@skrr-ai/cli 0.1.53 → 0.1.55

package/dist/commands/tasks/approvals/list.d.ts

@@ -30,10 +30,46 @@ export declare function approvalRow(a: Record<string, unknown>): {
  * on an older run that a later run got past is history, not the current state.
  */
 export declare function permissionBlockedRun(runs: Array<Record<string, unknown>>): Record<string, unknown> | null;
+/** One refused call: the tool and its input, as the run recorded them. */
+export type PermissionRefusal = {
+    tool: string | null;
+    input: string;
+};
+/** One way forward, as a command a person or a script can run. */
+export type PermissionBlockRemedy = {
+    action: 'run_interactively' | 'allow_unattended' | 'restart';
+    command: string;
+    description: string;
+};
+/**
+ * The structured answer `--json` carries as `blockedRun` (OSK-12173). Before
+ * this the explanation existed only as prose, and with `--json` only on
+ * stderr, so a script reading the JSON saw `{"data":[]}` and nothing to act on.
+ */
+export type BlockedRunSummary = {
+    runId: string;
+    failureCode: string;
+    /** The cause, from the run's own sentence, without its generic remedy. */
+    reason: string | null;
+    agentId: string | null;
+    /**
+     * The refused calls with their inputs. Empty when the run recorded none
+     * (runs finalized before the server kept them, or evidence without an input
+     * preview). Never inferred.
+     */
+    refused: PermissionRefusal[];
+    remedies: PermissionBlockRemedy[];
+};
+/**
+ * The block as data: which run, why, what was refused, and the ways forward
+ * with the agent id filled in (`<agent>` only when the run recorded no agent).
+ */
+export declare function blockedRunSummary(run: Record<string, unknown>, bin?: string, taskRef?: string): BlockedRunSummary;
 /**
  * What to print for such a run: why it is blocked, what needed approval (the
- * run's own recorded sentence, which names the refused tool), that an
- * unattended run cannot prompt, and the two ways forward with exact commands.
+ * run's own sentence, plus each refused input it recorded), that an unattended
+ * run cannot prompt, and the ways forward, each stated once with the real
+ * agent id.
  */
 export declare function permissionBlockLines(run: Record<string, unknown>, bin?: string, taskRef?: string): string[];
 export default class TasksApprovalsList extends BaseCommand {

