@skrr-ai/cli 0.1.54 → 0.1.56

package/dist/base-command.d.ts

@@ -3,7 +3,7 @@ export { resolveProfileFromArgv } from './lib/keychain';
 import { type AssigneeResolution, type MemberKind, type SpaceMember } from './lib/assignee-resolver';
 import { type CliConfig } from './lib/config';
 import { type OutboxMethod } from './lib/outbox';
-import { type ResolvedCredential } from './lib/credential-resolver';
+import { type CredentialProvenance, type ResolvedCredential } from './lib/credential-resolver';
 import { type BrokerRefusalDescription } from './lib/daemonBrokerRefusal';
 import { type DefaultAgentResolution } from './lib/tasks';
 export declare function assigneePayloadNeedsResolution(payload: Record<string, unknown>): boolean;
@@ -68,6 +68,13 @@ export declare abstract class BaseCommand extends Command {
      * from here.
      */
     protected resolvedCredential: ResolvedCredential;
+    /**
+     * Where `resolvedCredential` really came from when its `source` slot cannot
+     * say — an in-memory daemon hand-off or Agent session token is recorded as
+     * `env-token` for refresh semantics, but was not read from OVERSKY_TOKEN
+     * (OSK-12185). Null for every stored/env/flag credential.
+     */
+    protected credentialProvenance: CredentialProvenance | null;
     protected bareMode: boolean;
     /**
      * Set when the auto-broker reached a live daemon and it REFUSED the hand-off.

package/dist/base-command.js

@@ -132,6 +132,13 @@ class BaseCommand extends core_1.Command {
      * from here.
      */
     resolvedCredential;
+    /**
+     * Where `resolvedCredential` really came from when its `source` slot cannot
+     * say — an in-memory daemon hand-off or Agent session token is recorded as
+     * `env-token` for refresh semantics, but was not read from OVERSKY_TOKEN
+     * (OSK-12185). Null for every stored/env/flag credential.
+     */
+    credentialProvenance = null;
     bareMode = false;
     /**
      * Set when the auto-broker reached a live daemon and it REFUSED the hand-off.
@@ -173,6 +180,7 @@ class BaseCommand extends core_1.Command {
                     return;
                 }
                 autonomousCredential = delegatedCredential;
+                this.credentialProvenance = { kind: 'daemon-delegated' };
             }
             catch (err) {
                 this.failWithCliError({
@@ -214,6 +222,10 @@ class BaseCommand extends core_1.Command {
                 delete process.env.OVERSKY_WORKSPACE_ID;
             }
             this.resolvedCredential = autonomousCredential;
+            if (!this.credentialProvenance && autonomousCredential.source === 'env-token') {
+                // `resolveTrustedAutonomousCredential` read OVERSKY_SESSION_TOKEN.
+                this.credentialProvenance = { kind: 'agent-session' };
+            }
             (0, node_adapter_1.setAdapterCredentialOverride)(this.resolvedCredential);
             (0, data_provider_1.setHttpAdapter)((0, node_adapter_1.createNodeAdapter)());
             return;
@@ -327,6 +339,17 @@ class BaseCommand extends core_1.Command {
                                     : 'file',
                         kind: (0, auth_core_1.classifyTokenKind)(accessToken),
                     };
+                    // The slot above says `env-token`; the label must not. The token
+                    // came from the daemon's hand-off descriptor, and OVERSKY_TOKEN is
+                    // typically unset (OSK-12185).
+                    this.credentialProvenance = autoResult.outcome.brokered
+                        ? {
+                            kind: 'daemon-handoff',
+                            ...(autoResult.outcome.descriptorPath
+                                ? { descriptorPath: autoResult.outcome.descriptorPath }
+                                : {}),
+                        }
+                        : null;
                 }
                 else if ((this.brokerRefusal = (0, daemonBrokerRefusal_1.describeBrokerRefusal)(autoResult.outcome, this.config.bin))) {
                     // Reported by requireAuth(); nothing to print here.
@@ -821,7 +844,7 @@ class BaseCommand extends core_1.Command {
     credentialSourceLabel() {
         if (!this.resolvedCredential?.token)
             return null;
-        return (0, credential_resolver_1.formatCredentialSource)(this.resolvedCredential.source);
+        return (0, credential_resolver_1.describeCredentialSource)(this.resolvedCredential.source, this.credentialProvenance);
     }
     async catch(err) {
         if (isOclifExitError(err)) {

