another config's item, which may be sealed under a key we lack.
+ */
+function readSlot(account, service = currentService(), raw_ = false) {
     let raw;
     try {
         const out = (0, node_child_process_1.execFileSync)('security', ['find-generic-password', '-s', service, '-a', account, '-w'], { stdio: ['ignore', 'pipe', 'ignore'], encoding: 'utf-8' });
@@ -161,7 +282,7 @@ function readSlot(account, service = currentService()) {
         }
         return null;
     }
-    if (!isSecretAccount(account))
+    if (raw_ || !isSecretAccount(account))
         return raw;
     // L12 — route secret slots through the envelope.
     // - Envelope on disk + path active → returns plaintext.
@@ -169,10 +290,13 @@ function readSlot(account, service = currentService()) {
     //   re-login; the bundle is unrecoverable without the DEK).
     // - Legacy plaintext + path active → returns plaintext + needsMigration;
     //   we re-write in place to upgrade the slot.
-    const result = (0, cred_envelope_1.maybeDecryptOnRead)(raw);
+    const result = (0, cred_envelope_1.maybeDecryptOnRead)(raw, { foreignOwnerRoot: foreignOwnerRootAt(service) });
     if (result.plaintext === null)
         return null;
-    if (result.needsMigration) {
+    // Only this root's OWN slot is upgraded. A slot read as a migration source may
+    // belong to another config, whose envelope key this process does not hold —
+    // sealing it under ours would make it unreadable to its owner (OSK-12135).
+    if (result.needsMigration && service === currentService()) {
         // Best-effort upgrade — a failure here doesn't break the read; the
         // slot just stays plaintext and we'll try again on the next read.
         try {
@@ -184,6 +308,31 @@ function readSlot(account, service = currentService()) {
     }
     return result.plaintext;
 }
+/**
+ * The config root named by `service`'s owner record, when it is NOT this
+ * process's root; otherwise undefined. The record is non-secret JSON
+ * (`{configRoot, cliId}`), so it can be read before the secret it describes.
+ *
+ * Only a diagnostic input. Whether the bundle is ours is still decided by
+ * `auth-storage`'s `judgeOwnership`, which also weighs the token's own `did`
+ * — so the secret is decrypted as before, and only what a failure SAYS changes.
+ */
+function foreignOwnerRootAt(service) {
+    const raw = readSlot(ACCOUNT_OWNER, service);
+    if (!raw)
+        return undefined;
+    let root;
+    try {
+        root = JSON.parse(raw)?.configRoot;
+    }
+    catch {
+        return undefined;
+    }
+    if (typeof root !== 'string' || root.length === 0)
+        return undefined;
+    const resolved = path.resolve(root);
+    return resolved === resolvedConfigRoot() ? undefined : resolved;
+}
 /**
  * Escape a value for `security -i` (stdin interactive mode).
  * `security` accepts double-quoted args with `\"` and `\\` backslash escapes.
@@ -191,11 +340,11 @@ function readSlot(account, service = currentService()) {
 function quoteForSecurityInteractive(v) {
     return '"' + v.replace(/\\/g, '\\\\').replace(/"/g, '\\"') + '"';
 }
-function writeSlot(account, value, service = currentService()) {
+function writeSlot(account, value, service = currentService(), raw = false) {
     try {
         // L12 — wrap secret-bearing slots through the envelope when active.
-        // Empty / non-secret slots are passthrough.
-        const wireValue = isSecretAccount(account) ? (0, cred_envelope_1.maybeEncryptForWrite)(value) : value;
+        // Empty / non-secret slots are passthrough, and so is a raw copy.
+        const wireValue = !raw && isSecretAccount(account) ? (0, cred_envelope_1.maybeEncryptForWrite)(value) : value;
         // -i reads commands from stdin so the JWT never appears in argv (it
         // would otherwise be visible to same-UID `ps` observers). -U updates
         // in place instead of failing with "item already exists".