package/dist/commands/tasks/approvals/list.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.approvalRow = approvalRow;
 exports.permissionBlockedRun = permissionBlockedRun;
+exports.blockedRunSummary = blockedRunSummary;
 exports.permissionBlockLines = permissionBlockLines;
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
@@ -46,28 +47,107 @@ function permissionBlockedRun(runs) {
     const code = latest.failureCode ?? latest.failureClass;
     return code === data_provider_1.PERMISSION_BLOCKED_FAILURE_CODE ? latest : null;
 }
+/**
+ * Where the run's own fix begins in its recorded sentence.
+ *
+ * The server writes `failureReason` as the cause followed by the fix
+ * (`permissionBlockedRun.PERMISSION_BLOCK_GUIDANCE`), and that fix names the
+ * agent only as `<agent>` because the sentence is shared by every surface.
+ * This command knows the agent, so it states the fix itself, with the real id,
+ * and keeps only the cause from the sentence (OSK-12173): printing both showed
+ * the remedy twice, once with a placeholder.
+ */
+const RECORDED_REMEDY_MARKER = 'Re-running will be refused';
+function refusalsOf(run) {
+    const raw = run.permissionRefusals;
+    if (!Array.isArray(raw))
+        return [];
+    const out = [];
+    for (const entry of raw) {
+        if (!entry || typeof entry !== 'object')
+            continue;
+        const { tool, input } = entry;
+        if (typeof input !== 'string' || !input.trim())
+            continue;
+        out.push({ tool: typeof tool === 'string' && tool ? tool : null, input: input.trim() });
+    }
+    return out;
+}
+/** The cause, cut before the recorded remedy; `<agent>` filled in if any survives. */
+function blockReason(run, agentId) {
+    const full = typeof run.failureReason === 'string' ? run.failureReason.trim() : '';
+    if (!full)
+        return null;
+    const at = full.indexOf(RECORDED_REMEDY_MARKER);
+    const cause = at > 0 ? full.slice(0, at).trim() : full;
+    return agentId ? cause.split('<agent>').join(agentId) : cause;
+}
+/**
+ * The block as data: which run, why, what was refused, and the ways forward
+ * with the agent id filled in (`<agent>` only when the run recorded no agent).
+ */
+function blockedRunSummary(run, bin = 'skrr', taskRef = '<task-id>') {
+    const executor = run.executor;
+    const agentId = executor && typeof executor.agentId === 'string' && executor.agentId ? executor.agentId : null;
+    const agent = agentId ?? '<agent>';
+    const code = run.failureCode ?? run.failureClass;
+    return {
+        runId: String(run.runId ?? run.id ?? '-'),
+        failureCode: typeof code === 'string' ? code : data_provider_1.PERMISSION_BLOCKED_FAILURE_CODE,
+        reason: blockReason(run, agentId),
+        agentId,
+        refused: refusalsOf(run),
+        remedies: [
+            {
+                action: 'run_interactively',
+                command: `${bin} agents chat ${agent} --approve-tools --prompt "..."`,
+                description: 'Do the work interactively, approving each call.',
+            },
+            {
+                action: 'allow_unattended',
+                command: `${bin} agents update ${agent} --default-permission-mode bypassPermissions`,
+                description: 'Let unattended runs use the tool without asking.',
+            },
+            {
+                action: 'restart',
+                command: `${bin} tasks start ${taskRef}`,
+                description: 'Start the task again once its agent may use the tool (or pick an agent/harness whose mode allows it).',
+            },
+        ],
+    };
+}
+const SHELL_TOOL = /^(bash|shell|local_shell|exec_command|commandexecution|command_execution)$/i;
+function toolLabel(tool) {
+    if (!tool)
+        return '';
+    return SHELL_TOOL.test(tool) ? ' (shell)' : ` (${tool})`;
+}
 /**
  * What to print for such a run: why it is blocked, what needed approval (the
- * run's own recorded sentence, which names the refused tool), that an
- * unattended run cannot prompt, and the two ways forward with exact commands.
+ * run's own sentence, plus each refused input it recorded), that an unattended
+ * run cannot prompt, and the ways forward, each stated once with the real
+ * agent id.
  */
 function permissionBlockLines(run, bin = 'skrr', taskRef = '<task-id>') {
-    const runId = String(run.runId ?? run.id ?? '-');
-    const reason = typeof run.failureReason === 'string' ? run.failureReason.trim() : '';