package/dist/lib/agentic-stream.d.ts

@@ -173,6 +173,16 @@ export type ProjectedToolEvent = {
  * of the run. The pairing is unambiguous within a turn.
  */
 export declare function projectDaemonToolEvents(envelopes: unknown[], namesByCall: Map<string, string>): ProjectedToolEvent[];
+/**
+ * The line printed when a tool call ends, in the words its status earns.
+ *
+ * Every end used to print `[tool completed]`, including a failed call. And a
+ * call the harness never closed — which the daemon now reports as
+ * `unreported` rather than `failed` (OSK-12188) — must read as neither: it may
+ * well have run. Its close is made when the session exits, so the line says
+ * that too, rather than let the moment it prints stand for when the call ran.
+ */
+export declare function describeToolEnd(toolName: unknown, status: unknown): string;
 /**
  * WHO or WHAT decided a permission request, as a reader needs it (OSK-12113).
  *

package/dist/lib/agentic-stream.js

@@ -7,6 +7,7 @@ exports.envelopesText = envelopesText;
 exports.envelopeKey = envelopeKey;
 exports.unseenEnvelopes = unseenEnvelopes;
 exports.projectDaemonToolEvents = projectDaemonToolEvents;
+exports.describeToolEnd = describeToolEnd;
 exports.describePermissionDecider = describePermissionDecider;
 exports.projectPermissionResolutions = projectPermissionResolutions;
 exports.renderableDelta = renderableDelta;
@@ -249,6 +250,28 @@ function projectDaemonToolEvents(envelopes, namesByCall) {
     }
     return out;
 }
+/**
+ * The line printed when a tool call ends, in the words its status earns.
+ *
+ * Every end used to print `[tool completed]`, including a failed call. And a
+ * call the harness never closed — which the daemon now reports as
+ * `unreported` rather than `failed` (OSK-12188) — must read as neither: it may
+ * well have run. Its close is made when the session exits, so the line says
+ * that too, rather than let the moment it prints stand for when the call ran.
+ */
+function describeToolEnd(toolName, status) {
+    const name = String(toolName ?? 'unknown');
+    switch (status) {
+        case 'failed':
+            return `[tool failed] ${name}`;
+        case 'cancelled':
+            return `[tool cancelled] ${name}`;
+        case 'unreported':
+            return `[tool result not reported] ${name} (the harness never said how it ended; closed when the session ended)`;
+        default:
+            return `[tool completed] ${name}`;
+    }
+}
 const SURFACE_LABELS = {
     web: 'the web app',
     cli: 'the skrr CLI',
@@ -1126,7 +1149,7 @@ class AgenticStreamClient {
             this.renderedText = this.accumulated;
         }
         else if (event.type === 'tool.completed') {
-            output.write(`[tool completed] ${String(event.toolName ?? 'unknown')}\n`);
+            output.write(`${describeToolEnd(event.toolName, event.status)}\n`);
             this.renderedText = this.accumulated;
         }
         else if (event.type === 'stream.gap') {