@@ -231,13 +380,11 @@ function deleteSlot(account, service = currentService()) {
         }
     }
 }
-function readToken() {
-    if (!isAvailable())
-        return null;
-    const token = readSlot(ACCOUNT_TOKEN);
+function readEntryAt(service, account, expiresAccount) {
+    const token = readSlot(account, service);
     if (!token)
         return null;
-    const expiresRaw = readSlot(ACCOUNT_EXPIRES);
+    const expiresRaw = readSlot(expiresAccount, service);
     let expiresAt;
     if (expiresRaw) {
         const parsed = Number.parseInt(expiresRaw, 10);
@@ -246,51 +393,41 @@ function readToken() {
     }
     return expiresAt !== undefined ? { token, expiresAt } : { token };
 }
-function writeToken(token, expiresAt) {
-    if (!isAvailable())
-        return false;
-    if (!token)
-        return false;
-    if (!writeSlot(ACCOUNT_TOKEN, token))
+function writeEntryAt(service, account, expiresAccount, token, expiresAt) {
+    if (!writeSlot(account, token, service))
         return false;
     if (expiresAt && Number.isFinite(expiresAt)) {
-        writeSlot(ACCOUNT_EXPIRES, String(Math.trunc(expiresAt)));
+        writeSlot(expiresAccount, String(Math.trunc(expiresAt)), service);
     }
     else {
         // Stale expiry from a prior write would lie about the token's lifetime.
-        deleteSlot(ACCOUNT_EXPIRES);
+        deleteSlot(expiresAccount, service);
     }
     return true;
 }
-function readRefreshToken() {
+function readToken() {
     if (!isAvailable())
         return null;
-    const token = readSlot(ACCOUNT_REFRESH);
+    return readEntryAt(currentService(), ACCOUNT_TOKEN, ACCOUNT_EXPIRES);
+}
+function writeToken(token, expiresAt) {
+    if (!isAvailable())
+        return false;
     if (!token)
+        return false;
+    return writeEntryAt(currentService(), ACCOUNT_TOKEN, ACCOUNT_EXPIRES, token, expiresAt);
+}
+function readRefreshToken() {
+    if (!isAvailable())
         return null;
-    const expiresRaw = readSlot(ACCOUNT_REFRESH_EXPIRES);
-    let expiresAt;
-    if (expiresRaw) {
-        const parsed = Number.parseInt(expiresRaw, 10);
-        if (Number.isFinite(parsed) && parsed > 0)
-            expiresAt = parsed;
-    }
-    return expiresAt !== undefined ? { token, expiresAt } : { token };
+    return readEntryAt(currentService(), ACCOUNT_REFRESH, ACCOUNT_REFRESH_EXPIRES);
 }
 function writeRefreshToken(token, expiresAt) {
     if (!isAvailable())
         return false;
     if (!token)
         return false;
-    if (!writeSlot(ACCOUNT_REFRESH, token))
-        return false;
-    if (expiresAt && Number.isFinite(expiresAt)) {
-        writeSlot(ACCOUNT_REFRESH_EXPIRES, String(Math.trunc(expiresAt)));
-    }
-    else {
-        deleteSlot(ACCOUNT_REFRESH_EXPIRES);
-    }
-    return true;
+    return writeEntryAt(currentService(), ACCOUNT_REFRESH, ACCOUNT_REFRESH_EXPIRES, token, expiresAt);
 }
 /**
  * Read the API origin that issued the active token bundle.
