@skrr-ai/cli 0.1.55 → 0.1.56

package/dist/base-command.d.ts

@@ -3,7 +3,7 @@ export { resolveProfileFromArgv } from './lib/keychain';
 import { type AssigneeResolution, type MemberKind, type SpaceMember } from './lib/assignee-resolver';
 import { type CliConfig } from './lib/config';
 import { type OutboxMethod } from './lib/outbox';
-import { type ResolvedCredential } from './lib/credential-resolver';
+import { type CredentialProvenance, type ResolvedCredential } from './lib/credential-resolver';
 import { type BrokerRefusalDescription } from './lib/daemonBrokerRefusal';
 import { type DefaultAgentResolution } from './lib/tasks';
 export declare function assigneePayloadNeedsResolution(payload: Record<string, unknown>): boolean;
@@ -68,6 +68,13 @@ export declare abstract class BaseCommand extends Command {
      * from here.
      */
     protected resolvedCredential: ResolvedCredential;
+    /**
+     * Where `resolvedCredential` really came from when its `source` slot cannot
+     * say — an in-memory daemon hand-off or Agent session token is recorded as
+     * `env-token` for refresh semantics, but was not read from OVERSKY_TOKEN
+     * (OSK-12185). Null for every stored/env/flag credential.
+     */
+    protected credentialProvenance: CredentialProvenance | null;
     protected bareMode: boolean;
     /**
      * Set when the auto-broker reached a live daemon and it REFUSED the hand-off.

package/dist/base-command.js

@@ -132,6 +132,13 @@ class BaseCommand extends core_1.Command {
      * from here.
      */
     resolvedCredential;
+    /**
+     * Where `resolvedCredential` really came from when its `source` slot cannot
+     * say — an in-memory daemon hand-off or Agent session token is recorded as
+     * `env-token` for refresh semantics, but was not read from OVERSKY_TOKEN
+     * (OSK-12185). Null for every stored/env/flag credential.
+     */
+    credentialProvenance = null;
     bareMode = false;
     /**
      * Set when the auto-broker reached a live daemon and it REFUSED the hand-off.
@@ -173,6 +180,7 @@ class BaseCommand extends core_1.Command {
                     return;
                 }
                 autonomousCredential = delegatedCredential;
+                this.credentialProvenance = { kind: 'daemon-delegated' };
             }
             catch (err) {
                 this.failWithCliError({
@@ -214,6 +222,10 @@ class BaseCommand extends core_1.Command {
                 delete process.env.OVERSKY_WORKSPACE_ID;
             }
             this.resolvedCredential = autonomousCredential;
+            if (!this.credentialProvenance && autonomousCredential.source === 'env-token') {
+                // `resolveTrustedAutonomousCredential` read OVERSKY_SESSION_TOKEN.
+                this.credentialProvenance = { kind: 'agent-session' };
+            }
             (0, node_adapter_1.setAdapterCredentialOverride)(this.resolvedCredential);
             (0, data_provider_1.setHttpAdapter)((0, node_adapter_1.createNodeAdapter)());
             return;
@@ -327,6 +339,17 @@ class BaseCommand extends core_1.Command {
                                     : 'file',
                         kind: (0, auth_core_1.classifyTokenKind)(accessToken),
                     };
+                    // The slot above says `env-token`; the label must not. The token
+                    // came from the daemon's hand-off descriptor, and OVERSKY_TOKEN is
+                    // typically unset (OSK-12185).
+                    this.credentialProvenance = autoResult.outcome.brokered
+                        ? {
+                            kind: 'daemon-handoff',
+                            ...(autoResult.outcome.descriptorPath
+                                ? { descriptorPath: autoResult.outcome.descriptorPath }
+                                : {}),
+                        }
+                        : null;
                 }
                 else if ((this.brokerRefusal = (0, daemonBrokerRefusal_1.describeBrokerRefusal)(autoResult.outcome, this.config.bin))) {
                     // Reported by requireAuth(); nothing to print here.
@@ -821,7 +844,7 @@ class BaseCommand extends core_1.Command {
     credentialSourceLabel() {
         if (!this.resolvedCredential?.token)
             return null;
-        return (0, credential_resolver_1.formatCredentialSource)(this.resolvedCredential.source);
+        return (0, credential_resolver_1.describeCredentialSource)(this.resolvedCredential.source, this.credentialProvenance);
     }
     async catch(err) {
         if (isOclifExitError(err)) {