package/dist/lib/auth-core-init.d.ts

@@ -1,3 +1,51 @@
+/**
+ * A credential-envelope failure that carries a hint, as ONE plain line
+ * (OSK-12180) — or null when the warning is anything else.
+ *
+ * An unreadable stored credential is reported on every command until someone
+ * signs in again, and auth-core's structured form is six lines of object dump
+ * ending in the raw CryptoKit/OpenSSL string (`Unsupported state or unable to
+ * authenticate data`). The person reading it needs the hint auth-core already
+ * wrote for exactly this, and what to do; the key id and the crypto message are
+ * for whoever is debugging, which is what `DEBUG` is for everywhere else in
+ * this logger. The daemon logs through its own logger and keeps the structured
+ * record.
+ *
+ * The remedy is added only to the DEFAULT hint, which is about this config's
+ * own credential. A caller that supplied its own hint knows the case better —
+ * another config's credential is not fixed by `skrr login` here, and its hint
+ * says so (OSK-12135).
+ */
+export declare function plainCredentialEnvelopeWarning(args: readonly unknown[]): string | null;
+/**
+ * The one line an EXPECTED credential-key change prints (OSK-12186).
+ *
+ * When the key that wraps this profile's credential key changes underneath it
+ * — a Dedicated guest moved to a new image gets a new `/etc/machine-id`, which
+ * the Linux key is derived from; a new Mac or a reset Keychain does the same —
+ * auth-core cannot unwrap the old key, enrolls a new one and carries on. That
+ * is recovery, not damage, but it reached the terminal as four warnings: the
+ * unwrap failure, the rotation notice, and one decrypt failure per credential
+ * still sealed under the old key, each ending in a raw crypto string. The
+ * second run was clean, which is exactly what corruption does not look like.
+ *
+ * It is distinct from a GENUINELY unreadable credential (OSK-12180): there the
+ * key unwraps and one stored value still cannot be opened, nothing will fix it
+ * by itself, and that line names `skrr login`. Here the old values are
+ * unreadable BECAUSE the key was replaced, and the next step happens on its
+ * own when a local daemon can hand a credential over.
+ */
+export declare const CREDENTIAL_KEY_CHANGED_NOTICE: string;
+/**
+ * What the CLI prints for one auth-core warning: a replacement line, nothing
+ * (`''`), or null for "print it as auth-core wrote it".
+ *
+ * Stateful by design — the process that detected a key change has already
+ * told the person why every old credential is unreadable, so the per-value
+ * decrypt failures that follow add nothing. A fresh process starts clean, and
+ * a later genuinely unreadable credential still gets its own OSK-12180 line.
+ */
+export declare function createCredentialEnvelopeWarningPresenter(): (args: readonly unknown[]) => string | null;
 type DedicatedGenerationPreparationOptions = {
     machineUuid?: string;
     configDir?: string;