-    const executor = run.executor;
-    const agent = executor && typeof executor.agentId === 'string' && executor.agentId
-        ? executor.agentId
-        : '<agent>';
+    const summary = blockedRunSummary(run, bin, taskRef);
+    const reason = summary.reason ?? '';
+    // The sentence already quotes a lone refused input (shortened); list an
+    // input only when the sentence does not already show it.
+    const refusedLines = summary.refused
+        .filter((refusal) => !reason.includes(refusal.input.slice(0, 60)))
+        .map((refusal) => `  Refused: ${refusal.input}${toolLabel(refusal.tool)}`);
+    const [chat, update, restart] = summary.remedies;
     return [
-        `The latest run (${runId}) is blocked on a permission, not on an approval request.`,
+        `The latest run (${summary.runId}) is blocked on a permission, not on an approval request.`,
         ...(reason ? [`  ${reason}`] : []),
+        ...refusedLines,
         'It ran unattended (`tasks start`), and an unattended run cannot prompt anyone to approve a',
         'tool call, so the ask was refused on the spot and no approval request was recorded here.',
         '',
         'To continue, either:',
-        `  ${bin} agents chat ${agent} --approve-tools --prompt "..."   do the work interactively, approving each call`,
-        `  ${bin} agents update ${agent} --default-permission-mode bypassPermissions   let unattended runs use the tool`,
-        `  then: ${bin} tasks start ${taskRef}   (or pick an agent/harness whose mode allows it)`,
+        `  ${chat.command}   do the work interactively, approving each call`,
+        `  ${update.command}   let unattended runs use the tool`,
+        `  then: ${restart.command}   (or pick an agent/harness whose mode allows it)`,
     ];
 }
 class TasksApprovalsList extends base_command_1.BaseCommand {
@@ -98,25 +178,37 @@ class TasksApprovalsList extends base_command_1.BaseCommand {
         // row, so the empty list alone would say "nothing to act on" about a task
         // that is waiting on exactly that. Read the latest run, best-effort: the
         // approvals list is still the answer if the runs read fails.
+        // `runsRead` separates "the latest run is not blocked" from "we could not
+        // look": only the first may be reported to a script as `blockedRun: null`.
         let blockedRun = null;
+        let runsRead = false;
         try {
             const runs = (await data_provider_1.dataService.getTaskRuns(args.id));
             blockedRun = permissionBlockedRun(runs?.data ?? []);
+            runsRead = true;
         }
         catch {
             blockedRun = null;
         }
-        const blockLines = blockedRun ? permissionBlockLines(blockedRun, this.config.bin, args.id) : [];
         if (flags.json) {
-            // The server payload stays byte-identical; the pointer goes to stderr so
-            // `--json` remains parseable and a script still learns the task is stuck.
-            if (blockedRun) {
-                this.warn(`The latest run is blocked on a permission an unattended run could not ask for; ` +
-                    `\`${this.config.bin} tasks approvals list ${args.id}\` (without --json) says what to do.`);
-            }
-            this.log(JSON.stringify(response, null, 2));
+            // OSK-12173 — the server payload is kept as it was (`data` unchanged)
+            // and the block is added beside it as data a script can act on:
+            // `blockedRun` is the summary, or null when the latest run is not
+            // blocked. It is omitted when the runs could not be read, because null
+            // would claim a state nobody checked.
+            const payload = response && typeof response === 'object' && !Array.isArray(response)
+                ? response
+                : { data: items };
+            const out = runsRead
+                ? {
+                    ...payload,
+                    blockedRun: blockedRun ? blockedRunSummary(blockedRun, this.config.bin, args.id) : null,
+                }
+                : payload;
+            this.log(JSON.stringify(out, null, 2));
             return;
         }
+        const blockLines = blockedRun ? permissionBlockLines(blockedRun, this.config.bin, args.id) : [];
         if (items.length === 0) {
             this.log('No approval requests.');
             if (blockLines.length > 0) {

