@skrr-ai/cli 0.1.55 → 0.1.57

package/dist/base-command.d.ts

@@ -3,7 +3,7 @@ export { resolveProfileFromArgv } from './lib/keychain';
 import { type AssigneeResolution, type MemberKind, type SpaceMember } from './lib/assignee-resolver';
 import { type CliConfig } from './lib/config';
 import { type OutboxMethod } from './lib/outbox';
-import { type ResolvedCredential } from './lib/credential-resolver';
+import { type CredentialProvenance, type ResolvedCredential } from './lib/credential-resolver';
 import { type BrokerRefusalDescription } from './lib/daemonBrokerRefusal';
 import { type DefaultAgentResolution } from './lib/tasks';
 export declare function assigneePayloadNeedsResolution(payload: Record<string, unknown>): boolean;
@@ -68,6 +68,13 @@ export declare abstract class BaseCommand extends Command {
      * from here.
      */
     protected resolvedCredential: ResolvedCredential;
+    /**
+     * Where `resolvedCredential` really came from when its `source` slot cannot
+     * say — an in-memory daemon hand-off or Agent session token is recorded as
+     * `env-token` for refresh semantics, but was not read from OVERSKY_TOKEN
+     * (OSK-12185). Null for every stored/env/flag credential.
+     */
+    protected credentialProvenance: CredentialProvenance | null;
     protected bareMode: boolean;
     /**
      * Set when the auto-broker reached a live daemon and it REFUSED the hand-off.
@@ -102,6 +109,17 @@ export declare abstract class BaseCommand extends Command {
      * silently matched nothing reaches the search.
      */
     protected resolveSpaceReference(value: string): Promise<string>;
+    /**
+     * A 24-hex value: almost always the internal `_id` copied from `--json`,
+     * which prints it first (OSK-12205). No space route accepts it, so passing it
+     * through produced a not-found or a raw 404 that never said to use `id`.
+     *
+     * One listing tells the cases apart: a space whose `id` really is this value
+     * passes through unchanged; one whose `_id` is this value fails naming the
+     * exact `id` to use. A listing that fails, or finds neither, is not proof of
+     * anything, so it keeps the old pass-through and lets the route answer.
+     */
+    private resolveObjectIdShapedSpace;
     /**
      * Turn a project reference into `{ projectRef, spaceId }`, or fail the
      * command.

