@skrr-ai/cli 0.1.52 → 0.1.53

package/dist/lib/dedicated-machines.d.ts

@@ -122,6 +122,11 @@ export interface DedicatedImageStanding {
      * machine runs that image and its daemon reported a version. Null otherwise.
      */
     approvedImageDaemonVersion?: string | null;
+    /**
+     * Why `approvedImageDaemonVersion` is null, from a closed server vocabulary.
+     * Absent from a server older than this field.
+     */
+    approvedImageDaemonUnknownReason?: 'image_superseded' | 'approval_unreadable' | 'daemon_unreported' | null;
     /** When the older image stops being supported; null when there is no deadline. */
     updateBy?: string | null;
     lastUpdate?: {
@@ -150,8 +155,21 @@ export declare function compareDaemonVersions(a: string, b: string): number | nu
  * half is said to be unknown rather than left out.
  */
 export declare function describeDedicatedDaemonRelease(image: DedicatedImageStanding, latest: LatestDaemonRelease | null | undefined): string | null;
-/** One line saying where a machine's image stands and what the owner can do. */
-export declare function describeDedicatedImageStanding(image: DedicatedImageStanding, leaseId?: string): string;
+/**
+ * One line saying where a machine's image stands and what the owner can do.
+ *
+ * "current" is claimed only when it is KNOWN: no newer approved image AND this
+ * machine's own daemon is at the latest release (OSK-12153). A guest never
+ * updates its own daemon, so "no newer approved image" beside a daemon that is
+ * behind the latest release is a different — and worse — state than "current",
+ * and the line says so instead of collapsing toward the reassuring reading.
+ * With the release feed unread, or no daemon version, it says only what is
+ * known: there is no newer approved image.
+ */
+export declare function describeDedicatedImageStanding(image: DedicatedImageStanding, leaseId?: string, opts?: {
+    daemonVersion?: string | null;
+    latestDaemonRelease?: LatestDaemonRelease | null;
+}): string;
 /**
  * A deleted workspace: restorable into a new machine until `recoverableUntil`,
  * then every copy is deleted and `completedAt` records it. `withheld`: an unpaid