package/dist/lib/agentic-stream.d.ts

@@ -173,6 +173,16 @@ export type ProjectedToolEvent = {
  * of the run. The pairing is unambiguous within a turn.
  */
 export declare function projectDaemonToolEvents(envelopes: unknown[], namesByCall: Map<string, string>): ProjectedToolEvent[];
+/**
+ * The line printed when a tool call ends, in the words its status earns.
+ *
+ * Every end used to print `[tool completed]`, including a failed call. And a
+ * call the harness never closed — which the daemon now reports as
+ * `unreported` rather than `failed` (OSK-12188) — must read as neither: it may
+ * well have run. Its close is made when the session exits, so the line says
+ * that too, rather than let the moment it prints stand for when the call ran.
+ */
+export declare function describeToolEnd(toolName: unknown, status: unknown): string;
 /**
  * WHO or WHAT decided a permission request, as a reader needs it (OSK-12113).
  *

package/dist/lib/agentic-stream.js

@@ -7,6 +7,7 @@ exports.envelopesText = envelopesText;
 exports.envelopeKey = envelopeKey;
 exports.unseenEnvelopes = unseenEnvelopes;
 exports.projectDaemonToolEvents = projectDaemonToolEvents;
+exports.describeToolEnd = describeToolEnd;
 exports.describePermissionDecider = describePermissionDecider;
 exports.projectPermissionResolutions = projectPermissionResolutions;
 exports.renderableDelta = renderableDelta;
@@ -249,6 +250,28 @@ function projectDaemonToolEvents(envelopes, namesByCall) {
     }
     return out;
 }
+/**
+ * The line printed when a tool call ends, in the words its status earns.
+ *
+ * Every end used to print `[tool completed]`, including a failed call. And a
+ * call the harness never closed — which the daemon now reports as
+ * `unreported` rather than `failed` (OSK-12188) — must read as neither: it may
+ * well have run. Its close is made when the session exits, so the line says
+ * that too, rather than let the moment it prints stand for when the call ran.
+ */
+function describeToolEnd(toolName, status) {
+    const name = String(toolName ?? 'unknown');
+    switch (status) {
+        case 'failed':
+            return `[tool failed] ${name}`;
+        case 'cancelled':
+            return `[tool cancelled] ${name}`;
+        case 'unreported':
+            return `[tool result not reported] ${name} (the harness never said how it ended; closed when the session ended)`;
+        default:
+            return `[tool completed] ${name}`;
+    }
+}
 const SURFACE_LABELS = {
     web: 'the web app',
     cli: 'the skrr CLI',
@@ -1126,7 +1149,7 @@ class AgenticStreamClient {
             this.renderedText = this.accumulated;
         }
         else if (event.type === 'tool.completed') {
-            output.write(`[tool completed] ${String(event.toolName ?? 'unknown')}\n`);
+            output.write(`${describeToolEnd(event.toolName, event.status)}\n`);
             this.renderedText = this.accumulated;
         }
         else if (event.type === 'stream.gap') {

package/dist/lib/auth-core-init.d.ts

@@ -17,6 +17,35 @@
  * says so (OSK-12135).
  */
 export declare function plainCredentialEnvelopeWarning(args: readonly unknown[]): string | null;
+/**
+ * The one line an EXPECTED credential-key change prints (OSK-12186).
+ *
+ * When the key that wraps this profile's credential key changes underneath it
+ * — a Dedicated guest moved to a new image gets a new `/etc/machine-id`, which
+ * the Linux key is derived from; a new Mac or a reset Keychain does the same —
+ * auth-core cannot unwrap the old key, enrolls a new one and carries on. That
+ * is recovery, not damage, but it reached the terminal as four warnings: the
+ * unwrap failure, the rotation notice, and one decrypt failure per credential
+ * still sealed under the old key, each ending in a raw crypto string. The
+ * second run was clean, which is exactly what corruption does not look like.
+ *
+ * It is distinct from a GENUINELY unreadable credential (OSK-12180): there the
+ * key unwraps and one stored value still cannot be opened, nothing will fix it
+ * by itself, and that line names `skrr login`. Here the old values are
+ * unreadable BECAUSE the key was replaced, and the next step happens on its
+ * own when a local daemon can hand a credential over.
+ */
+export declare const CREDENTIAL_KEY_CHANGED_NOTICE: string;
+/**
+ * What the CLI prints for one auth-core warning: a replacement line, nothing
+ * (`''`), or null for "print it as auth-core wrote it".
+ *
+ * Stateful by design — the process that detected a key change has already
+ * told the person why every old credential is unreadable, so the per-value
+ * decrypt failures that follow add nothing. A fresh process starts clean, and
+ * a later genuinely unreadable credential still gets its own OSK-12180 line.
+ */
+export declare function createCredentialEnvelopeWarningPresenter(): (args: readonly unknown[]) => string | null;
 type DedicatedGenerationPreparationOptions = {
     machineUuid?: string;
     configDir?: string;