package/dist/base-command.js

@@ -20,6 +20,7 @@ const core_1 = require("@oclif/core");
 Object.defineProperty(exports, "Flags", { enumerable: true, get: function () { return core_1.Flags; } });
 const option_hint_1 = require("./lib/option-hint");
 const failed_lookup_1 = require("./lib/failed-lookup");
+const internal_id_1 = require("./lib/internal-id");
 const http_error_1 = require("./lib/http-error");
 // Re-exported from its home in `lib/keychain`, beside the other profile
 // functions. It lived here while `init()` was its only caller; a lib module
@@ -132,6 +133,13 @@ class BaseCommand extends core_1.Command {
      * from here.
      */
     resolvedCredential;
+    /**
+     * Where `resolvedCredential` really came from when its `source` slot cannot
+     * say — an in-memory daemon hand-off or Agent session token is recorded as
+     * `env-token` for refresh semantics, but was not read from OVERSKY_TOKEN
+     * (OSK-12185). Null for every stored/env/flag credential.
+     */
+    credentialProvenance = null;
     bareMode = false;
     /**
      * Set when the auto-broker reached a live daemon and it REFUSED the hand-off.
@@ -173,6 +181,7 @@ class BaseCommand extends core_1.Command {
                     return;
                 }
                 autonomousCredential = delegatedCredential;
+                this.credentialProvenance = { kind: 'daemon-delegated' };
             }
             catch (err) {
                 this.failWithCliError({
@@ -214,6 +223,10 @@ class BaseCommand extends core_1.Command {
                 delete process.env.OVERSKY_WORKSPACE_ID;
             }
             this.resolvedCredential = autonomousCredential;
+            if (!this.credentialProvenance && autonomousCredential.source === 'env-token') {
+                // `resolveTrustedAutonomousCredential` read OVERSKY_SESSION_TOKEN.
+                this.credentialProvenance = { kind: 'agent-session' };
+            }
             (0, node_adapter_1.setAdapterCredentialOverride)(this.resolvedCredential);
             (0, data_provider_1.setHttpAdapter)((0, node_adapter_1.createNodeAdapter)());
             return;
@@ -248,6 +261,27 @@ class BaseCommand extends core_1.Command {
         // can't wedge the CLI; on timeout we fall through to legacy
         // plaintext and the resolver still finds the token.
         await (0, auth_core_init_1.prefetchCliAuth)();
+        // On a brokered Dedicated guest a stored cli-auth.json predates broker
+        // mode, and the broker's success path retires it (revoke + delete). That
+        // could never run when the file carried an access token: the resolver
+        // below adopted it first, and the auto-broker only asks when the resolver
+        // found nothing — so a live pre-broker family was used and kept forever
+        // (OSK-12194). Broker FIRST in exactly that case. The file is retired only
+        // after a redeem succeeds; if the broker cannot answer, the resolver still
+        // falls back to the file, so a working login is never lost to an outage.
+        // `maybeAutoBroker` applies the same skip rules as below (bare, env token,
+        // login/logout/pair), and a laptop never has the guest descriptor.
+        let earlyAutoBroker = null;
+        if (!this.bareMode && !parsed.token && (0, daemonBroker_1.shouldBrokerBeforeStoredCredential)()) {
+            earlyAutoBroker = await (0, daemonBroker_1.maybeAutoBroker)({
+                cliConfig: this.cliConfig,
+                bareMode: this.bareMode,
+                commandId: this.id,
+            });
+            if (!earlyAutoBroker.triggered)
+                earlyAutoBroker = null;
+        }
+        const brokeredFirst = earlyAutoBroker?.outcome?.ok === true;
         // Resolve credential via the Phase H.1 precedence chain. The
         // adapter then cherry-picks the token for the Authorization
         // header; we hand it a pre-resolved override so it doesn't
@@ -284,12 +318,14 @@ class BaseCommand extends core_1.Command {
         // repair that reason implies — "Not signed in. Run `skrr login`" was true
         // and pointed at the wrong fix (OSK-12149). Rate limiting and a mismatched
         // baseURL keep their own one-line hints below.
-        if (!this.resolvedCredential.token) {
-            const autoResult = await (0, daemonBroker_1.maybeAutoBroker)({
-                cliConfig: this.cliConfig,
-                bareMode: this.bareMode,
-                commandId: this.id,
-            });
+        if (!this.resolvedCredential.token || brokeredFirst) {
+            // The guest's early broker above already asked; its answer stands.
+            const autoResult = earlyAutoBroker ??
+                (await (0, daemonBroker_1.maybeAutoBroker)({
+                    cliConfig: this.cliConfig,
+                    bareMode: this.bareMode,
+                    commandId: this.id,
+                }));
             if (autoResult.triggered && autoResult.outcome) {
                 if (autoResult.outcome.ok) {
                     // Persist the cliId now so a sibling skrr process spawned