package/dist/lib/auth-core-init.js

@@ -3,7 +3,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CliCredentialInitializationError = void 0;
+exports.CliCredentialInitializationError = exports.CREDENTIAL_KEY_CHANGED_NOTICE = void 0;
+exports.plainCredentialEnvelopeWarning = plainCredentialEnvelopeWarning;
+exports.createCredentialEnvelopeWarningPresenter = createCredentialEnvelopeWarningPresenter;
 exports.prepareDedicatedRuntimeAuthGeneration = prepareDedicatedRuntimeAuthGeneration;
 exports.ensureAuthCoreConfigured = ensureAuthCoreConfigured;
 exports.prefetchCliAuth = prefetchCliAuth;
@@ -44,6 +46,94 @@ function envFlag(name) {
     const v = process.env[name];
     return v === '1' || v === 'true' || v === 'TRUE';
 }
+/**
+ * A credential-envelope failure that carries a hint, as ONE plain line
+ * (OSK-12180) — or null when the warning is anything else.
+ *
+ * An unreadable stored credential is reported on every command until someone
+ * signs in again, and auth-core's structured form is six lines of object dump
+ * ending in the raw CryptoKit/OpenSSL string (`Unsupported state or unable to
+ * authenticate data`). The person reading it needs the hint auth-core already
+ * wrote for exactly this, and what to do; the key id and the crypto message are
+ * for whoever is debugging, which is what `DEBUG` is for everywhere else in
+ * this logger. The daemon logs through its own logger and keeps the structured
+ * record.
+ *
+ * The remedy is added only to the DEFAULT hint, which is about this config's
+ * own credential. A caller that supplied its own hint knows the case better —
+ * another config's credential is not fixed by `skrr login` here, and its hint
+ * says so (OSK-12135).
+ */
+function plainCredentialEnvelopeWarning(args) {
+    const [message, metadata] = args;
+    if (typeof message !== 'string' || !message.startsWith('[credEnvelope] '))
+        return null;
+    if (!metadata || typeof metadata !== 'object')
+        return null;
+    const hint = metadata.hint;
+    if (typeof hint !== 'string' || !hint.trim())
+        return null;
+    const remedy = hint === auth_core_1.DEFAULT_UNREADABLE_CREDENTIAL_HINT ? ' Run `skrr login`.' : '';
+    return `warning: ${hint.trim()}.${remedy} (DEBUG=1 shows the underlying error.)`;
+}
+/**
+ * The one line an EXPECTED credential-key change prints (OSK-12186).
+ *
+ * When the key that wraps this profile's credential key changes underneath it
+ * — a Dedicated guest moved to a new image gets a new `/etc/machine-id`, which
+ * the Linux key is derived from; a new Mac or a reset Keychain does the same —
+ * auth-core cannot unwrap the old key, enrolls a new one and carries on. That
+ * is recovery, not damage, but it reached the terminal as four warnings: the
+ * unwrap failure, the rotation notice, and one decrypt failure per credential
+ * still sealed under the old key, each ending in a raw crypto string. The
+ * second run was clean, which is exactly what corruption does not look like.
+ *
+ * It is distinct from a GENUINELY unreadable credential (OSK-12180): there the
+ * key unwraps and one stored value still cannot be opened, nothing will fix it
+ * by itself, and that line names `skrr login`. Here the old values are
+ * unreadable BECAUSE the key was replaced, and the next step happens on its
+ * own when a local daemon can hand a credential over.
+ */
+exports.CREDENTIAL_KEY_CHANGED_NOTICE = "note: this machine's credential key changed (a new machine or image), so credentials " +
+    'saved under the old key can no longer be read. skrr gets a new one from the local daemon when ' +
+    'one is running; otherwise run `skrr login`. (DEBUG=1 shows the underlying error.)';
+/**
+ * What the CLI prints for one auth-core warning: a replacement line, nothing
+ * (`''`), or null for "print it as auth-core wrote it".
+ *
+ * Stateful by design — the process that detected a key change has already
+ * told the person why every old credential is unreadable, so the per-value
+ * decrypt failures that follow add nothing. A fresh process starts clean, and
+ * a later genuinely unreadable credential still gets its own OSK-12180 line.
+ */
+function createCredentialEnvelopeWarningPresenter() {
+    let keyChanged = false;
+    return (args) => {
+        const [message, metadata] = args;
+        const event = typeof message === 'string' && message.startsWith('[credEnvelope] ')
+            ? message.slice('[credEnvelope] '.length)
+            : null;
+        const meta = (metadata && typeof metadata === 'object' ? metadata : {});
+        // auth-core emits this and then, from the same branch, `kek_rotated`: the
+        // wrapped key was present and would not unwrap. The notice below is the
+        // one line for both.
+        if (event === 'cred_envelope.unwrap.failed' && meta.reason === 'wrapped_dek_unwrap_threw') {
+            return '';
+        }
+        if (event === 'cred_envelope.kek_rotated') {
+            if (keyChanged)
+                return '';
+            keyChanged = true;
+            return exports.CREDENTIAL_KEY_CHANGED_NOTICE;
+        }
+        // Every value sealed under the old key fails here now — the notice has
+        // already said why. A MALFORMED envelope is a different fact and still prints.
+        if (keyChanged && event === 'cred_envelope.read.decrypt_failed')
+            return '';
+        return plainCredentialEnvelopeWarning(args);
+    };
+}
+const presentCredentialEnvelopeWarning = createCredentialEnvelopeWarningPresenter();
 const cliLogger = {
     // The CLI is a short-lived foreground process. Trace/debug get dropped
     // unless DEBUG is set so we don't spam terminal output.
@@ -55,7 +145,15 @@ const cliLogger = {
         if (process.env.DEBUG)
             console.error('[auth-core info]', ...args);
     },
-    warn: (...args) => console.error('[auth-core warn]', ...args),
+    warn: (...args) => {
+        const plain = process.env.DEBUG ? null : presentCredentialEnvelopeWarning(args);
+        if (plain === '')
+            return;
+        if (plain)
+            console.error(plain);
+        else
+            console.error('[auth-core warn]', ...args);
+    },
     error: (...args) => console.error('[auth-core error]', ...args),
 };
 /**

package/dist/lib/cli-identity.js

@@ -74,7 +74,6 @@ const path = __importStar(require("node:path"));
 const auth_storage_1 = require("./auth-storage");
 const config_1 = require("./config");
 const cli_id_1 = require("./cli-id");
-const device_id_1 = require("./device-id");
 const keychain_1 = require("./keychain");
 /**
  * A named profile's own identity. Deterministic in (host, user, config root,
@@ -127,7 +126,7 @@ function planLoginCliId(cfg, deps = {}) {
     const machine = cfg.cliId?.trim();
     if (machine)
         return { cliId: machine, source: 'machine' };
-    const cliId = (0, device_id_1.generateCliId)();
+    const cliId = (0, config_1.machineCliId)();
     return { cliId, source: 'machine', updatedConfig: { ...cfg, cliId } };
 }
 /**