package/dist/lib/dedicated-machines.js

@@ -107,7 +107,7 @@ function describeDedicatedDaemonRelease(image, latest) {
         ? `latest release skrrd ${latest.version}`
         : `latest release unknown (${latest.error})`;
     if (!carried) {
-        return image.updateAvailable ? latestText : `approved image's daemon unknown · ${latestText}`;
+        return `${approvedImageDaemonUnknownText(image)} · ${latestText}`;
     }
     if (!('version' in latest)) {
         return `approved image carries skrrd ${carried} · ${latestText}`;
@@ -121,8 +121,35 @@ function describeDedicatedDaemonRelease(image, latest) {
     }
     return `approved image carries skrrd ${carried} · ${latestText}`;
 }
-/** One line saying where a machine's image stands and what the owner can do. */
-function describeDedicatedImageStanding(image, leaseId) {
+/**
+ * Why the server could not say which daemon the approved image carries, in
+ * words an owner can act on (OSK-12153). A bare "unknown" named no cause and no
+ * next step.
+ */
+function approvedImageDaemonUnknownText(image) {
+    switch (image.approvedImageDaemonUnknownReason) {
+        case 'image_superseded':
+            return 'this machine runs an older image than the approved one, so which skrrd the approved image carries is seen once it moves onto it';
+        case 'approval_unreadable':
+            return "the server cannot compare this machine's image with the approved one, so it cannot say which skrrd the approved image carries";
+        case 'daemon_unreported':
+            return 'this machine runs the approved image, but its daemon has not reported a version yet';
+        default:
+            return 'the server did not say which skrrd the approved image carries';
+    }
+}
+/**
+ * One line saying where a machine's image stands and what the owner can do.
+ *
+ * "current" is claimed only when it is KNOWN: no newer approved image AND this
+ * machine's own daemon is at the latest release (OSK-12153). A guest never
+ * updates its own daemon, so "no newer approved image" beside a daemon that is
+ * behind the latest release is a different — and worse — state than "current",
+ * and the line says so instead of collapsing toward the reassuring reading.
+ * With the release feed unread, or no daemon version, it says only what is
+ * known: there is no newer approved image.
+ */
+function describeDedicatedImageStanding(image, leaseId, opts = {}) {
     const last = image.lastUpdate;
     if (last?.status === 'applying') {
         return `moving onto the current image${last.startedAt ? ` since ${last.startedAt}` : ''}; files are kept`;
@@ -141,7 +168,18 @@ function describeDedicatedImageStanding(image, leaseId) {
         parts.push('the last image update did not complete on either image; files are kept');
     }
     else {
-        parts.push('current');
+        const here = String(opts.daemonVersion || '').trim();
+        const latest = opts.latestDaemonRelease;
+        const compared = here && latest && 'version' in latest ? compareDaemonVersions(here, latest.version) : null;