@@ -327,6 +363,17 @@ class BaseCommand extends core_1.Command {
                                     : 'file',
                         kind: (0, auth_core_1.classifyTokenKind)(accessToken),
                     };
+                    // The slot above says `env-token`; the label must not. The token
+                    // came from the daemon's hand-off descriptor, and OVERSKY_TOKEN is
+                    // typically unset (OSK-12185).
+                    this.credentialProvenance = autoResult.outcome.brokered
+                        ? {
+                            kind: 'daemon-handoff',
+                            ...(autoResult.outcome.descriptorPath
+                                ? { descriptorPath: autoResult.outcome.descriptorPath }
+                                : {}),
+                        }
+                        : null;
                 }
                 else if ((this.brokerRefusal = (0, daemonBrokerRefusal_1.describeBrokerRefusal)(autoResult.outcome, this.config.bin))) {
                     // Reported by requireAuth(); nothing to print here.
@@ -426,6 +473,8 @@ class BaseCommand extends core_1.Command {
         // Only canonical ids short-circuit. Human-readable refs are accepted by
         // some read endpoints, but space-scoped mutation endpoints require the
         // UUID, so refs go through the same exact-match resolution as titles.
+        if ((0, internal_id_1.looksLikeInternalObjectId)(query))
+            return this.resolveObjectIdShapedSpace(query);
         if (!query || (0, space_resolver_1.looksLikeCanonicalSpaceId)(query))
             return query;
         if ((0, failed_lookup_1.isFailedLookupValue)(query)) {
@@ -470,6 +519,43 @@ class BaseCommand extends core_1.Command {
             },
         });
     }
+    /**
+     * A 24-hex value: almost always the internal `_id` copied from `--json`,
+     * which prints it first (OSK-12205). No space route accepts it, so passing it
+     * through produced a not-found or a raw 404 that never said to use `id`.
+     *
+     * One listing tells the cases apart: a space whose `id` really is this value
+     * passes through unchanged; one whose `_id` is this value fails naming the
+     * exact `id` to use. A listing that fails, or finds neither, is not proof of
+     * anything, so it keeps the old pass-through and lets the route answer.
+     */
+    async resolveObjectIdShapedSpace(query) {
+        let rows = [];
+        try {
+            const response = (await data_provider_1.dataService.listSpaces({ limit: 200, includeArchived: true }));
+            rows = response?.data ?? [];
+        }
+        catch {
+            return query;
+        }
+        if (rows.some((row) => row.id === query))
+            return query;
+        const byInternalId = rows.find((row) => String(row._id ?? '') === query);
+        if (!byInternalId)
+            return query;
+        this.failWithCliError({
+            message: (0, internal_id_1.describeInternalIdMisuse)({
+                value: query,
+                noun: 'space',
+                canonicalId: typeof byInternalId.id === 'string' ? byInternalId.id : null,
+                bin: this.config.bin,
+            }),
+            code: 'SPACE_INTERNAL_ID',
+            exit: 2,
+            retryable: false,
+            details: { context: { query, id: byInternalId.id } },
+        });
+    }
     async resolveProjectReference(value, spaceFlag, opts = {}) {
         const spaceRequired = opts.spaceRequired !== false;
         const { projectRef, spaceRef } = (0, projects_1.splitQualifiedProjectRef)(value, spaceFlag);
@@ -534,6 +620,17 @@ class BaseCommand extends core_1.Command {
         const query = value.trim();
         if (!query)
             return query;
+        // A task's `id` is a UUID, so a 24-hex value is the internal `_id` that
+        // `--json` prints first. The title search it used to reach can only say
+        // "no task matching", which never names the field to use (OSK-12205).
+        if ((0, internal_id_1.looksLikeInternalObjectId)(query)) {
+            this.failWithCliError({
+                message: (0, internal_id_1.describeInternalIdMisuse)({ value: query, noun: 'task', bin: this.config.bin }),
+                code: 'TASK_INTERNAL_ID',
+                exit: 2,
+                retryable: false,
+            });
+        }
         // Before the search, not after it: `null` from a failed `jq -r` must never
         // reach the title tiers, and it should not cost a request to say so.
         if ((0, failed_lookup_1.isFailedLookupValue)(query)) {
@@ -821,7 +918,7 @@ class BaseCommand extends core_1.Command {
     credentialSourceLabel() {
         if (!this.resolvedCredential?.token)
             return null;
-        return (0, credential_resolver_1.formatCredentialSource)(this.resolvedCredential.source);
+        return (0, credential_resolver_1.describeCredentialSource)(this.resolvedCredential.source, this.credentialProvenance);
     }
     async catch(err) {
         if (isOclifExitError(err)) {