package/dist/lib/auth-core-init.d.ts

@@ -1,3 +1,22 @@
+/**
+ * A credential-envelope failure that carries a hint, as ONE plain line
+ * (OSK-12180) — or null when the warning is anything else.
+ *
+ * An unreadable stored credential is reported on every command until someone
+ * signs in again, and auth-core's structured form is six lines of object dump
+ * ending in the raw CryptoKit/OpenSSL string (`Unsupported state or unable to
+ * authenticate data`). The person reading it needs the hint auth-core already
+ * wrote for exactly this, and what to do; the key id and the crypto message are
+ * for whoever is debugging, which is what `DEBUG` is for everywhere else in
+ * this logger. The daemon logs through its own logger and keeps the structured
+ * record.
+ *
+ * The remedy is added only to the DEFAULT hint, which is about this config's
+ * own credential. A caller that supplied its own hint knows the case better —
+ * another config's credential is not fixed by `skrr login` here, and its hint
+ * says so (OSK-12135).
+ */
+export declare function plainCredentialEnvelopeWarning(args: readonly unknown[]): string | null;
 type DedicatedGenerationPreparationOptions = {
     machineUuid?: string;
     configDir?: string;

package/dist/lib/auth-core-init.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CliCredentialInitializationError = void 0;
+exports.plainCredentialEnvelopeWarning = plainCredentialEnvelopeWarning;
 exports.prepareDedicatedRuntimeAuthGeneration = prepareDedicatedRuntimeAuthGeneration;
 exports.ensureAuthCoreConfigured = ensureAuthCoreConfigured;
 exports.prefetchCliAuth = prefetchCliAuth;
@@ -44,6 +45,36 @@ function envFlag(name) {
     const v = process.env[name];
     return v === '1' || v === 'true' || v === 'TRUE';
 }
+/**
+ * A credential-envelope failure that carries a hint, as ONE plain line
+ * (OSK-12180) — or null when the warning is anything else.
+ *
+ * An unreadable stored credential is reported on every command until someone
+ * signs in again, and auth-core's structured form is six lines of object dump
+ * ending in the raw CryptoKit/OpenSSL string (`Unsupported state or unable to
+ * authenticate data`). The person reading it needs the hint auth-core already
+ * wrote for exactly this, and what to do; the key id and the crypto message are
+ * for whoever is debugging, which is what `DEBUG` is for everywhere else in
+ * this logger. The daemon logs through its own logger and keeps the structured
+ * record.
+ *
+ * The remedy is added only to the DEFAULT hint, which is about this config's
+ * own credential. A caller that supplied its own hint knows the case better —
+ * another config's credential is not fixed by `skrr login` here, and its hint
+ * says so (OSK-12135).
+ */
+function plainCredentialEnvelopeWarning(args) {
+    const [message, metadata] = args;
+    if (typeof message !== 'string' || !message.startsWith('[credEnvelope] '))
+        return null;
+    if (!metadata || typeof metadata !== 'object')
+        return null;
+    const hint = metadata.hint;
+    if (typeof hint !== 'string' || !hint.trim())
+        return null;
+    const remedy = hint === auth_core_1.DEFAULT_UNREADABLE_CREDENTIAL_HINT ? ' Run `skrr login`.' : '';
+    return `warning: ${hint.trim()}.${remedy} (DEBUG=1 shows the underlying error.)`;
+}
 const cliLogger = {
     // The CLI is a short-lived foreground process. Trace/debug get dropped
     // unless DEBUG is set so we don't spam terminal output.
@@ -55,7 +86,13 @@ const cliLogger = {
         if (process.env.DEBUG)
             console.error('[auth-core info]', ...args);
     },
-    warn: (...args) => console.error('[auth-core warn]', ...args),
+    warn: (...args) => {
+        const plain = process.env.DEBUG ? null : plainCredentialEnvelopeWarning(args);
+        if (plain)
+            console.error(plain);
+        else
+            console.error('[auth-core warn]', ...args);
+    },
     error: (...args) => console.error('[auth-core error]', ...args),
 };
 /**

package/dist/lib/cli-identity.js

@@ -74,7 +74,6 @@ const path = __importStar(require("node:path"));
 const auth_storage_1 = require("./auth-storage");
 const config_1 = require("./config");
 const cli_id_1 = require("./cli-id");
-const device_id_1 = require("./device-id");
 const keychain_1 = require("./keychain");
 /**
  * A named profile's own identity. Deterministic in (host, user, config root,
@@ -127,7 +126,7 @@ function planLoginCliId(cfg, deps = {}) {
     const machine = cfg.cliId?.trim();
     if (machine)
         return { cliId: machine, source: 'machine' };
-    const cliId = (0, device_id_1.generateCliId)();
+    const cliId = (0, config_1.machineCliId)();
     return { cliId, source: 'machine', updatedConfig: { ...cfg, cliId } };
 }
 /**

package/dist/lib/config.d.ts

@@ -190,6 +190,16 @@ export declare function isEnvAuthOverride(): boolean;
  * resolver and every existing install read it.
  */
 export declare function configRoot(env?: NodeJS.ProcessEnv): string;
+/**
+ * The machine cliId THIS config root mints when it has none stored
+ * (OSK-12179). The primary root keeps the historical (host, user) id; any other
+ * root gets one of its own, so two roots of one user are two server-side
+ * families and one root's hand-off confirm cannot retire the other's session.
+ *
+ * Mints nothing and reads nothing stored: callers persist it (`cli-identity.ts`)
+ * or present it only when nothing is stored (the daemon broker).
+ */
+export declare function machineCliId(): string;
 /**
  * The PRE-RENAME config root — the generation between `.sky` and `.skrr`.
  *

