@skrr-ai/cli 0.1.55 → 0.1.57

package/dist/lib/auth-core-init.js

@@ -3,8 +3,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CliCredentialInitializationError = void 0;
+exports.CliCredentialInitializationError = exports.CREDENTIAL_KEY_CHANGED_NOTICE = void 0;
 exports.plainCredentialEnvelopeWarning = plainCredentialEnvelopeWarning;
+exports.createCredentialEnvelopeWarningPresenter = createCredentialEnvelopeWarningPresenter;
 exports.prepareDedicatedRuntimeAuthGeneration = prepareDedicatedRuntimeAuthGeneration;
 exports.ensureAuthCoreConfigured = ensureAuthCoreConfigured;
 exports.prefetchCliAuth = prefetchCliAuth;
@@ -75,6 +76,73 @@ function plainCredentialEnvelopeWarning(args) {
     const remedy = hint === auth_core_1.DEFAULT_UNREADABLE_CREDENTIAL_HINT ? ' Run `skrr login`.' : '';
     return `warning: ${hint.trim()}.${remedy} (DEBUG=1 shows the underlying error.)`;
 }
+/**
+ * The one line an EXPECTED credential-key change prints (OSK-12186).
+ *
+ * When the key that wraps this profile's credential key changes underneath it
+ * — a Dedicated guest moved to a new image gets a new `/etc/machine-id`, which
+ * the Linux key is derived from; a new Mac or a reset Keychain does the same —
+ * auth-core cannot unwrap the old key, enrolls a new one and carries on. That
+ * is recovery, not damage, but it reached the terminal as four warnings: the
+ * unwrap failure, the rotation notice, and one decrypt failure per credential
+ * still sealed under the old key, each ending in a raw crypto string. The
+ * second run was clean, which is exactly what corruption does not look like.
+ *
+ * It is distinct from a GENUINELY unreadable credential (OSK-12180): there the
+ * key unwraps and one stored value still cannot be opened, nothing will fix it
+ * by itself, and that line names `skrr login`. Here the old values are
+ * unreadable BECAUSE the key was replaced, and the next step happens on its
+ * own when a local daemon can hand a credential over.
+ */
+exports.CREDENTIAL_KEY_CHANGED_NOTICE = "note: this machine's credential key changed (a new machine or image), so credentials " +
+    'saved under the old key can no longer be read. skrr gets a new one from the local daemon when ' +
+    'one is running; otherwise run `skrr login`. (DEBUG=1 shows the underlying error.)';
+/**
+ * What the CLI prints for one auth-core warning: a replacement line, nothing
+ * (`''`), or null for "print it as auth-core wrote it".
+ *
+ * Stateful by design — the process that detected a key change has already
+ * told the person why every old credential is unreadable, so the per-value
+ * decrypt failures that follow add nothing. A fresh process starts clean, and
+ * a later genuinely unreadable credential still gets its own OSK-12180 line.
+ */
+/** auth-core's device-identity warning for a private key it could not open. */
+const DEVICE_KEY_DECRYPT_FAILED = '[deviceIdentity] private_key_decrypt_failed';
+function createCredentialEnvelopeWarningPresenter() {
+    let keyChanged = false;
+    return (args) => {
+        const [message, metadata] = args;
+        const event = typeof message === 'string' && message.startsWith('[credEnvelope] ')
+            ? message.slice('[credEnvelope] '.length)
+            : null;
+        const meta = (metadata && typeof metadata === 'object' ? metadata : {});
+        // auth-core emits this and then, from the same branch, `kek_rotated`: the
+        // wrapped key was present and would not unwrap. The notice below is the
+        // one line for both.
+        if (event === 'cred_envelope.unwrap.failed' && meta.reason === 'wrapped_dek_unwrap_threw') {
+            return '';
+        }
+        if (event === 'cred_envelope.kek_rotated') {
+            if (keyChanged)
+                return '';
+            keyChanged = true;
+            return exports.CREDENTIAL_KEY_CHANGED_NOTICE;
+        }
+        // Every value sealed under the old key fails here now — the notice has
+        // already said why. A MALFORMED envelope is a different fact and still prints.
+        if (keyChanged && event === 'cred_envelope.read.decrypt_failed')
+            return '';
+        // The device private key is one of those values: auth-core's device
+        // identity loads it next, cannot open it, and mints a new keypair. It
+        // logs that through its own `[deviceIdentity]` prefix, which reached the
+        // terminal as a raw `[auth-core warn]` line right under the notice. The
+        // notice covers it; without a key change it is a real fault and prints.
+        if (keyChanged && message === DEVICE_KEY_DECRYPT_FAILED)
+            return '';
+        return plainCredentialEnvelopeWarning(args);
+    };
+}
+const presentCredentialEnvelopeWarning = createCredentialEnvelopeWarningPresenter();
 const cliLogger = {
     // The CLI is a short-lived foreground process. Trace/debug get dropped
     // unless DEBUG is set so we don't spam terminal output.
@@ -87,7 +155,9 @@ const cliLogger = {
             console.error('[auth-core info]', ...args);
     },
     warn: (...args) => {
-        const plain = process.env.DEBUG ? null : plainCredentialEnvelopeWarning(args);
+        const plain = process.env.DEBUG ? null : presentCredentialEnvelopeWarning(args);
+        if (plain === '')
+            return;
         if (plain)
             console.error(plain);
         else