package/dist/commands/agents/chat.js

@@ -287,9 +287,11 @@ class AgentsChat extends base_command_1.BaseCommand {
             description: 'Permission mode for THIS turn only, on a local-harness agent. It beats the agent’s and ' +
                 'the harness’s stored defaults for this turn and changes nothing else — pass it again ' +
                 'on each turn that needs it (`agents update --default-permission-mode` changes every ' +
-                'conversation of the agent). A mode the harness cannot honour runs as the one it can, ' +
-                'and run.started says which. --approve-tools is separate: it answers the approval ' +
-                'prompts a mode asks for.',
+                'conversation of the agent). A mode the harness cannot honour runs as the closest ' +
+                'STRICTER mode it can, and run.started says which; when the only mode it can run would ' +
+                'let more run without asking, the turn is refused before it starts (run.failed, ' +
+                'PERMISSION_MODE_UNSUPPORTED_BY_HARNESS). --approve-tools is separate: it answers the ' +
+                'approval prompts a mode asks for.',
             options: ['default', 'acceptEdits', 'bypassPermissions', 'plan'],
         }),
         'local-skill': core_1.Flags.string({

package/dist/commands/agents/create.js

@@ -9,6 +9,7 @@ const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const agent_visual_refs_1 = require("../../lib/agent-visual-refs");
 const runtime_tool_support_1 = require("../../lib/runtime-tool-support");
+const agent_model_check_1 = require("../../lib/agent-model-check");
 const base_command_1 = require("../../base-command");
 const execution_target_1 = require("../../lib/execution-target");
 const prompt_1 = require("../../lib/prompt");
@@ -407,6 +408,12 @@ class AgentsCreate extends base_command_1.BaseCommand {
             this.warn(unappliedPayloadKeysWarning(unapplied));
         }
         await (0, runtime_tool_support_1.warnPluginsNotLoaded)(payload.tools, (message) => this.warn(message));
+        await (0, agent_model_check_1.warnIfModelNotListed)({
+            model: payload.model,
+            agent: created,
+            bin: this.config.bin,
+            warn: (message) => this.warn(message),
+        });
         if (flags.json) {
             this.log(JSON.stringify((0, web_url_1.withAgentUrl)(this.cliConfig.baseURL, created), null, 2));
             return;

package/dist/commands/agents/update.js

@@ -10,6 +10,7 @@ const data_provider_1 = require("@skrr-ai/data-provider");
 const agent_visual_refs_1 = require("../../lib/agent-visual-refs");
 const create_1 = require("./create");
 const runtime_tool_support_1 = require("../../lib/runtime-tool-support");
+const agent_model_check_1 = require("../../lib/agent-model-check");
 const base_command_1 = require("../../base-command");
 const execution_target_1 = require("../../lib/execution-target");
 const prompt_1 = require("../../lib/prompt");
@@ -221,6 +222,12 @@ class AgentsUpdate extends base_command_1.BaseCommand {
         for (const warning of agentUpdateWarnings(payload, updated))
             this.warn(warning);
         await (0, runtime_tool_support_1.warnPluginsNotLoaded)(payload.tools, (message) => this.warn(message));
+        await (0, agent_model_check_1.warnIfModelNotListed)({
+            model: payload.model,
+            agent: updated,
+            bin: this.config.bin,
+            warn: (message) => this.warn(message),
+        });
         if (flags.json) {
             this.log(JSON.stringify((0, web_url_1.withAgentUrl)(this.cliConfig.baseURL, updated), null, 2));
             return;

package/dist/commands/login.js

@@ -234,6 +234,20 @@ class Login extends base_command_1.BaseCommand {
                 if (handoff.status === 'delivered') {
                     this.log(`The local daemon was signed in too — ${handoff.detail}.`);
                 }
+                else if (handoff.reason === 'foreign-root') {
+                    // Not a failure and not a hint to re-login anything: the daemon is
+                    // the default root's, and this is a second root (OSK-12189).
+                    this.log(`The local daemon was left as it was — ${handoff.detail}.`);
+                }
+                else if (handoff.reason === 'mint-refused') {
+                    // The server refused before the daemon was touched, so its own
+                    // credential is exactly what it was. Saying "not signed in" here sent
+                    // people to re-login a healthy daemon (OSK-12189).
+                    this.log(`This login was not handed to the local daemon (${handoff.detail}). ` +
+                        `The daemon keeps whatever sign-in it already had — check it with ` +
+                        `\`${this.config.bin} daemon status\`, and run \`${this.config.bin} daemon login\` ` +
+                        `only if that says it is signed out.`);
+                }
                 else if (handoff.status === 'failed') {
                     this.log(`The local daemon was not signed in (${handoff.detail}). ` +
                         `Run \`${this.config.bin} daemon login\` to finish.`);