@@ -321,6 +458,82 @@ function deleteServerOrigin() {
         return;
     deleteSlot(ACCOUNT_SERVER_ORIGIN);
 }
+/** Raw owner record (`{configRoot, cliId}` JSON) of this root's own slot. */
+function readOwner() {
+    if (!isAvailable())
+        return null;
+    const value = readSlot(ACCOUNT_OWNER);
+    return value && value.length > 0 ? value : null;
+}
+function writeOwner(owner) {
+    if (!isAvailable())
+        return false;
+    if (!owner)
+        return false;
+    return writeSlot(ACCOUNT_OWNER, owner);
+}
+function deleteOwner() {
+    if (!isAvailable())
+        return;
+    deleteSlot(ACCOUNT_OWNER);
+}
+/**
+ * Read a whole bundle from a slot this root does not own (the legacy slot, or a
+ * displaced one). The caller decides whether it is ours; nothing here rewrites
+ * a slot on another config's behalf.
+ */
+function readBundleAt(slot) {
+    if (!isAvailable())
+        return null;
+    const service = serviceForSlot(slot);
+    const token = readEntryAt(service, ACCOUNT_TOKEN, ACCOUNT_EXPIRES);
+    if (!token)
+        return null;
+    return {
+        token,
+        refresh: readEntryAt(service, ACCOUNT_REFRESH, ACCOUNT_REFRESH_EXPIRES),
+        serverOrigin: readSlot(ACCOUNT_SERVER_ORIGIN, service) || null,
+        owner: readSlot(ACCOUNT_OWNER, service) || null,
+    };
+}
+const BUNDLE_ACCOUNTS = [
+    ACCOUNT_TOKEN,
+    ACCOUNT_EXPIRES,
+    ACCOUNT_REFRESH,
+    ACCOUNT_REFRESH_EXPIRES,
+    ACCOUNT_SERVER_ORIGIN,
+    ACCOUNT_OWNER,
+];
+/**
+ * Copy every item of one slot to another BYTE FOR BYTE (the displacement
+ * rescue). Raw on purpose: the secret items may be sealed under the owning
+ * config's envelope key, and re-sealing them under ours would make the copy
+ * unreadable to the one config it exists for.
+ */
+function copyBundle(from, to) {
+    if (!isAvailable())
+        return false;
+    const source = serviceForSlot(from);
+    const target = serviceForSlot(to);
+    if (readSlot(ACCOUNT_TOKEN, source, true) === null)
+        return false;
+    for (const account of BUNDLE_ACCOUNTS) {
+        const value = readSlot(account, source, true);
+        if (value === null)
+            deleteSlot(account, target);
+        else if (!writeSlot(account, value, target, true))
+            return false;
+    }
+    return true;
+}
+/** Remove every CLI item under a slot this root does not own. The caller proves ownership. */
+function deleteAllAt(slot) {
+    if (!isAvailable())
+        return;
+    const service = serviceForSlot(slot);
+    for (const account of BUNDLE_ACCOUNTS)
+        deleteSlot(account, service);
+}
 function deleteToken() {
     if (!isAvailable())
         return;
@@ -423,6 +636,7 @@ function deleteAll() {
     deleteToken();
     deleteRefreshToken();
     deleteServerOrigin();
+    deleteOwner();
 }
 /**
  * Pull `--profile` out of raw argv.

package/dist/lib/label-ref.d.ts

@@ -102,3 +102,37 @@ export declare class LabelRefError extends Error {
  * label ends up attached to a year of work.
  */
 export declare function resolveLabelRefs(refs: string[] | undefined, context: LabelRefContext): Promise<string[]>;
+/**
+ * Help for a `--tag` flag that sits beside `--label-id` (OSK-12053, OSK-12166).
+ *
+ * Tags and labels are two DIFFERENT vocabularies: a tag is any free string,
+ * stored as typed on `task.tags`; a label is declared (`skrr labels`) and is
+ * what `--label` filters, the board and the label guidance read. The flags used
+ * to be described as "Tag (repeatable)" and "Attach a task label", so a person
+ * wanting the `dogfood` label typed `--tag dogfood` on every task of a program
+ * and none of them was labelled.
+ */
+export declare const TAG_FLAG_HELP: string;
+export interface TagNamingLabel {
+    tag: string;
+    label: LabelRow;
+}
+/**
+ * The `--tag` values that equal a declared label's name, each paired with that
+ * label — the one case where the mistake is certain enough to say so.