package/dist/lib/config.d.ts

@@ -190,6 +190,16 @@ export declare function isEnvAuthOverride(): boolean;
  * resolver and every existing install read it.
  */
 export declare function configRoot(env?: NodeJS.ProcessEnv): string;
+/**
+ * The machine cliId THIS config root mints when it has none stored
+ * (OSK-12179). The primary root keeps the historical (host, user) id; any other
+ * root gets one of its own, so two roots of one user are two server-side
+ * families and one root's hand-off confirm cannot retire the other's session.
+ *
+ * Mints nothing and reads nothing stored: callers persist it (`cli-identity.ts`)
+ * or present it only when nothing is stored (the daemon broker).
+ */
+export declare function machineCliId(): string;
 /**
  * The PRE-RENAME config root — the generation between `.sky` and `.skrr`.
  *

package/dist/lib/config.js

@@ -39,6 +39,7 @@ exports.describeDeployment = describeDeployment;
 exports.canonicalizeKnownBaseURL = canonicalizeKnownBaseURL;
 exports.isEnvAuthOverride = isEnvAuthOverride;
 exports.configRoot = configRoot;
+exports.machineCliId = machineCliId;
 exports.priorConfigDir = priorConfigDir;
 exports.loadConfig = loadConfig;
 exports.saveConfig = saveConfig;
@@ -54,6 +55,7 @@ const path = __importStar(require("node:path"));
 const keychain_1 = require("./keychain");
 const auth_core_1 = require("@skrr-ai/auth-core");
 const cli_id_1 = require("./cli-id");
+const device_id_1 = require("./device-id");
 const publicEndpoints_generated_1 = require("./publicEndpoints.generated");
 // Both from config/public-endpoints.json, the one domain contract, rather than a
 // fourth hand-copied pair. The CLI previously knew only about dev — there was no
@@ -269,6 +271,26 @@ function configRoot(env = process.env) {
 function newConfigDir() {
     return configRoot();
 }
+/** The root this machine uses when nothing relocates it (`~/.skrr`). */
+function defaultConfigRoot() {
+    return (0, auth_core_1.resolveConfigRoot)({});
+}
+/** Is this process on the primary root, however it was reached? */
+function isDefaultConfigRoot() {
+    return path.resolve(configRoot()) === path.resolve(defaultConfigRoot());
+}
+/**
+ * The machine cliId THIS config root mints when it has none stored
+ * (OSK-12179). The primary root keeps the historical (host, user) id; any other
+ * root gets one of its own, so two roots of one user are two server-side
+ * families and one root's hand-off confirm cannot retire the other's session.
+ *
+ * Mints nothing and reads nothing stored: callers persist it (`cli-identity.ts`)
+ * or present it only when nothing is stored (the daemon broker).
+ */
+function machineCliId() {
+    return (0, device_id_1.machineCliIdForRoot)(configRoot(), defaultConfigRoot());
+}
 /**
  * Fields that belong to the MACHINE, not to a profile.
  *
@@ -472,6 +494,13 @@ function loadConfig() {
             if (!fs.existsSync(carriedPath))
                 continue;
             const carried = migrateLegacyBaseURL(readJsonOrThrow(carriedPath));
+            // The ancestor lives under $HOME whatever root this is, so its `cliId`
+            // belongs to the PRIMARY root's sessions. A relocated root that adopted
+            // it would present the primary root's identity, and a hand-off confirm
+            // there retires the primary root's families (OSK-12179). It mints its own
+            // at first login instead (`machineCliId`).
+            if (!isDefaultConfigRoot())
+                delete carried.cliId;
             try {
                 saveConfig(carried);
             }

package/dist/lib/credential-resolver.d.ts

@@ -64,6 +64,33 @@ export declare function resolveCredential(opts?: ResolveOptions): Promise<Resolv
  * a token (e.g., just post-login) don't need to re-resolve.
  */
 export declare function kindOf(token: string | null | undefined): TokenKind;
+/**
+ * Where an in-memory credential ACTUALLY came from, when the shared
+ * `CredentialSource` union has no slot for it.
+ *
+ * Two CLI paths hold a token that was never read from `OVERSKY_TOKEN` yet
+ * are recorded as `env-token` — the union's only "a token this process holds
+ * in memory" slot, and the one `ensureFreshCliCredential` correctly skips: a
+ * daemon hand-off redeem (renewed by re-redeeming its descriptor) and a
+ * daemon-launched Agent session (`OVERSKY_SESSION_TOKEN`). Labelling either
+ * by the slot alone printed `Token source: OVERSKY_TOKEN` for a variable
+ * that was not set, which sends a debugging user to the wrong place
+ * (OSK-12185). The provenance travels BESIDE the credential so the slot keeps
+ * its refresh semantics and the label tells the truth.
+ */
+export type CredentialProvenance = {
+    kind: 'daemon-handoff';
+    descriptorPath?: string;
+} | {
+    kind: 'daemon-delegated';
+} | {
+    kind: 'agent-session';
+};
+/**
+ * The label `whoami`, `context` and `doctor` print — text and `--json` read
+ * the same value. A recorded provenance wins over the source slot.
+ */
+export declare function describeCredentialSource(source: CredentialSource, provenance?: CredentialProvenance | null): string;
 /**
  * Human-readable label for a `CredentialSource`. Used by `skrr whoami`
  * and (Phase H) `skrr doctor`.