package/dist/commands/tasks/move.js

@@ -3,6 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const api_fetch_1 = require("../../lib/api-fetch");
+const http_error_1 = require("../../lib/http-error");
+const workflow_state_hint_1 = require("../../lib/workflow-state-hint");
 const session_task_endpoints_1 = require("../../lib/session-task-endpoints");
 const base_command_1 = require("../../base-command");
 const task_closure_1 = require("../../lib/task-closure");
@@ -129,6 +131,15 @@ class TasksMove extends base_command_1.BaseCommand {
             }
         }
         catch (err) {
+            const unknownState = (0, workflow_state_hint_1.describeUnknownWorkflowState)((0, http_error_1.httpBodyOf)(err), this.config.bin);
+            if (unknownState) {
+                this.failWithCliError({
+                    message: unknownState,
+                    code: 'WORKFLOW_STATE_UNKNOWN',
+                    exit: 2,
+                    retryable: false,
+                });
+            }
             this.handleApiError(err);
         }
         if (flags.json) {

package/dist/lib/agent-model-check.d.ts

@@ -0,0 +1,19 @@
+interface ModelsReport {
+    provider?: string | null;
+    source?: string;
+    sourceReason?: string;
+    models?: Array<{
+        value?: string;
+    }>;
+}
+/** The harness the saved agent runs on first, as the write response names it. */
+export declare function primaryHarnessId(agent: unknown): string | null;
+export declare function describeUnlistedModel(model: string | undefined, report: ModelsReport | undefined, harnessId: string, bin: string): string | null;
+/** Best effort: a check that cannot run says nothing rather than failing the save. */
+export declare function warnIfModelNotListed(opts: {
+    model: string | undefined;
+    agent: unknown;
+    bin: string;
+    warn: (message: string) => void;
+}): Promise<void>;
+export {};

package/dist/lib/agent-model-check.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.primaryHarnessId = primaryHarnessId;
+exports.describeUnlistedModel = describeUnlistedModel;
+exports.warnIfModelNotListed = warnIfModelNotListed;
+const harnesses_1 = require("./harnesses");
+/**
+ * A model id the agent's harness does not list, said at save time (OSK-12205).
+ *
+ * `agents create/update --model <id>` stored any well-formed id without a
+ * word; the first anyone heard of a typo was a failed turn, whose remedy then
+ * sent a local agent to "publish the agent". The server only validates the
+ * id's SHAPE on write — asking the daemon for its live list on every PATCH
+ * would put a machine round-trip on the write path — so the check lives here,
+ * after the write, and never fails the command.
+ *
+ * Only a list that speaks for the harness can say "not there": `live` (the
+ * installed harness enumerated it) or `managed` (the admission policy). A
+ * `curated` list is our suggestion, so a miss against it is reported as
+ * unverified, with the reason the live list was unavailable.
+ */
+/** Not model names: "no selection", which runs the harness default. */
+const SENTINELS = new Set(['', 'default', 'auto']);
+/** The harness the saved agent runs on first, as the write response names it. */
+function primaryHarnessId(agent) {
+    const record = (agent ?? {});
+    if (typeof record.harnessId === 'string' && record.harnessId)
+        return record.harnessId;
+    const policy = record.executionPolicy;
+    const target = (policy?.targets ?? []).find((t) => t?.kind === 'harness' && t.enabled !== false && typeof t.harnessId === 'string');
+    return target?.harnessId ?? null;
+}
+function describeUnlistedModel(model, report, harnessId, bin) {
+    const id = typeof model === 'string' ? model.trim() : '';
+    if (SENTINELS.has(id.toLowerCase()))
+        return null;
+    const listed = (report?.models ?? []).some((entry) => entry?.value === id);
+    if (listed)
+        return null;
+    const provider = report?.provider || 'this';
+    const remedy = `\`${bin} harnesses models ${harnessId}\` lists what it can run.`;
+    if (report?.source === 'live' || report?.source === 'managed') {
+        return (`Model '${id}' is not in the ${provider} harness's ${report.source} model list ` +
+            `(${harnessId}). It was saved, but a turn fails when the harness refuses it. ${remedy}`);
+    }
+    const why = report?.sourceReason ? ` (${report.sourceReason})` : '';
+    return (`Model '${id}' is not in the suggested list for the ${provider} harness, and the ` +
+        `harness's live list was unavailable${why}, so it could not be checked. It was saved. ` +
+        remedy);
+}
+/** Best effort: a check that cannot run says nothing rather than failing the save. */
+async function warnIfModelNotListed(opts) {
+    const id = typeof opts.model === 'string' ? opts.model.trim() : '';
+    if (SENTINELS.has(id.toLowerCase()))
+        return;
+    const harnessId = primaryHarnessId(opts.agent);
+    if (!harnessId)
+        return;
+    try {
+        const report = (await (0, harnesses_1.getHarnessModels)(harnessId));
+        const message = describeUnlistedModel(id, report, harnessId, opts.bin);
+        if (message)
+            opts.warn(message);
+    }
+    catch {
+        /* the save stands; the harness list is a hint */
+    }
+}