package/dist/lib/auth-storage.d.ts

@@ -48,6 +48,21 @@ export interface WriteOptions {
  * retiring it. Everything else should keep using `readFromBackend()`.
  */
 export declare function readFromFile(): AuthBundle | null;
+/**
+ * The refresh family a stored `cli-auth.json` carries, whether or not it also
+ * carries an access token — for the Dedicated guest's retirement of a
+ * pre-broker file only (OSK-12194).
+ *
+ * `readFromFile()` treats a file with an empty `token` as no credential, which
+ * is right for signing in and wrong here: the realistic pre-broker shape is
+ * `{"token":"", "refreshToken":…, "serverOrigin":…}` once its access token
+ * lapsed, and a reader that returns nothing for it retires nothing. Same
+ * ownership rules as `readFromFile()`; never rewrites the file.
+ */
+export declare function readRefreshFamilyFromFile(): {
+    refreshToken: string;
+    serverOrigin?: string;
+} | null;
 /**
  * Delete `~/.skrr/cli-auth.json` only (the keychain is untouched). Exported
  * for the brokered-hand-off migration cleanup; `skrr logout` continues to

package/dist/lib/auth-storage.js

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.backends = void 0;
 exports.readFromFile = readFromFile;
+exports.readRefreshFamilyFromFile = readRefreshFamilyFromFile;
 exports.deleteFileBackend = deleteFileBackend;
 exports.readFromBackend = readFromBackend;
 exports.describeForeignCredential = describeForeignCredential;
@@ -234,13 +235,33 @@ function judgeOwnership(bundle, me, ownSlot) {
 function readFromFile() {
     return readFileAssessed().bundle;
 }
+/**
+ * The refresh family a stored `cli-auth.json` carries, whether or not it also
+ * carries an access token — for the Dedicated guest's retirement of a
+ * pre-broker file only (OSK-12194).
+ *
+ * `readFromFile()` treats a file with an empty `token` as no credential, which
+ * is right for signing in and wrong here: the realistic pre-broker shape is
+ * `{"token":"", "refreshToken":…, "serverOrigin":…}` once its access token
+ * lapsed, and a reader that returns nothing for it retires nothing. Same
+ * ownership rules as `readFromFile()`; never rewrites the file.
+ */
+function readRefreshFamilyFromFile() {
+    const bundle = readFileAssessed({ requireAccessToken: false }).bundle;
+    if (!bundle?.refreshToken)
+        return null;
+    return {
+        refreshToken: bundle.refreshToken,
+        ...(bundle.serverOrigin ? { serverOrigin: bundle.serverOrigin } : {}),
+    };
+}
 /**
  * This root's file, refused when it belongs to another config; else, under a
  * root override, the pre-override `$HOME/.skrr` file when it is positively ours.
  */
-function readFileAssessed() {
+function readFileAssessed(opts = {}) {
     const me = currentOwner();
-    const own = readFileAt(authFilePath(), true);
+    const own = readFileAt(authFilePath(), true, opts);
     if (own) {
         const judged = judgeOwnership(own, me, true);
         return judged.ours ? { bundle: own } : { bundle: null, foreign: judged.stored };
@@ -248,7 +269,7 @@ function readFileAssessed() {
     const legacy = legacyAuthFilePath();
     if (path.resolve(legacy) === path.resolve(authFilePath()))
         return { bundle: null };
-    const adopted = readFileAt(legacy, false);
+    const adopted = readFileAt(legacy, false, opts);
     if (adopted && judgeOwnership(adopted, me, false).ours)
         return { bundle: adopted };
     return { bundle: null };
@@ -265,7 +286,7 @@ function legacyFileIsOurs() {
  * Parse one credential file. `upgradeInPlace` lets the envelope migration
  * rewrite it — true only for this root's own file, never a migration source.
  */
-function readFileAt(p, upgradeInPlace) {
+function readFileAt(p, upgradeInPlace, opts = {}) {
     if (!fs.existsSync(p))
         return null;
     let raw;
@@ -282,7 +303,9 @@ function readFileAt(p, upgradeInPlace) {
     catch {
         return null;
     }
-    if (typeof parsed.token !== 'string' || parsed.token.length === 0) {
+    const requireAccessToken = opts.requireAccessToken !== false;
+    const hasAccessToken = typeof parsed.token === 'string' && parsed.token.length > 0;
+    if (!hasAccessToken && requireAccessToken) {
         return null;
     }
     // L12 — route the secret string fields through the envelope. Mixed
@@ -293,13 +316,16 @@ function readFileAt(p, upgradeInPlace) {
     const owner = parseOwner(parsed.owner);
     const ownerRoot = owner?.configRoot ? path.resolve(owner.configRoot) : undefined;
     const decryptOptions = ownerRoot && ownerRoot !== path.resolve((0, config_1.configRoot)()) ? { foreignOwnerRoot: ownerRoot } : {};
-    const tokenResult = (0, cred_envelope_1.maybeDecryptOnRead)(parsed.token, decryptOptions);
+    const tokenResult = hasAccessToken
+        ? (0, cred_envelope_1.maybeDecryptOnRead)(parsed.token, decryptOptions)
+        : { plaintext: '', needsMigration: false };
     if (tokenResult.plaintext === null) {
         // Envelope on disk but no DEK to unwrap → treat as missing so the
         // caller falls through to a clean `skrr login`.
         return null;
     }
-    let needsMigration = tokenResult.needsMigration;
+    // A token-less read is never written back: there is no access token to seal.
+    let needsMigration = hasAccessToken && tokenResult.needsMigration;
     const bundle = { token: tokenResult.plaintext };
     if (typeof parsed.expiresAt === 'number' && Number.isFinite(parsed.expiresAt)) {
         bundle.expiresAt = parsed.expiresAt;