+ *
+ * Best-effort by construction: it only ever feeds a WARNING, so a vocabulary
+ * that cannot be read yields no matches rather than an error, and the tags are
+ * stored as typed either way. Nothing is converted into a label implicitly —
+ * which one a person meant is theirs to say, and a warning that names the exact
+ * flag costs one retry.
+ */
+export declare function tagsNamingLabels(tags: string[] | undefined, context: LabelVocabularyContext): Promise<TagNamingLabel[]>;
+/** The stderr line for `tagsNamingLabels` hits; an empty string when there are none. */
+export declare function describeTagsNamingLabels(hits: TagNamingLabel[]): string;
+/**
+ * The whole `--tag` check a write command runs: the warning for tags that equal
+ * a declared label AND were not also attached through `--label` (passing both
+ * is someone doing it right). An empty string means say nothing.
+ */
+export declare function tagLabelWarning(tags: string[] | undefined, attachedLabelIds: string[] | undefined, context: LabelVocabularyContext): Promise<string>;

package/dist/lib/label-ref.js

@@ -33,11 +33,14 @@
  * their path.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LabelRefError = void 0;
+exports.TAG_FLAG_HELP = exports.LabelRefError = void 0;
 exports.looksLikeLabelId = looksLikeLabelId;
 exports.closestNames = closestNames;
 exports.collectLabelVocabulary = collectLabelVocabulary;
 exports.resolveLabelRefs = resolveLabelRefs;
+exports.tagsNamingLabels = tagsNamingLabels;
+exports.describeTagsNamingLabels = describeTagsNamingLabels;
+exports.tagLabelWarning = tagLabelWarning;
 const data_provider_1 = require("@skrr-ai/data-provider");
 const workspaces_1 = require("./workspaces");
 /** A canonical v4 uuid, which is what every label id is. */
@@ -171,3 +174,71 @@ async function resolveLabelRefs(refs, context) {
     }
     return resolved;
 }
+/**
+ * Help for a `--tag` flag that sits beside `--label-id` (OSK-12053, OSK-12166).
+ *
+ * Tags and labels are two DIFFERENT vocabularies: a tag is any free string,
+ * stored as typed on `task.tags`; a label is declared (`skrr labels`) and is
+ * what `--label` filters, the board and the label guidance read. The flags used
+ * to be described as "Tag (repeatable)" and "Attach a task label", so a person
+ * wanting the `dogfood` label typed `--tag dogfood` on every task of a program
+ * and none of them was labelled.
+ */
+exports.TAG_FLAG_HELP = 'Free-form tag (repeatable), stored exactly as typed and never checked against anything. ' +
+    'NOT a label: to classify the task under a declared label (`labels list`), use --label-id ' +
+    '(it takes a label name or id).';
+/**
+ * The `--tag` values that equal a declared label's name, each paired with that
+ * label — the one case where the mistake is certain enough to say so.
+ *
+ * Best-effort by construction: it only ever feeds a WARNING, so a vocabulary
+ * that cannot be read yields no matches rather than an error, and the tags are
+ * stored as typed either way. Nothing is converted into a label implicitly —
+ * which one a person meant is theirs to say, and a warning that names the exact
+ * flag costs one retry.
+ */
+async function tagsNamingLabels(tags, context) {
+    const input = (tags ?? []).map((tag) => tag.trim()).filter(Boolean);
+    if (input.length === 0)
+        return [];
+    let vocabulary;
+    try {
+        vocabulary = await collectLabelVocabulary(context);
+    }
+    catch {
+        return [];
+    }
+    const hits = [];
+    for (const tag of input) {
+        const needle = tag.toLowerCase();
+        const label = vocabulary.find((row) => (row.name ?? '').toLowerCase() === needle);
+        if (label)
+            hits.push({ tag, label });
+    }
+    return hits;
+}
+/** The stderr line for `tagsNamingLabels` hits; an empty string when there are none. */
+function describeTagsNamingLabels(hits) {
+    if (hits.length === 0)
+        return '';
+    const names = hits.map((hit) => `"${hit.tag}"`).join(', ');
+    // `--label-id` is the flag the help LISTS; `--label` is a hidden alias of it,
+    // so a warning that named the alias sent people to a flag they could not
+    // find in `--help` (OSK-12166).