+        if (compared === -1 && latest && 'version' in latest) {
+            parts.push(`no newer approved image, but this machine's skrrd ${here} is behind the latest release ${latest.version}`);
+        }
+        else if (compared !== null) {
+            parts.push('current');
+        }
+        else {
+            parts.push('no newer approved image');
+        }
     }
     if (last?.status === 'succeeded' && last.settledAt)
         parts.push(`updated ${last.settledAt}`);
@@ -631,7 +669,10 @@ function describeDedicatedLease(lease, harnesses = [], opts = {}) {
     const image = [resources.imageVersion || lease.daemon?.imageVersion].filter(Boolean).join('');
     row('image', image);
     if (lease.health?.image) {
-        row('image update', describeDedicatedImageStanding(lease.health.image, dedicatedLeaseId(lease)));
+        row('image update', describeDedicatedImageStanding(lease.health.image, dedicatedLeaseId(lease), {
+            daemonVersion: lease.daemon?.version,
+            latestDaemonRelease: opts.latestDaemonRelease,
+        }));
         row('image daemon', describeDedicatedDaemonRelease(lease.health.image, opts.latestDaemonRelease));
     }
     if (lease.daemon?.version || lease.daemon?.lastHeartbeatAt) {

package/dist/lib/keychain.js

@@ -290,7 +290,7 @@ function readSlot(account, service = currentService(), raw_ = false) {
     //   re-login; the bundle is unrecoverable without the DEK).
     // - Legacy plaintext + path active → returns plaintext + needsMigration;
     //   we re-write in place to upgrade the slot.
-    const result = (0, cred_envelope_1.maybeDecryptOnRead)(raw);
+    const result = (0, cred_envelope_1.maybeDecryptOnRead)(raw, { foreignOwnerRoot: foreignOwnerRootAt(service) });
     if (result.plaintext === null)
         return null;
     // Only this root's OWN slot is upgraded. A slot read as a migration source may
@@ -308,6 +308,31 @@ function readSlot(account, service = currentService(), raw_ = false) {
     }
     return result.plaintext;
 }
+/**
+ * The config root named by `service`'s owner record, when it is NOT this
+ * process's root; otherwise undefined. The record is non-secret JSON
+ * (`{configRoot, cliId}`), so it can be read before the secret it describes.
+ *
+ * Only a diagnostic input. Whether the bundle is ours is still decided by
+ * `auth-storage`'s `judgeOwnership`, which also weighs the token's own `did`
+ * — so the secret is decrypted as before, and only what a failure SAYS changes.
+ */
+function foreignOwnerRootAt(service) {
+    const raw = readSlot(ACCOUNT_OWNER, service);
+    if (!raw)
+        return undefined;
+    let root;
+    try {
+        root = JSON.parse(raw)?.configRoot;
+    }
+    catch {
+        return undefined;
+    }
+    if (typeof root !== 'string' || root.length === 0)
+        return undefined;
+    const resolved = path.resolve(root);
+    return resolved === resolvedConfigRoot() ? undefined : resolved;
+}
 /**
  * Escape a value for `security -i` (stdin interactive mode).
  * `security` accepts double-quoted args with `\"` and `\\` backslash escapes.