package/dist/lib/commitments.js

@@ -1334,6 +1334,9 @@ function formatCommitmentExplanation(explanation) {
         : explanation.verdict === 'quiet'
             ? `Chose to stay quiet at: ${explanation.stoppedAt}`
             : `Stopped at: ${explanation.stoppedAt}`);
+    // What the next Run may do without asking — an Ask-mode Agent can ask
+    // nobody on an unattended Run (OSK-12201). Same lines as show/preflight.
+    lines.push(...permissionLines(explanation.permissions));
     return lines;
 }
 /**

package/dist/lib/config.d.ts

@@ -190,6 +190,10 @@ export declare function isEnvAuthOverride(): boolean;
  * resolver and every existing install read it.
  */
 export declare function configRoot(env?: NodeJS.ProcessEnv): string;
+/** The root this machine uses when nothing relocates it (`~/.skrr`). */
+export declare function defaultConfigRoot(): string;
+/** Is this process on the primary root, however it was reached? */
+export declare function isDefaultConfigRoot(env?: NodeJS.ProcessEnv): boolean;
 /**
  * The machine cliId THIS config root mints when it has none stored
  * (OSK-12179). The primary root keeps the historical (host, user) id; any other

package/dist/lib/config.js

@@ -39,6 +39,8 @@ exports.describeDeployment = describeDeployment;
 exports.canonicalizeKnownBaseURL = canonicalizeKnownBaseURL;
 exports.isEnvAuthOverride = isEnvAuthOverride;
 exports.configRoot = configRoot;
+exports.defaultConfigRoot = defaultConfigRoot;
+exports.isDefaultConfigRoot = isDefaultConfigRoot;
 exports.machineCliId = machineCliId;
 exports.priorConfigDir = priorConfigDir;
 exports.loadConfig = loadConfig;
@@ -276,8 +278,8 @@ function defaultConfigRoot() {
     return (0, auth_core_1.resolveConfigRoot)({});
 }
 /** Is this process on the primary root, however it was reached? */
-function isDefaultConfigRoot() {
-    return path.resolve(configRoot()) === path.resolve(defaultConfigRoot());
+function isDefaultConfigRoot(env = process.env) {
+    return path.resolve(configRoot(env)) === path.resolve(defaultConfigRoot());
 }
 /**
  * The machine cliId THIS config root mints when it has none stored