+    const flags = hits.map((hit) => `--label-id ${hit.label.name}`).join(' ');
+    return (`--tag ${names} ${hits.length === 1 ? 'was' : 'were'} stored as free-form ` +
+        `${hits.length === 1 ? 'tag' : 'tags'}, NOT as the declared label of the same name, ` +
+        `so a label filter will not find this task. To attach the label, pass ${flags}.`);
+}
+/**
+ * The whole `--tag` check a write command runs: the warning for tags that equal
+ * a declared label AND were not also attached through `--label` (passing both
+ * is someone doing it right). An empty string means say nothing.
+ */
+async function tagLabelWarning(tags, attachedLabelIds, context) {
+    if (!tags || tags.length === 0)
+        return '';
+    const attached = new Set(attachedLabelIds ?? []);
+    const hits = await tagsNamingLabels(tags, context);
+    return describeTagsNamingLabels(hits.filter((hit) => !attached.has(hit.label.id)));
+}

package/dist/lib/login.js

@@ -31,12 +31,13 @@ const node_child_process_1 = require("node:child_process");
 const auth_core_1 = require("@skrr-ai/auth-core");
 const auth_storage_1 = require("./auth-storage");
 const config_1 = require("./config");
-const device_id_1 = require("./device-id");
+const cli_identity_1 = require("./cli-identity");
 const ssh_detect_1 = require("./ssh-detect");
 const device_code_1 = require("./device-code");
 const device_identity_1 = require("./device-identity");
 const oauthLogin_1 = require("./oauthLogin");
 const daemonBroker_1 = require("./daemonBroker");
+const daemonBrokerRefusal_1 = require("./daemonBrokerRefusal");
 /**
  * What a shell with no terminal can do instead (OSK-12117). The refusal used to
  * name only CI tokens, which is not a sign-in: an agent session asking for one
@@ -73,16 +74,16 @@ async function cliLogin(opts = {}) {
     const serverUrl = (opts.serverUrl ?? cfg.baseURL).replace(/\/+$/, '');
     const scope = opts.scope ?? 'cli';
     // Persist the cliId on first login so future refreshes present a
-    // stable device identity. Same invariant as the device-code-only
-    // path this supersedes.
-    const cliId = cfg.cliId ?? (0, device_id_1.generateCliId)();
-    if (!cfg.cliId) {
-        (0, config_1.saveConfig)({ ...cfg, cliId });
-    }
+    // stable device identity. A named profile signing in with no credential is
+    // issued its OWN id here, so the hand-off confirm below cannot retire another
+    // profile's session (OSK-12156); see `cli-identity.ts`.
+    const cliId = (0, cli_identity_1.cliIdForLogin)(cfg);
     const envForce = isTruthy(process.env.OVERSKY_FORCE_DEVICE_CODE);
     const ssh = (0, ssh_detect_1.detectSshSession)();
     /** Set when the broker was refused for a reason that WAITING fixes. */
     let brokerRateLimited = false;
+    /** Set when a live daemon answered the hand-off and refused it (OSK-12149). */
+    let brokerRefusal = null;
     // --- Daemon-as-broker pre-flight ---------------------------------------
     // When the local `oversky` daemon is already authenticated for this user
     // on this machine, the cleanest UX is no second browser flow at all:
@@ -129,7 +130,8 @@ async function cliLogin(opts = {}) {
                 };
             }
             console.log('');
-            console.log('  Authorized via the skrr background service on this computer (no browser needed).');
+            console.log('  Authorized via the skrr background service on this computer (no browser needed). ' +
+                'Stored a durable session for this profile.');
             return {
                 token: brokerResult.accessToken,
                 refreshToken: brokerResult.refreshToken,
@@ -179,6 +181,15 @@ async function cliLogin(opts = {}) {
             console.log('');
             console.log(describeBrokerBaseUrlMismatch(brokerResult, serverUrl));
         }
+        // The daemon answered and refused. Say so before whatever comes next —
+        // a browser that opens with no stated cause, or a refusal about terminals
+        // that says nothing about the daemon, both hid the real reason.