package/dist/lib/label-ref.d.ts

@@ -103,7 +103,7 @@ export declare class LabelRefError extends Error {
  */
 export declare function resolveLabelRefs(refs: string[] | undefined, context: LabelRefContext): Promise<string[]>;
 /**
- * Help for a `--tag` flag that sits beside `--label` (OSK-12053).
+ * Help for a `--tag` flag that sits beside `--label-id` (OSK-12053, OSK-12166).
  *
  * Tags and labels are two DIFFERENT vocabularies: a tag is any free string,
  * stored as typed on `task.tags`; a label is declared (`skrr labels`) and is

package/dist/lib/label-ref.js

@@ -175,7 +175,7 @@ async function resolveLabelRefs(refs, context) {
     return resolved;
 }
 /**
- * Help for a `--tag` flag that sits beside `--label` (OSK-12053).
+ * Help for a `--tag` flag that sits beside `--label-id` (OSK-12053, OSK-12166).
  *
  * Tags and labels are two DIFFERENT vocabularies: a tag is any free string,
  * stored as typed on `task.tags`; a label is declared (`skrr labels`) and is
@@ -185,7 +185,8 @@ async function resolveLabelRefs(refs, context) {
  * and none of them was labelled.
  */
 exports.TAG_FLAG_HELP = 'Free-form tag (repeatable), stored exactly as typed and never checked against anything. ' +
-    'NOT a label: to classify the task under a declared label (`labels list`), use --label.';
+    'NOT a label: to classify the task under a declared label (`labels list`), use --label-id ' +
+    '(it takes a label name or id).';
 /**
  * The `--tag` values that equal a declared label's name, each paired with that
  * label — the one case where the mistake is certain enough to say so.
@@ -221,7 +222,10 @@ function describeTagsNamingLabels(hits) {
     if (hits.length === 0)
         return '';
     const names = hits.map((hit) => `"${hit.tag}"`).join(', ');
-    const flags = hits.map((hit) => `--label ${hit.label.name}`).join(' ');
+    // `--label-id` is the flag the help LISTS; `--label` is a hidden alias of it,
+    // so a warning that named the alias sent people to a flag they could not
+    // find in `--help` (OSK-12166).
+    const flags = hits.map((hit) => `--label-id ${hit.label.name}`).join(' ');
     return (`--tag ${names} ${hits.length === 1 ? 'was' : 'were'} stored as free-form ` +
         `${hits.length === 1 ? 'tag' : 'tags'}, NOT as the declared label of the same name, ` +
         `so a label filter will not find this task. To attach the label, pass ${flags}.`);

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/credentialEnvelopeBridge.d.ts

@@ -141,7 +141,19 @@ export interface ReadTransformResult {
      *  path is active — caller should re-write to upgrade. */
     needsMigration: boolean;
 }
-export declare function maybeDecryptOnRead(stored: string): ReadTransformResult;
+/** What the caller knows about the stored value that the envelope does not. */
+export interface DecryptOnReadOptions {
+    /**
+     * Replaces the default `decrypt_failed` hint. The default says a re-login
+     * rebuilds the credential, which is true only of THIS config's own value. A
+     * caller reading a value another config sealed under its own key knows the
+     * failure is expected and a re-login here changes nothing (OSK-12135).
+     */
+    unreadableHint?: string;
+}
+/** The `decrypt_failed` hint when the caller has no better explanation. */
+export declare const DEFAULT_UNREADABLE_CREDENTIAL_HINT = "stored credential is unreadable on this machine \u2014 signing in again rebuilds it";
+export declare function maybeDecryptOnRead(stored: string, options?: DecryptOnReadOptions): ReadTransformResult;
 /** @internal Test seam — wrapped-DEK path resolver. */
 export declare function __wrappedDekFilePathForTest(profile: string): string;
 export {};