package/dist/lib/config.js

@@ -39,6 +39,7 @@ exports.describeDeployment = describeDeployment;
 exports.canonicalizeKnownBaseURL = canonicalizeKnownBaseURL;
 exports.isEnvAuthOverride = isEnvAuthOverride;
 exports.configRoot = configRoot;
+exports.machineCliId = machineCliId;
 exports.priorConfigDir = priorConfigDir;
 exports.loadConfig = loadConfig;
 exports.saveConfig = saveConfig;
@@ -54,6 +55,7 @@ const path = __importStar(require("node:path"));
 const keychain_1 = require("./keychain");
 const auth_core_1 = require("@skrr-ai/auth-core");
 const cli_id_1 = require("./cli-id");
+const device_id_1 = require("./device-id");
 const publicEndpoints_generated_1 = require("./publicEndpoints.generated");
 // Both from config/public-endpoints.json, the one domain contract, rather than a
 // fourth hand-copied pair. The CLI previously knew only about dev — there was no
@@ -269,6 +271,26 @@ function configRoot(env = process.env) {
 function newConfigDir() {
     return configRoot();
 }
+/** The root this machine uses when nothing relocates it (`~/.skrr`). */
+function defaultConfigRoot() {
+    return (0, auth_core_1.resolveConfigRoot)({});
+}
+/** Is this process on the primary root, however it was reached? */
+function isDefaultConfigRoot() {
+    return path.resolve(configRoot()) === path.resolve(defaultConfigRoot());
+}
+/**
+ * The machine cliId THIS config root mints when it has none stored
+ * (OSK-12179). The primary root keeps the historical (host, user) id; any other
+ * root gets one of its own, so two roots of one user are two server-side
+ * families and one root's hand-off confirm cannot retire the other's session.
+ *
+ * Mints nothing and reads nothing stored: callers persist it (`cli-identity.ts`)
+ * or present it only when nothing is stored (the daemon broker).
+ */
+function machineCliId() {
+    return (0, device_id_1.machineCliIdForRoot)(configRoot(), defaultConfigRoot());
+}
 /**
  * Fields that belong to the MACHINE, not to a profile.
  *
@@ -472,6 +494,13 @@ function loadConfig() {
             if (!fs.existsSync(carriedPath))
                 continue;
             const carried = migrateLegacyBaseURL(readJsonOrThrow(carriedPath));
+            // The ancestor lives under $HOME whatever root this is, so its `cliId`
+            // belongs to the PRIMARY root's sessions. A relocated root that adopted
+            // it would present the primary root's identity, and a hand-off confirm
+            // there retires the primary root's families (OSK-12179). It mints its own
+            // at first login instead (`machineCliId`).
+            if (!isDefaultConfigRoot())
+                delete carried.cliId;
             try {
                 saveConfig(carried);
             }

package/dist/lib/device-id.d.ts

@@ -12,3 +12,26 @@
  * 128-char + printable-ASCII guard.
  */
 export declare function generateCliId(): string;
+/**
+ * The machine cliId for ONE config root (OSK-12179).
+ *
+ * `generateCliId()` hashes only (host, user), so every root on the machine got
+ * the same id: a fresh `SKRR_CONFIG_DIR` root's default profile minted exactly
+ * the id the real `~/.skrr` root had been presenting. The server's
+ * `cli-handoff/confirm` retires every OTHER live family of (user, cliId), so a
+ * sign-in in the second root could end the first root's session. The Keychain
+ * slots were already separated by root (OSK-12135), and a named profile's own
+ * id already hashes its root (`profileScopedCliId`); this was the one identity
+ * that did not.
+ *
+ * The DEFAULT root keeps `generateCliId()` byte for byte. Every install already
+ * stores or re-derives that value, every live session is bound to it, and a
+ * refresh presenting another id is refused — so changing it would sign the
+ * primary root out. Only a root somewhere else gets its own id, deterministic in
+ * (host, user, root) so a root that loses its config file and signs in again
+ * presents the same id rather than scattering families.
+ *
+ * A root is the default one when it resolves to the default path, however it
+ * was reached: `SKRR_CONFIG_DIR=~/.skrr` is the primary root, not a second one.
+ */
+export declare function machineCliIdForRoot(root: string, defaultRoot: string): string;