package/dist/lib/agentic-stream.d.ts

@@ -173,6 +173,16 @@ export type ProjectedToolEvent = {
  * of the run. The pairing is unambiguous within a turn.
  */
 export declare function projectDaemonToolEvents(envelopes: unknown[], namesByCall: Map<string, string>): ProjectedToolEvent[];
+/**
+ * The line printed when a tool call ends, in the words its status earns.
+ *
+ * Every end used to print `[tool completed]`, including a failed call. And a
+ * call the harness never closed — which the daemon now reports as
+ * `unreported` rather than `failed` (OSK-12188) — must read as neither: it may
+ * well have run. Its close is made when the session exits, so the line says
+ * that too, rather than let the moment it prints stand for when the call ran.
+ */
+export declare function describeToolEnd(toolName: unknown, status: unknown): string;
 /**
  * WHO or WHAT decided a permission request, as a reader needs it (OSK-12113).
  *
@@ -355,6 +365,12 @@ export declare class AgenticStreamClient {
     private readonly toolNamesByCall;
     /** `permission-ask` requestId → tool name, to name its resolution (OSK-12113). */
     private readonly toolNamesByPermission;
+    /**
+     * Permission prompts on the terminal still waiting for an answer, by
+     * toolUseId, so a server `permission:cancel` can close the one it names
+     * (OSK-12197) instead of leaving `[y/N]` open after the run stopped asking.
+     */
+    private readonly openPermissionPrompts;
     /** Text already written to the terminal, for suffix-only rendering. */
     private renderedText;
     private idleTimer;
@@ -433,6 +449,12 @@ export declare class AgenticStreamClient {
     private installHandlers;
     private handlePermission;
     private handleQuestion;
+    /**
+     * The server closed a permission request (OSK-12197): it expired unanswered,
+     * the pre-execution step gave up, or another surface answered it. Say so,
+     * and close the terminal prompt if this client is still showing it.
+     */
+    private handlePermissionCancel;
     private ask;
     /**
      * True the first time this (kind, identity) pair is seen; false afterwards.