package/dist/lib/credential-resolver.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveTrustedAutonomousCredential = resolveTrustedAutonomousCredential;
 exports.resolveCredential = resolveCredential;
 exports.kindOf = kindOf;
+exports.describeCredentialSource = describeCredentialSource;
 exports.formatCredentialSource = formatCredentialSource;
 /**
  * credential-resolver.ts — Phase H.1 precedence for the Sky CLI.
@@ -118,6 +119,24 @@ async function resolveCredential(opts = {}) {
 function kindOf(token) {
     return (0, auth_core_1.classifyTokenKind)(token);
 }
+/**
+ * The label `whoami`, `context` and `doctor` print — text and `--json` read
+ * the same value. A recorded provenance wins over the source slot.
+ */
+function describeCredentialSource(source, provenance) {
+    if (provenance?.kind === 'daemon-handoff') {
+        return provenance.descriptorPath
+            ? `daemon hand-off (${provenance.descriptorPath})`
+            : 'daemon hand-off';
+    }
+    if (provenance?.kind === 'daemon-delegated') {
+        return 'daemon delegated credential (OVERSKY_DELEGATED_CLI_BROKER_URL)';
+    }
+    if (provenance?.kind === 'agent-session') {
+        return 'agent session (OVERSKY_SESSION_TOKEN)';
+    }
+    return formatCredentialSource(source);
+}
 /**
  * Human-readable label for a `CredentialSource`. Used by `skrr whoami`
  * and (Phase H) `skrr doctor`.

package/dist/lib/daemonBroker.d.ts

@@ -115,6 +115,13 @@ export interface DaemonBrokeredOutcome {
     /** Server the minted credential belongs to (daemon-reported, else the
      *  descriptor's own `serverUrl`). */
     serverUrl?: string;
+    /**
+     * The descriptor file the token was redeemed from. The token lives only in
+     * this process's memory, so this path is the only honest answer to "where
+     * did this credential come from" — `skrr whoami` prints it as the token
+     * source (OSK-12185).
+     */
+    descriptorPath?: string;
 }
 /**
  * Explicit reasons the broker path could fail. These exist to keep the

package/dist/lib/daemonBroker.js

@@ -463,6 +463,7 @@ async function brokerThrough(bootstrap, opts, sourcePath) {
                 ...((response.serverUrl ?? bootstrap.serverUrl)
                     ? { serverUrl: response.serverUrl ?? bootstrap.serverUrl }
                     : {}),
+                ...(sourcePath ? { descriptorPath: sourcePath } : {}),
             };
         }
         // The descriptor ALSO advertises the durable mint (a laptop island during

package/dist/lib/device-id.d.ts

@@ -12,3 +12,26 @@
  * 128-char + printable-ASCII guard.
  */
 export declare function generateCliId(): string;
+/**
+ * The machine cliId for ONE config root (OSK-12179).
+ *
+ * `generateCliId()` hashes only (host, user), so every root on the machine got
+ * the same id: a fresh `SKRR_CONFIG_DIR` root's default profile minted exactly
+ * the id the real `~/.skrr` root had been presenting. The server's
+ * `cli-handoff/confirm` retires every OTHER live family of (user, cliId), so a
+ * sign-in in the second root could end the first root's session. The Keychain
+ * slots were already separated by root (OSK-12135), and a named profile's own
+ * id already hashes its root (`profileScopedCliId`); this was the one identity
+ * that did not.
+ *
+ * The DEFAULT root keeps `generateCliId()` byte for byte. Every install already
+ * stores or re-derives that value, every live session is bound to it, and a
+ * refresh presenting another id is refused — so changing it would sign the
+ * primary root out. Only a root somewhere else gets its own id, deterministic in
+ * (host, user, root) so a root that loses its config file and signs in again
+ * presents the same id rather than scattering families.
+ *
+ * A root is the default one when it resolves to the default path, however it
+ * was reached: `SKRR_CONFIG_DIR=~/.skrr` is the primary root, not a second one.
+ */
+export declare function machineCliIdForRoot(root: string, defaultRoot: string): string;