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/credentialEnvelopeBridge.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_UNREADABLE_CREDENTIAL_HINT = void 0;
 exports.__setStateForTest = __setStateForTest;
 exports.__getStateForTest = __getStateForTest;
 exports.__clearWarnDedupeForTest = __clearWarnDedupeForTest;
@@ -165,7 +166,10 @@ function emit(eventName, success, metadata) {
         metadata: { event: eventName, ...metadata },
     });
     if (!success) {
-        const signature = `${eventName}:${metadata.kekId ?? ''}:${metadata.kekKind ?? ''}:${metadata.message ?? ''}`;
+        // The hint is part of the signature: the same crypto failure on this
+        // config's own credential and on another config's is two different facts,
+        // and the second must not swallow the first (OSK-12135).
+        const signature = `${eventName}:${metadata.kekId ?? ''}:${metadata.kekKind ?? ''}:${metadata.message ?? ''}:${metadata.hint ?? ''}`;
         if (!warnedSignatures.has(signature)) {
             if (warnedSignatures.size >= MAX_WARNED_SIGNATURES)
                 warnedSignatures.clear();
@@ -755,7 +759,9 @@ function wrapIfActiveOrPassthrough(plaintext) {
         return plaintext;
     }
 }
-function maybeDecryptOnRead(stored) {
+/** The `decrypt_failed` hint when the caller has no better explanation. */
+exports.DEFAULT_UNREADABLE_CREDENTIAL_HINT = 'stored credential is unreadable on this machine — signing in again rebuilds it';
+function maybeDecryptOnRead(stored, options = {}) {
     if (typeof stored !== 'string' || stored.length === 0) {
         return { plaintext: stored, needsMigration: false };
     }
@@ -787,7 +793,7 @@ function maybeDecryptOnRead(stored) {
                 // The crypto error alone reads as a crash; the actionable truth is
                 // that this stored credential is unreadable by THIS binary (usually
                 // a signing-identity or profile drift) and re-login rebuilds it.
-                hint: 'stored credential is unreadable on this machine — signing in again rebuilds it',
+                hint: options.unreadableHint ?? exports.DEFAULT_UNREADABLE_CREDENTIAL_HINT,
             });
             return { plaintext: null, needsMigration: false };
         }

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.d.ts

@@ -27,7 +27,7 @@ export { formatRecoveryCode, parseRecoveryCode, normalizeRecoveryCode, isValidRe
 export { buildCredentialAad, decrypt as credEnvelopeDecrypt, deserialize as credEnvelopeDeserialize, encrypt as credEnvelopeEncrypt, ENVELOPE_MAGIC as CRED_ENVELOPE_MAGIC, generateDek, isEnvelopeString as isCredEnvelopeString, KEY_LEN as CRED_KEY_LEN, openBuffer as credOpenBuffer, sealBuffer as credSealBuffer, serialize as credEnvelopeSerialize, unwrap as credEnvelopeUnwrap, wrap as credEnvelopeWrap, type SealedBlob as CredSealedBlob, } from './credentialEnvelope.js';
 export { __setKekStrategyForTest, getKekStrategy, InMemoryKek, UnavailableKek, KekUnavailableError, LinuxKek, MacosKek, registerZeroizeHook, WindowsKek, zeroizeKekCaches, type KekStrategy, } from './kek/index.js';
 export { buildProof as buildDeviceProof, generateDeviceKeyPair, jwkThumbprint, normalizeHtu, publicJwkFromX, tokenHash, verifyProof as verifyDeviceProof, type DeviceKeyPair, type DeviceProofClaims, type DeviceProofHeader, type Ed25519PrivateJwk, type Ed25519PublicJwk, type VerifyFailureReason as DeviceProofVerifyFailureReason, type VerifyFailure as DeviceProofVerifyFailure, type VerifyOptions as DeviceProofVerifyOptions, type VerifySuccess as DeviceProofVerifySuccess, } from './deviceKey.js';
-export { initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, maybeEncryptForWrite, maybeDecryptOnRead, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
+export { initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, type DecryptOnReadOptions, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
 export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
 export { getMachineUuid, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.js