package/dist/lib/agentic-stream.js

@@ -7,6 +7,7 @@ exports.envelopesText = envelopesText;
 exports.envelopeKey = envelopeKey;
 exports.unseenEnvelopes = unseenEnvelopes;
 exports.projectDaemonToolEvents = projectDaemonToolEvents;
+exports.describeToolEnd = describeToolEnd;
 exports.describePermissionDecider = describePermissionDecider;
 exports.projectPermissionResolutions = projectPermissionResolutions;
 exports.renderableDelta = renderableDelta;
@@ -249,6 +250,28 @@ function projectDaemonToolEvents(envelopes, namesByCall) {
     }
     return out;
 }
+/**
+ * The line printed when a tool call ends, in the words its status earns.
+ *
+ * Every end used to print `[tool completed]`, including a failed call. And a
+ * call the harness never closed — which the daemon now reports as
+ * `unreported` rather than `failed` (OSK-12188) — must read as neither: it may
+ * well have run. Its close is made when the session exits, so the line says
+ * that too, rather than let the moment it prints stand for when the call ran.
+ */
+function describeToolEnd(toolName, status) {
+    const name = String(toolName ?? 'unknown');
+    switch (status) {
+        case 'failed':
+            return `[tool failed] ${name}`;
+        case 'cancelled':
+            return `[tool cancelled] ${name}`;
+        case 'unreported':
+            return `[tool result not reported] ${name} (the harness never said how it ended; closed when the session ended)`;
+        default:
+            return `[tool completed] ${name}`;
+    }
+}
 const SURFACE_LABELS = {
     web: 'the web app',
     cli: 'the skrr CLI',
@@ -534,6 +557,12 @@ class AgenticStreamClient {
     toolNamesByCall = new Map();
     /** `permission-ask` requestId → tool name, to name its resolution (OSK-12113). */
     toolNamesByPermission = new Map();
+    /**
+     * Permission prompts on the terminal still waiting for an answer, by
+     * toolUseId, so a server `permission:cancel` can close the one it names
+     * (OSK-12197) instead of leaving `[y/N]` open after the run stopped asking.
+     */
+    openPermissionPrompts = new Map();
     /** Text already written to the terminal, for suffix-only rendering. */
     renderedText = '';
     idleTimer = null;
@@ -923,6 +952,11 @@ class AgenticStreamClient {
                 return;
             void this.handlePermission(event);
         });
+        socket.on('permission:cancel', (event) => {
+            if (!match(event))
+                return;
+            this.handlePermissionCancel(event);
+        });
         socket.on('question:ask', (event) => {
             if (match(event))
                 void this.handleQuestion(event);
@@ -985,7 +1019,16 @@ class AgenticStreamClient {
             });
             return;
         }
-        const answer = await this.ask(`Allow ${describePermission(event)}? [y/N] `);
+        const prompt = new AbortController();
+        if (event.toolUseId)
+            this.openPermissionPrompts.set(event.toolUseId, prompt);
+        const answer = await this.ask(`Allow ${describePermission(event)}? [y/N] `, prompt.signal);
+        if (event.toolUseId)
+            this.openPermissionPrompts.delete(event.toolUseId);
+        // Closed by the server (it stopped waiting, or another surface answered):
+        // there is nothing left to answer, and a late "no" would read as a person's.
+        if (prompt.signal.aborted)
+            return;
         const approved = /^y(es)?$/i.test(answer.trim());
         this.socket.emit(approved ? 'permission:approve' : 'permission:deny', {
             sessionId: this.options.sessionId,
@@ -1041,10 +1084,36 @@ class AgenticStreamClient {
             ...(interactive ? {} : { nonInteractive: true }),
         });
     }
-    ask(prompt) {
+    /**
+     * The server closed a permission request (OSK-12197): it expired unanswered,
+     * the pre-execution step gave up, or another surface answered it. Say so,
+     * and close the terminal prompt if this client is still showing it.
+     */
+    handlePermissionCancel(event) {
+        const toolUseId = typeof event.toolUseId === 'string' ? event.toolUseId : undefined;
+        const open = toolUseId ? this.openPermissionPrompts.get(toolUseId) : undefined;
+        // Every answer is echoed to the whole session as `answered` — including
+        // this client's own. Only one that closes a prompt still open HERE is news.
+        if (event.reason === 'answered' && !open)
+            return;
+        if (!this.firstTimeSeen('permission-cancel', toolUseId))
+            return;
+        if (toolUseId)
+            this.openPermissionPrompts.delete(toolUseId);
+        open?.abort();
+        this.emit({
+            ...event,
+            type: 'permission.cancelled',
+            promptClosed: Boolean(open),
+            ...(event.reason === 'answered' && !event.message
+                ? { message: 'answered on another surface' }
+                : {}),
+        });
+    }
+    ask(prompt, signal) {
         // A prompt raised after close has nobody to answer it, and re-creating the
         // interface here would resurrect stdin for a run that is already over.
-        if (this.closed)
+        if (this.closed || signal?.aborted)
             return Promise.resolve('');
         if (!this.readline) {
             this.readline = (0, node_readline_1.createInterface)({
@@ -1052,7 +1121,15 @@ class AgenticStreamClient {
                 output: process.stderr,
             });
         }
-        return new Promise((resolve) => this.readline.question(prompt, resolve));
+        if (!signal) {
+            return new Promise((resolve) => this.readline.question(prompt, resolve));
+        }
+        return new Promise((resolve) => {
+            // readline does not call back for a question aborted by its signal, so
+            // the abort settles the prompt itself.
+            signal.addEventListener('abort', () => resolve(''), { once: true });
+            this.readline.question(prompt, { signal }, resolve);
+        });
     }
     /**
      * True the first time this (kind, identity) pair is seen; false afterwards.
@@ -1126,7 +1203,7 @@ class AgenticStreamClient {
             this.renderedText = this.accumulated;
         }
         else if (event.type === 'tool.completed') {
-            output.write(`[tool completed] ${String(event.toolName ?? 'unknown')}\n`);
+            output.write(`${describeToolEnd(event.toolName, event.status)}\n`);
             this.renderedText = this.accumulated;
         }
         else if (event.type === 'stream.gap') {
@@ -1153,6 +1230,15 @@ class AgenticStreamClient {
             output.write(`\n[${event.type}] ${describePermission(event)}\n`);
             this.renderedText = this.accumulated;
         }
+        else if (event.type === 'permission.cancelled') {
+            // A request the run stopped waiting for (OSK-12197). Without this line
+            // an expired approval looked exactly like one still being asked.
+            const why = typeof event.message === 'string' && event.message
+                ? event.message
+                : `closed (${String(event.reason ?? 'cancelled')})`;
+            output.write(`\n[permission] ${String(event.toolName ?? 'tool')}: ${why}\n`);
+            this.renderedText = this.accumulated;
+        }
         else if (event.type === 'question.requested') {
             output.write(`\n[${event.type}]\n`);
             this.renderedText = this.accumulated;