+        brokerRefusal = (0, daemonBrokerRefusal_1.describeBrokerRefusal)(brokerResult);
+        if (brokerRefusal && !(0, ssh_detect_1.isNonInteractive)()) {
+            console.log('');
+            console.log(`  Asked the local skrr service for a session first. ${brokerRefusal.headline}`);
+            console.log('  Continuing with a sign-in of this CLI’s own.');
+        }
     }
     // --- Decision tree (first match wins) ---
     //
@@ -199,7 +210,10 @@ async function cliLogin(opts = {}) {
             ? 'The skrr background service on this computer is being rate-limited while brokering logins, and this ' +
                 'shell cannot run the browser flow instead. The limit is per 15-minute window — ' +
                 `retry shortly, or sign in now with ${exports.HEADLESS_LOGIN_HINT}`
-            : `skrr login opens a browser, and this shell has no terminal to run it from. ${exports.HEADLESS_LOGIN_HINT}`);
+            : brokerRefusal
+                ? `${brokerRefusal.headline} ${brokerRefusal.remedy}\n` +
+                    `skrr login would otherwise open a browser, and this shell has no terminal to run it from. ${exports.HEADLESS_LOGIN_HINT}`
+                : `skrr login opens a browser, and this shell has no terminal to run it from. ${exports.HEADLESS_LOGIN_HINT}`);
     }
     if (ssh.detected) {
         // Device-code's "open this URL on your laptop" UX is the correct
@@ -282,9 +296,7 @@ async function cliLoginWithRefreshToken(opts) {
     // the operator retries. The refresh exchange itself is idempotent on
     // the server side (rotation is the unit of retry); writing the cliId
     // up-front never causes a server-state mismatch.
-    if (cfg.cliId !== opts.cliId) {
-        (0, config_1.saveConfig)({ ...cfg, cliId: opts.cliId });
-    }
+    (0, cli_identity_1.persistPresentedCliId)(cfg, opts.cliId);
     let pair;
     try {
         pair = await (0, auth_core_1.refreshDaemonToken)(serverUrl, opts.refreshToken, opts.cliId, {

package/dist/lib/oauthLogin.js

@@ -44,7 +44,7 @@ const node_http_1 = __importDefault(require("node:http"));
 const node_child_process_1 = require("node:child_process");
 const auth_storage_1 = require("./auth-storage");
 const config_1 = require("./config");
-const device_id_1 = require("./device-id");
+const cli_identity_1 = require("./cli-identity");
 const publicEndpoints_generated_1 = require("./publicEndpoints.generated");
 // ---------------------------------------------------------------------------
 // PKCE helpers
@@ -272,13 +272,7 @@ async function runOAuthLogin(opts) {
         });
     // Resolve cliId — explicit override wins; otherwise persist on disk
     // so subsequent refreshes present the same device identity.
-    let cliId = opts?.cliId;
-    if (!cliId) {
-        cliId = cfg.cliId ?? (0, device_id_1.generateCliId)();
-        if (!cfg.cliId) {
-            (0, config_1.saveConfig)({ ...cfg, cliId });
-        }
-    }
+    const cliId = opts?.cliId ?? (0, cli_identity_1.cliIdForLogin)(cfg);
     const { codeVerifier, codeChallenge } = generatePkce();
     const state = generateState();
     return new Promise((resolve) => {