@@ -24,9 +24,9 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.generateVerifier = exports.invalidateHeadersHelperCache = exports.runHeadersHelper = exports.SENTINEL_TRIGGERING_FAILURES = exports.__resetAuthHelperFailureReasonForTest = exports.getLastAuthHelperFailureReason = exports.getDefaultHelperTtlMs = exports.invokeAuthHelper = exports.AuthHelperUnavailableError = exports.AuthHelperUntrustedError = exports.CI_TOKEN_PREFIX = exports.classifyTokenKind = exports.invalidateAuthHelperCache = exports.__resetCredentialResolverForTest = exports.CREDENTIAL_PRECEDENCE = exports.CredentialResolver = exports.__setFdReaderForTest = exports.readAuthFromFd = exports.createRefreshScheduler = exports.UNKNOWN_401_BUDGET = exports.__resetUnknown401StreaksForTest = exports.__refreshDiagnostics = exports.installLockExitHandlers = exports.clearReauthState = exports.needsReauthState = exports.persistReauthState = exports.withAuthLock = exports.revokeDaemonRefreshSession = exports.refreshDaemonToken = exports.classifyRefreshResponse = exports.EXIT_NEEDS_REAUTH = exports.reauthCommand = exports.formatReauthMessage = exports.handleMidStreamAuthExpiry = exports.isAuthExpiredSseEvent = exports.decodeJwtPayload = exports.decodeJwtExpiry = exports.TransientAuthFailure = exports.PermanentAuthFailure = exports.emitAuthTelemetry = exports.getAuthBinaryName = exports.getAuthKillSwitches = exports.getAuthConfigDir = exports.getAuthLogger = exports.configureAuthCore = exports.OAUTH_CLI_SCOPE = exports.isDaemonScope = exports.VALID_DAEMON_SCOPE_SET = exports.ALL_DAEMON_SCOPES = exports.SCOPES = void 0;
 exports.publicJwkFromX = exports.normalizeHtu = exports.jwkThumbprint = exports.generateDeviceKeyPair = exports.buildDeviceProof = exports.zeroizeKekCaches = exports.WindowsKek = exports.registerZeroizeHook = exports.MacosKek = exports.LinuxKek = exports.KekUnavailableError = exports.UnavailableKek = exports.InMemoryKek = exports.getKekStrategy = exports.__setKekStrategyForTest = exports.credEnvelopeWrap = exports.credEnvelopeUnwrap = exports.credEnvelopeSerialize = exports.credSealBuffer = exports.credOpenBuffer = exports.CRED_KEY_LEN = exports.isCredEnvelopeString = exports.generateDek = exports.CRED_ENVELOPE_MAGIC = exports.credEnvelopeEncrypt = exports.credEnvelopeDeserialize = exports.credEnvelopeDecrypt = exports.buildCredentialAad = exports.isValidRecoveryCode = exports.normalizeRecoveryCode = exports.parseRecoveryCode = exports.formatRecoveryCode = exports.MAX_TTL_DAYS = exports.MIN_TTL_DAYS = exports.parseTtlDays = exports.LoginExchangeError = exports.LoginInitError = exports.loginWithLocalhost = exports.LocalCallbackMalformedError = exports.LocalCallbackDeniedError = exports.LocalCallbackStateMismatchError = exports.LocalCallbackTimeoutError = exports.LocalCallbackBindError = exports.LocalCallbackError = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.startLocalCallback = exports.verifyChallenge = exports.safeEqual = exports.generateState = exports.challenge = void 0;
-exports.parsePairBundle = exports.openPairBundleBase64 = exports.generatePairKeyPair = exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = exports.ensureMachineDaemonId = exports.__resetMachineUuidCacheForTest = exports.HOSTED_RUNTIME_MACHINE_SOURCES = exports.hostedRuntimeIdOverride = exports.getMachineUuid = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.describeCredEnvelopeState = exports.hasCredEnvelopePathConflict = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDeviceProof = exports.tokenHash = void 0;
-exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.resolveFirstPartyHarnessChannel = exports.resolveChannelManifestUrl = exports.isFirstPartyHarnessChannel = exports.firstPartyHarnessFeedCandidates = exports.firstPartyHarnessFeedBase = exports.firstPartyHarnessChannelPrefix = exports.FIRST_PARTY_HARNESS_CHANNELS = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.migrateFirstPartyHarnessHome = exports.linkFirstPartyHarnessAliases = exports.firstPartyHarnessInstalledBinaryPath = exports.firstPartyHarnessHomeDir = exports.firstPartyHarnessBinDir = exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.LOOPBACK_DEFAULT_MAX_BODY_BYTES = exports.LoopbackTargetRefusedError = exports.isLoopbackAddress = exports.isLoopbackHostname = exports.assertLoopbackHttpUrl = exports.loopbackFetch = exports.withLoopbackNoProxy = exports.envHasProxy = exports.LOOPBACK_NO_PROXY_HOSTS = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.harnessLoadsClaudeSkillsLayout = exports.claudeSkillsLayoutEvidence = exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = exports.getHarnessTier = exports.HARNESS_TIERS = exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = void 0;