package/dist/lib/auth-core-init.d.ts

@@ -17,6 +17,26 @@
  * says so (OSK-12135).
  */
 export declare function plainCredentialEnvelopeWarning(args: readonly unknown[]): string | null;
+/**
+ * The one line an EXPECTED credential-key change prints (OSK-12186).
+ *
+ * When the key that wraps this profile's credential key changes underneath it
+ * — a Dedicated guest moved to a new image gets a new `/etc/machine-id`, which
+ * the Linux key is derived from; a new Mac or a reset Keychain does the same —
+ * auth-core cannot unwrap the old key, enrolls a new one and carries on. That
+ * is recovery, not damage, but it reached the terminal as four warnings: the
+ * unwrap failure, the rotation notice, and one decrypt failure per credential
+ * still sealed under the old key, each ending in a raw crypto string. The
+ * second run was clean, which is exactly what corruption does not look like.
+ *
+ * It is distinct from a GENUINELY unreadable credential (OSK-12180): there the
+ * key unwraps and one stored value still cannot be opened, nothing will fix it
+ * by itself, and that line names `skrr login`. Here the old values are
+ * unreadable BECAUSE the key was replaced, and the next step happens on its
+ * own when a local daemon can hand a credential over.
+ */
+export declare const CREDENTIAL_KEY_CHANGED_NOTICE: string;
+export declare function createCredentialEnvelopeWarningPresenter(): (args: readonly unknown[]) => string | null;
 type DedicatedGenerationPreparationOptions = {
     machineUuid?: string;
     configDir?: string;