package/dist/lib/auth-core-init.js

@@ -3,8 +3,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CliCredentialInitializationError = void 0;
+exports.CliCredentialInitializationError = exports.CREDENTIAL_KEY_CHANGED_NOTICE = void 0;
 exports.plainCredentialEnvelopeWarning = plainCredentialEnvelopeWarning;
+exports.createCredentialEnvelopeWarningPresenter = createCredentialEnvelopeWarningPresenter;
 exports.prepareDedicatedRuntimeAuthGeneration = prepareDedicatedRuntimeAuthGeneration;
 exports.ensureAuthCoreConfigured = ensureAuthCoreConfigured;
 exports.prefetchCliAuth = prefetchCliAuth;
@@ -75,6 +76,64 @@ function plainCredentialEnvelopeWarning(args) {
     const remedy = hint === auth_core_1.DEFAULT_UNREADABLE_CREDENTIAL_HINT ? ' Run `skrr login`.' : '';
     return `warning: ${hint.trim()}.${remedy} (DEBUG=1 shows the underlying error.)`;
 }
+/**
+ * The one line an EXPECTED credential-key change prints (OSK-12186).
+ *
+ * When the key that wraps this profile's credential key changes underneath it
+ * — a Dedicated guest moved to a new image gets a new `/etc/machine-id`, which
+ * the Linux key is derived from; a new Mac or a reset Keychain does the same —
+ * auth-core cannot unwrap the old key, enrolls a new one and carries on. That
+ * is recovery, not damage, but it reached the terminal as four warnings: the
+ * unwrap failure, the rotation notice, and one decrypt failure per credential
+ * still sealed under the old key, each ending in a raw crypto string. The
+ * second run was clean, which is exactly what corruption does not look like.
+ *
+ * It is distinct from a GENUINELY unreadable credential (OSK-12180): there the
+ * key unwraps and one stored value still cannot be opened, nothing will fix it
+ * by itself, and that line names `skrr login`. Here the old values are
+ * unreadable BECAUSE the key was replaced, and the next step happens on its
+ * own when a local daemon can hand a credential over.
+ */
+exports.CREDENTIAL_KEY_CHANGED_NOTICE = "note: this machine's credential key changed (a new machine or image), so credentials " +
+    'saved under the old key can no longer be read. skrr gets a new one from the local daemon when ' +
+    'one is running; otherwise run `skrr login`. (DEBUG=1 shows the underlying error.)';
+/**
+ * What the CLI prints for one auth-core warning: a replacement line, nothing
+ * (`''`), or null for "print it as auth-core wrote it".
+ *
+ * Stateful by design — the process that detected a key change has already
+ * told the person why every old credential is unreadable, so the per-value
+ * decrypt failures that follow add nothing. A fresh process starts clean, and
+ * a later genuinely unreadable credential still gets its own OSK-12180 line.
+ */
+function createCredentialEnvelopeWarningPresenter() {
+    let keyChanged = false;
+    return (args) => {
+        const [message, metadata] = args;
+        const event = typeof message === 'string' && message.startsWith('[credEnvelope] ')
+            ? message.slice('[credEnvelope] '.length)
+            : null;
+        const meta = (metadata && typeof metadata === 'object' ? metadata : {});
+        // auth-core emits this and then, from the same branch, `kek_rotated`: the
+        // wrapped key was present and would not unwrap. The notice below is the
+        // one line for both.
+        if (event === 'cred_envelope.unwrap.failed' && meta.reason === 'wrapped_dek_unwrap_threw') {
+            return '';
+        }
+        if (event === 'cred_envelope.kek_rotated') {
+            if (keyChanged)
+                return '';
+            keyChanged = true;
+            return exports.CREDENTIAL_KEY_CHANGED_NOTICE;
+        }
+        // Every value sealed under the old key fails here now — the notice has
+        // already said why. A MALFORMED envelope is a different fact and still prints.
+        if (keyChanged && event === 'cred_envelope.read.decrypt_failed')
+            return '';
+        return plainCredentialEnvelopeWarning(args);
+    };
+}
+const presentCredentialEnvelopeWarning = createCredentialEnvelopeWarningPresenter();
 const cliLogger = {
     // The CLI is a short-lived foreground process. Trace/debug get dropped
     // unless DEBUG is set so we don't spam terminal output.
@@ -87,7 +146,9 @@ const cliLogger = {
             console.error('[auth-core info]', ...args);
     },
     warn: (...args) => {
-        const plain = process.env.DEBUG ? null : plainCredentialEnvelopeWarning(args);
+        const plain = process.env.DEBUG ? null : presentCredentialEnvelopeWarning(args);
+        if (plain === '')
+            return;
         if (plain)
             console.error(plain);
         else