-exports.consolidateProfileState = exports.profileStateFilePathsToClear = exports.profileStateFileLocations = exports.resolveProfileStateFile = exports.resolveProfileStateDir = exports.legacyProfileStateDir = exports.profileStateDir = exports.SUPERSEDED_COPY_SUFFIX = exports.SUPERSEDED_MARKER_SUFFIX = exports.PROFILES_SEGMENT = exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.isTrustedArtifactOrigin = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.TRUSTED_FEED_ORIGINS = void 0;
+exports.openPairBundleBase64 = exports.generatePairKeyPair = exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = exports.ensureMachineDaemonId = exports.__resetMachineUuidCacheForTest = exports.HOSTED_RUNTIME_MACHINE_SOURCES = exports.hostedRuntimeIdOverride = exports.getMachineUuid = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.DEFAULT_UNREADABLE_CREDENTIAL_HINT = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.describeCredEnvelopeState = exports.hasCredEnvelopePathConflict = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDeviceProof = exports.tokenHash = void 0;
+exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.resolveFirstPartyHarnessChannel = exports.resolveChannelManifestUrl = exports.isFirstPartyHarnessChannel = exports.firstPartyHarnessFeedCandidates = exports.firstPartyHarnessFeedBase = exports.firstPartyHarnessChannelPrefix = exports.FIRST_PARTY_HARNESS_CHANNELS = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.migrateFirstPartyHarnessHome = exports.linkFirstPartyHarnessAliases = exports.firstPartyHarnessInstalledBinaryPath = exports.firstPartyHarnessHomeDir = exports.firstPartyHarnessBinDir = exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.LOOPBACK_DEFAULT_MAX_BODY_BYTES = exports.LoopbackTargetRefusedError = exports.isLoopbackAddress = exports.isLoopbackHostname = exports.assertLoopbackHttpUrl = exports.loopbackFetch = exports.withLoopbackNoProxy = exports.envHasProxy = exports.LOOPBACK_NO_PROXY_HOSTS = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.harnessLoadsClaudeSkillsLayout = exports.claudeSkillsLayoutEvidence = exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = exports.getHarnessTier = exports.HARNESS_TIERS = exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = exports.parsePairBundle = void 0;
+exports.consolidateProfileState = exports.profileStateFilePathsToClear = exports.profileStateFileLocations = exports.resolveProfileStateFile = exports.resolveProfileStateDir = exports.legacyProfileStateDir = exports.profileStateDir = exports.SUPERSEDED_COPY_SUFFIX = exports.SUPERSEDED_MARKER_SUFFIX = exports.PROFILES_SEGMENT = exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.isTrustedArtifactOrigin = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.TRUSTED_FEED_ORIGINS = exports.MAX_SIGS = void 0;
 // Daemon scope vocabulary — single source of truth for non-Mongoose tiers
 // (daemon, desktop, cli). Schema-bound canonical lives in
 // `@skrr-ai/data-schemas/common/daemonScopes`; the two are kept byte-equal
@@ -234,6 +234,7 @@ Object.defineProperty(exports, "hasCredEnvelopePathConflict", { enumerable: true
 Object.defineProperty(exports, "describeCredEnvelopeState", { enumerable: true, get: function () { return credentialEnvelopeBridge_js_1.describeCredEnvelopeState; } });
 Object.defineProperty(exports, "maybeEncryptForWrite", { enumerable: true, get: function () { return credentialEnvelopeBridge_js_1.maybeEncryptForWrite; } });
 Object.defineProperty(exports, "maybeDecryptOnRead", { enumerable: true, get: function () { return credentialEnvelopeBridge_js_1.maybeDecryptOnRead; } });
+Object.defineProperty(exports, "DEFAULT_UNREADABLE_CREDENTIAL_HINT", { enumerable: true, get: function () { return credentialEnvelopeBridge_js_1.DEFAULT_UNREADABLE_CREDENTIAL_HINT; } });
 // Test seams — `__`-prefixed so consumers don't import them in
 // production code paths. Re-exported here so CLI/daemon spec files
 // can resolve the wrapped-DEK path against the same module instance.