package/dist/lib/device-id.js

@@ -1,11 +1,46 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.generateCliId = generateCliId;
+exports.machineCliIdForRoot = machineCliIdForRoot;
 const node_crypto_1 = require("node:crypto");
 const node_os_1 = __importDefault(require("node:os"));
+const path = __importStar(require("node:path"));
 /**
  * Derive a stable per-machine identifier the server will treat as a
  * "device" for the device-code flow. Mirrors the daemon's `generateDaemonId`
@@ -25,3 +60,36 @@ function generateCliId() {
     const digest = (0, node_crypto_1.createHash)('sha256').update(`${hostname}|${username}|cli`).digest('hex');
     return `cli_${digest.slice(0, 12)}`;
 }
+/**
+ * The machine cliId for ONE config root (OSK-12179).
+ *
+ * `generateCliId()` hashes only (host, user), so every root on the machine got
+ * the same id: a fresh `SKRR_CONFIG_DIR` root's default profile minted exactly
+ * the id the real `~/.skrr` root had been presenting. The server's
+ * `cli-handoff/confirm` retires every OTHER live family of (user, cliId), so a
+ * sign-in in the second root could end the first root's session. The Keychain
+ * slots were already separated by root (OSK-12135), and a named profile's own
+ * id already hashes its root (`profileScopedCliId`); this was the one identity
+ * that did not.
+ *
+ * The DEFAULT root keeps `generateCliId()` byte for byte. Every install already
+ * stores or re-derives that value, every live session is bound to it, and a
+ * refresh presenting another id is refused — so changing it would sign the
+ * primary root out. Only a root somewhere else gets its own id, deterministic in
+ * (host, user, root) so a root that loses its config file and signs in again
+ * presents the same id rather than scattering families.
+ *
+ * A root is the default one when it resolves to the default path, however it
+ * was reached: `SKRR_CONFIG_DIR=~/.skrr` is the primary root, not a second one.
+ */
+function machineCliIdForRoot(root, defaultRoot) {
+    const resolved = path.resolve(root);
+    if (resolved === path.resolve(defaultRoot))
+        return generateCliId();
+    const hostname = node_os_1.default.hostname();
+    const username = node_os_1.default.userInfo().username || 'unknown';
+    const digest = (0, node_crypto_1.createHash)('sha256')
+        .update(`${hostname}|${username}|cli|root:${resolved}`)
+        .digest('hex');
+    return `cli_${digest.slice(0, 12)}`;
+}

package/dist/lib/first-party-harness-broker.js

@@ -75,7 +75,6 @@ const auth_core_init_1 = require("./auth-core-init");
 const config_1 = require("./config");
 const cli_id_1 = require("./cli-id");
 const cred_envelope_1 = require("./cred-envelope");
-const device_id_1 = require("./device-id");
 const first_party_harness_1 = require("./first-party-harness");
 const first_party_harness_agent_1 = require("./first-party-harness-agent");
 const first_party_harness_managed_1 = require("./first-party-harness-managed");
@@ -862,8 +861,9 @@ function hasLocalCredential() {
  *
  * The id login and refresh present, read through `resolveCliId` (a named
  * profile may have its own, OSK-12156); regenerated deterministically as the
- * machine id when nothing is stored (same hostname+user always yields the same
- * value). Normalized to the `cli_` namespace the server requires,
+ * machine id of THIS config root when nothing is stored (the same host, user
+ * and root always yield the same value; a relocated root does not share the
+ * primary root's id, OSK-12179). Normalized to the `cli_` namespace the server requires,
  * because `OVERSKY_CLI_ID` is overlaid verbatim with no format check and a
  * hand-set value would otherwise come back as an opaque
  * `runtime-id-namespace-mismatch`.
@@ -879,7 +879,7 @@ function localRuntimeId() {
     })();
     if (configured?.startsWith('cli_'))
         return configured;
-    return (0, device_id_1.generateCliId)();
+    return (0, config_1.machineCliId)();
 }
 function errorCodeOf(err) {
     const code = err?.code;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/credentialEnvelopeBridge.js