package/dist/lib/credential-resolver.d.ts

@@ -64,6 +64,33 @@ export declare function resolveCredential(opts?: ResolveOptions): Promise<Resolv
  * a token (e.g., just post-login) don't need to re-resolve.
  */
 export declare function kindOf(token: string | null | undefined): TokenKind;
+/**
+ * Where an in-memory credential ACTUALLY came from, when the shared
+ * `CredentialSource` union has no slot for it.
+ *
+ * Two CLI paths hold a token that was never read from `OVERSKY_TOKEN` yet
+ * are recorded as `env-token` — the union's only "a token this process holds
+ * in memory" slot, and the one `ensureFreshCliCredential` correctly skips: a
+ * daemon hand-off redeem (renewed by re-redeeming its descriptor) and a
+ * daemon-launched Agent session (`OVERSKY_SESSION_TOKEN`). Labelling either
+ * by the slot alone printed `Token source: OVERSKY_TOKEN` for a variable
+ * that was not set, which sends a debugging user to the wrong place
+ * (OSK-12185). The provenance travels BESIDE the credential so the slot keeps
+ * its refresh semantics and the label tells the truth.
+ */
+export type CredentialProvenance = {
+    kind: 'daemon-handoff';
+    descriptorPath?: string;
+} | {
+    kind: 'daemon-delegated';
+} | {
+    kind: 'agent-session';
+};
+/**
+ * The label `whoami`, `context` and `doctor` print — text and `--json` read
+ * the same value. A recorded provenance wins over the source slot.
+ */
+export declare function describeCredentialSource(source: CredentialSource, provenance?: CredentialProvenance | null): string;
 /**
  * Human-readable label for a `CredentialSource`. Used by `skrr whoami`
  * and (Phase H) `skrr doctor`.

package/dist/lib/credential-resolver.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveTrustedAutonomousCredential = resolveTrustedAutonomousCredential;
 exports.resolveCredential = resolveCredential;
 exports.kindOf = kindOf;
+exports.describeCredentialSource = describeCredentialSource;
 exports.formatCredentialSource = formatCredentialSource;
 /**
  * credential-resolver.ts — Phase H.1 precedence for the Sky CLI.
@@ -118,6 +119,24 @@ async function resolveCredential(opts = {}) {
 function kindOf(token) {
     return (0, auth_core_1.classifyTokenKind)(token);
 }
+/**
+ * The label `whoami`, `context` and `doctor` print — text and `--json` read
+ * the same value. A recorded provenance wins over the source slot.
+ */
+function describeCredentialSource(source, provenance) {
+    if (provenance?.kind === 'daemon-handoff') {
+        return provenance.descriptorPath
+            ? `daemon hand-off (${provenance.descriptorPath})`
+            : 'daemon hand-off';
+    }
+    if (provenance?.kind === 'daemon-delegated') {
+        return 'daemon delegated credential (OVERSKY_DELEGATED_CLI_BROKER_URL)';
+    }
+    if (provenance?.kind === 'agent-session') {
+        return 'agent session (OVERSKY_SESSION_TOKEN)';
+    }
+    return formatCredentialSource(source);
+}
 /**
  * Human-readable label for a `CredentialSource`. Used by `skrr whoami`
  * and (Phase H) `skrr doctor`.

package/dist/lib/daemonBroker.d.ts

@@ -115,6 +115,13 @@ export interface DaemonBrokeredOutcome {
     /** Server the minted credential belongs to (daemon-reported, else the
      *  descriptor's own `serverUrl`). */
     serverUrl?: string;
+    /**
+     * The descriptor file the token was redeemed from. The token lives only in
+     * this process's memory, so this path is the only honest answer to "where
+     * did this credential come from" — `skrr whoami` prints it as the token
+     * source (OSK-12185).
+     */
+    descriptorPath?: string;
 }
 /**
  * Explicit reasons the broker path could fail. These exist to keep the

package/dist/lib/daemonBroker.js

@@ -463,6 +463,7 @@ async function brokerThrough(bootstrap, opts, sourcePath) {
                 ...((response.serverUrl ?? bootstrap.serverUrl)
                     ? { serverUrl: response.serverUrl ?? bootstrap.serverUrl }
                     : {}),
+                ...(sourcePath ? { descriptorPath: sourcePath } : {}),
             };
         }
         // The descriptor ALSO advertises the durable mint (a laptop island during