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/credentialEnvelopeBridge.d.ts

@@ -141,7 +141,19 @@ export interface ReadTransformResult {
      *  path is active — caller should re-write to upgrade. */
     needsMigration: boolean;
 }
-export declare function maybeDecryptOnRead(stored: string): ReadTransformResult;
+/** What the caller knows about the stored value that the envelope does not. */
+export interface DecryptOnReadOptions {
+    /**
+     * Replaces the default `decrypt_failed` hint. The default says a re-login
+     * rebuilds the credential, which is true only of THIS config's own value. A
+     * caller reading a value another config sealed under its own key knows the
+     * failure is expected and a re-login here changes nothing (OSK-12135).
+     */
+    unreadableHint?: string;
+}
+/** The `decrypt_failed` hint when the caller has no better explanation. */
+export declare const DEFAULT_UNREADABLE_CREDENTIAL_HINT = "stored credential is unreadable on this machine \u2014 signing in again rebuilds it";
+export declare function maybeDecryptOnRead(stored: string, options?: DecryptOnReadOptions): ReadTransformResult;
 /** @internal Test seam — wrapped-DEK path resolver. */
 export declare function __wrappedDekFilePathForTest(profile: string): string;
 export {};

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/credentialEnvelopeBridge.js

@@ -146,7 +146,10 @@ function emit(eventName, success, metadata) {
         metadata: { event: eventName, ...metadata },
     });
     if (!success) {
-        const signature = `${eventName}:${metadata.kekId ?? ''}:${metadata.kekKind ?? ''}:${metadata.message ?? ''}`;
+        // The hint is part of the signature: the same crypto failure on this
+        // config's own credential and on another config's is two different facts,
+        // and the second must not swallow the first (OSK-12135).
+        const signature = `${eventName}:${metadata.kekId ?? ''}:${metadata.kekKind ?? ''}:${metadata.message ?? ''}:${metadata.hint ?? ''}`;
         if (!warnedSignatures.has(signature)) {
             if (warnedSignatures.size >= MAX_WARNED_SIGNATURES)
                 warnedSignatures.clear();
@@ -736,7 +739,9 @@ export function wrapIfActiveOrPassthrough(plaintext) {
         return plaintext;
     }
 }
-export function maybeDecryptOnRead(stored) {
+/** The `decrypt_failed` hint when the caller has no better explanation. */
+export const DEFAULT_UNREADABLE_CREDENTIAL_HINT = 'stored credential is unreadable on this machine — signing in again rebuilds it';
+export function maybeDecryptOnRead(stored, options = {}) {
     if (typeof stored !== 'string' || stored.length === 0) {
         return { plaintext: stored, needsMigration: false };
     }
@@ -768,7 +773,7 @@ export function maybeDecryptOnRead(stored) {
                 // The crypto error alone reads as a crash; the actionable truth is
                 // that this stored credential is unreadable by THIS binary (usually
                 // a signing-identity or profile drift) and re-login rebuilds it.
-                hint: 'stored credential is unreadable on this machine — signing in again rebuilds it',
+                hint: options.unreadableHint ?? DEFAULT_UNREADABLE_CREDENTIAL_HINT,
             });
             return { plaintext: null, needsMigration: false };
         }

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.d.ts

@@ -27,7 +27,7 @@ export { formatRecoveryCode, parseRecoveryCode, normalizeRecoveryCode, isValidRe
 export { buildCredentialAad, decrypt as credEnvelopeDecrypt, deserialize as credEnvelopeDeserialize, encrypt as credEnvelopeEncrypt, ENVELOPE_MAGIC as CRED_ENVELOPE_MAGIC, generateDek, isEnvelopeString as isCredEnvelopeString, KEY_LEN as CRED_KEY_LEN, openBuffer as credOpenBuffer, sealBuffer as credSealBuffer, serialize as credEnvelopeSerialize, unwrap as credEnvelopeUnwrap, wrap as credEnvelopeWrap, type SealedBlob as CredSealedBlob, } from './credentialEnvelope.js';
 export { __setKekStrategyForTest, getKekStrategy, InMemoryKek, UnavailableKek, KekUnavailableError, LinuxKek, MacosKek, registerZeroizeHook, WindowsKek, zeroizeKekCaches, type KekStrategy, } from './kek/index.js';
 export { buildProof as buildDeviceProof, generateDeviceKeyPair, jwkThumbprint, normalizeHtu, publicJwkFromX, tokenHash, verifyProof as verifyDeviceProof, type DeviceKeyPair, type DeviceProofClaims, type DeviceProofHeader, type Ed25519PrivateJwk, type Ed25519PublicJwk, type VerifyFailureReason as DeviceProofVerifyFailureReason, type VerifyFailure as DeviceProofVerifyFailure, type VerifyOptions as DeviceProofVerifyOptions, type VerifySuccess as DeviceProofVerifySuccess, } from './deviceKey.js';
-export { initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, maybeEncryptForWrite, maybeDecryptOnRead, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
+export { initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, type DecryptOnReadOptions, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
 export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
 export { getMachineUuid, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.js

@@ -108,7 +108,7 @@ export { buildProof as buildDeviceProof, generateDeviceKeyPair, jwkThumbprint, n
 // Daemon and CLI consume these; the underlying primitives live above.
 export { 
 // credEnvelope bridge
-initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, maybeEncryptForWrite, maybeDecryptOnRead, 
+initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, 
 // Test seams — `__`-prefixed so consumers don't import them in
 // production code paths. Re-exported here so CLI/daemon spec files
 // can resolve the wrapped-DEK path against the same module instance.

package/dist/node_modules/@skrr-ai/auth-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skrr-ai/auth-core",
-  "version": "0.4.5",
+  "version": "0.4.6",
   "main": "dist/cjs/index.js",
   "types": "dist/esm/index.d.ts",
   "exports": {