package/dist/lib/device-id.js

@@ -1,11 +1,46 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.generateCliId = generateCliId;
+exports.machineCliIdForRoot = machineCliIdForRoot;
 const node_crypto_1 = require("node:crypto");
 const node_os_1 = __importDefault(require("node:os"));
+const path = __importStar(require("node:path"));
 /**
  * Derive a stable per-machine identifier the server will treat as a
  * "device" for the device-code flow. Mirrors the daemon's `generateDaemonId`
@@ -25,3 +60,36 @@ function generateCliId() {
     const digest = (0, node_crypto_1.createHash)('sha256').update(`${hostname}|${username}|cli`).digest('hex');
     return `cli_${digest.slice(0, 12)}`;
 }
+/**
+ * The machine cliId for ONE config root (OSK-12179).
+ *
+ * `generateCliId()` hashes only (host, user), so every root on the machine got
+ * the same id: a fresh `SKRR_CONFIG_DIR` root's default profile minted exactly
+ * the id the real `~/.skrr` root had been presenting. The server's
+ * `cli-handoff/confirm` retires every OTHER live family of (user, cliId), so a
+ * sign-in in the second root could end the first root's session. The Keychain
+ * slots were already separated by root (OSK-12135), and a named profile's own
+ * id already hashes its root (`profileScopedCliId`); this was the one identity
+ * that did not.
+ *
+ * The DEFAULT root keeps `generateCliId()` byte for byte. Every install already
+ * stores or re-derives that value, every live session is bound to it, and a
+ * refresh presenting another id is refused — so changing it would sign the
+ * primary root out. Only a root somewhere else gets its own id, deterministic in
+ * (host, user, root) so a root that loses its config file and signs in again
+ * presents the same id rather than scattering families.
+ *
+ * A root is the default one when it resolves to the default path, however it
+ * was reached: `SKRR_CONFIG_DIR=~/.skrr` is the primary root, not a second one.
+ */
+function machineCliIdForRoot(root, defaultRoot) {
+    const resolved = path.resolve(root);
+    if (resolved === path.resolve(defaultRoot))
+        return generateCliId();
+    const hostname = node_os_1.default.hostname();
+    const username = node_os_1.default.userInfo().username || 'unknown';
+    const digest = (0, node_crypto_1.createHash)('sha256')
+        .update(`${hostname}|${username}|cli|root:${resolved}`)
+        .digest('hex');
+    return `cli_${digest.slice(0, 12)}`;
+}

package/dist/lib/first-party-harness-broker.js

@@ -75,7 +75,6 @@ const auth_core_init_1 = require("./auth-core-init");
 const config_1 = require("./config");
 const cli_id_1 = require("./cli-id");
 const cred_envelope_1 = require("./cred-envelope");
-const device_id_1 = require("./device-id");
 const first_party_harness_1 = require("./first-party-harness");
 const first_party_harness_agent_1 = require("./first-party-harness-agent");
 const first_party_harness_managed_1 = require("./first-party-harness-managed");
@@ -862,8 +861,9 @@ function hasLocalCredential() {
  *
  * The id login and refresh present, read through `resolveCliId` (a named
  * profile may have its own, OSK-12156); regenerated deterministically as the
- * machine id when nothing is stored (same hostname+user always yields the same
- * value). Normalized to the `cli_` namespace the server requires,
+ * machine id of THIS config root when nothing is stored (the same host, user
+ * and root always yield the same value; a relocated root does not share the
+ * primary root's id, OSK-12179). Normalized to the `cli_` namespace the server requires,
  * because `OVERSKY_CLI_ID` is overlaid verbatim with no format check and a
  * hand-set value would otherwise come back as an opaque
  * `runtime-id-namespace-mismatch`.
@@ -879,7 +879,7 @@ function localRuntimeId() {
     })();
     if (configured?.startsWith('cli_'))
         return configured;
-    return (0, device_id_1.generateCliId)();
+    return (0, config_1.machineCliId)();
 }
 function errorCodeOf(err) {
     const code = err?.code;