@@ -329,14 +329,18 @@ async function consolidateWrappedDek(profile, kek, aad) {
     };
     // The paths go in the MESSAGE, not only the metadata: a log pipeline that
     // drops structured fields would otherwise render this as an unactionable
-    // noun. Naming the remedy matters too — logging out on one side deletes that
-    // side's key and lets the next start adopt the other.
+    // noun. Naming the remedy matters too, and it has to be one that converges
+    // (OSK-12172). Only the CLI's logout deletes a key, and only the canonical
+    // one; a daemon logout deletes neither. So the CLI logs out, the daemon
+    // BINARY restarts and adopts its legacy key into the empty canonical slot,
+    // and the CLI logs back in on it. Not `skrr daemon restart`: any `skrr`
+    // command mints a fresh key into an empty slot before doing anything else.
     (0, runtime_js_1.getAuthLogger)().warn(`[credEnvelope] profile "${profile}" has two different usable wrapped DEKs; ` +
         `refusing to choose. Keeping ${_pathConflict.legacyPath} and leaving ` +
         `${_pathConflict.canonicalPath} untouched. Each side can still read its own ` +
-        "credentials, and neither can read the other's. To converge, log out on one " +
-        `side (\`${(0, runtime_js_1.getAuthBinaryName)()} logout\` here) and log back in; the surviving key ` +
-        'is then adopted by both.');
+        "credentials, and neither can read the other's. Do not delete " +
+        `${_pathConflict.legacyPath}: it is the key the daemon reads. To converge on it, ` +
+        'run `skrr logout && skrrd restart && skrr login`.');
 }
 /**
  * Initialize the envelope path. Idempotent — second call when state is

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/credentialEnvelopeBridge.js

@@ -47,7 +47,7 @@ import lockfile from 'proper-lockfile';
 import { buildCredentialAad, decrypt as credEnvelopeDecrypt, deserialize as credEnvelopeDeserialize, encrypt as credEnvelopeEncrypt, isEnvelopeString as isCredEnvelopeString, generateDek, serialize as credEnvelopeSerialize, } from './credentialEnvelope.js';
 import { getKekStrategy, zeroizeKekCaches } from './kek/index.js';
 import { consolidateProfileState, profileStateDir, profileStateFilePathsToClear, resolveProfileStateFile, } from './profileStateDir.js';
-import { emitAuthTelemetry, getAuthBinaryName, getAuthLogger, getCredEnvelopeFailClosed, } from './runtime.js';
+import { emitAuthTelemetry, getAuthLogger, getCredEnvelopeFailClosed } from './runtime.js';
 /**
  * Account name the wrapped DEK lives under (file fallback). Keeping the
  * literal here so a future rename surfaces as a single grep target.
@@ -309,14 +309,18 @@ async function consolidateWrappedDek(profile, kek, aad) {
     };
     // The paths go in the MESSAGE, not only the metadata: a log pipeline that
     // drops structured fields would otherwise render this as an unactionable
-    // noun. Naming the remedy matters too — logging out on one side deletes that
-    // side's key and lets the next start adopt the other.
+    // noun. Naming the remedy matters too, and it has to be one that converges
+    // (OSK-12172). Only the CLI's logout deletes a key, and only the canonical
+    // one; a daemon logout deletes neither. So the CLI logs out, the daemon
+    // BINARY restarts and adopts its legacy key into the empty canonical slot,
+    // and the CLI logs back in on it. Not `skrr daemon restart`: any `skrr`
+    // command mints a fresh key into an empty slot before doing anything else.
     getAuthLogger().warn(`[credEnvelope] profile "${profile}" has two different usable wrapped DEKs; ` +
         `refusing to choose. Keeping ${_pathConflict.legacyPath} and leaving ` +
         `${_pathConflict.canonicalPath} untouched. Each side can still read its own ` +
-        "credentials, and neither can read the other's. To converge, log out on one " +
-        `side (\`${getAuthBinaryName()} logout\` here) and log back in; the surviving key ` +
-        'is then adopted by both.');
+        "credentials, and neither can read the other's. Do not delete " +
+        `${_pathConflict.legacyPath}: it is the key the daemon reads. To converge on it, ` +
+        'run `skrr logout && skrrd restart && skrr login`.');
 }
 /**
  * Initialize the envelope path. Idempotent — second call when state is

package/dist/node_modules/@skrr-ai/auth-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skrr-ai/auth-core",
-  "version": "0.4.6",
+  "version": "0.4.7",
   "main": "dist/cjs/index.js",
   "types": "dist/esm/index.d.ts",
   "exports": {