package/dist/lib/credential-resolver.d.ts

@@ -64,6 +64,33 @@ export declare function resolveCredential(opts?: ResolveOptions): Promise<Resolv
  * a token (e.g., just post-login) don't need to re-resolve.
  */
 export declare function kindOf(token: string | null | undefined): TokenKind;
+/**
+ * Where an in-memory credential ACTUALLY came from, when the shared
+ * `CredentialSource` union has no slot for it.
+ *
+ * Two CLI paths hold a token that was never read from `OVERSKY_TOKEN` yet
+ * are recorded as `env-token` — the union's only "a token this process holds
+ * in memory" slot, and the one `ensureFreshCliCredential` correctly skips: a
+ * daemon hand-off redeem (renewed by re-redeeming its descriptor) and a
+ * daemon-launched Agent session (`OVERSKY_SESSION_TOKEN`). Labelling either
+ * by the slot alone printed `Token source: OVERSKY_TOKEN` for a variable
+ * that was not set, which sends a debugging user to the wrong place
+ * (OSK-12185). The provenance travels BESIDE the credential so the slot keeps
+ * its refresh semantics and the label tells the truth.
+ */
+export type CredentialProvenance = {
+    kind: 'daemon-handoff';
+    descriptorPath?: string;
+} | {
+    kind: 'daemon-delegated';
+} | {
+    kind: 'agent-session';
+};
+/**
+ * The label `whoami`, `context` and `doctor` print — text and `--json` read
+ * the same value. A recorded provenance wins over the source slot.
+ */
+export declare function describeCredentialSource(source: CredentialSource, provenance?: CredentialProvenance | null): string;
 /**
  * Human-readable label for a `CredentialSource`. Used by `skrr whoami`
  * and (Phase H) `skrr doctor`.

package/dist/lib/credential-resolver.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveTrustedAutonomousCredential = resolveTrustedAutonomousCredential;
 exports.resolveCredential = resolveCredential;
 exports.kindOf = kindOf;
+exports.describeCredentialSource = describeCredentialSource;
 exports.formatCredentialSource = formatCredentialSource;
 /**
  * credential-resolver.ts — Phase H.1 precedence for the Sky CLI.
@@ -118,6 +119,24 @@ async function resolveCredential(opts = {}) {
 function kindOf(token) {
     return (0, auth_core_1.classifyTokenKind)(token);
 }
+/**
+ * The label `whoami`, `context` and `doctor` print — text and `--json` read
+ * the same value. A recorded provenance wins over the source slot.
+ */
+function describeCredentialSource(source, provenance) {
+    if (provenance?.kind === 'daemon-handoff') {
+        return provenance.descriptorPath
+            ? `daemon hand-off (${provenance.descriptorPath})`
+            : 'daemon hand-off';
+    }
+    if (provenance?.kind === 'daemon-delegated') {
+        return 'daemon delegated credential (OVERSKY_DELEGATED_CLI_BROKER_URL)';
+    }
+    if (provenance?.kind === 'agent-session') {
+        return 'agent session (OVERSKY_SESSION_TOKEN)';
+    }
+    return formatCredentialSource(source);
+}
 /**
  * Human-readable label for a `CredentialSource`. Used by `skrr whoami`
  * and (Phase H) `skrr doctor`.

package/dist/lib/daemonBroker.d.ts

@@ -115,6 +115,13 @@ export interface DaemonBrokeredOutcome {
     /** Server the minted credential belongs to (daemon-reported, else the
      *  descriptor's own `serverUrl`). */
     serverUrl?: string;
+    /**
+     * The descriptor file the token was redeemed from. The token lives only in
+     * this process's memory, so this path is the only honest answer to "where
+     * did this credential come from" — `skrr whoami` prints it as the token
+     * source (OSK-12185).
+     */
+    descriptorPath?: string;
 }
 /**
  * Explicit reasons the broker path could fail. These exist to keep the
@@ -335,6 +342,24 @@ export declare function maybeRetireStoredCliAuthFile(opts: {
     descriptorPath?: string;
     descriptorServerUrl?: string;
 }): Promise<void>;
+/**
+ * Should this process broker BEFORE it reads the stored credential?
+ * (OSK-12194)
+ *
+ * True only on a brokered Dedicated guest: the guest hand-off descriptor is
+ * live and offers the access-token mode and NOT the durable mint (its secret
+ * can only redeem, so any `cli-auth.json` here predates broker mode), and that
+ * file carries a refresh family for the descriptor's own server — the same
+ * provenance guard the retirement applies.
+ *
+ * Without this, the retirement could never run: it runs after a successful
+ * redeem, the auto-broker runs only when the resolver found no token, and the
+ * resolver adopts a file that carries one — so a LIVE pre-broker family was
+ * used and kept forever, which is exactly the case the cleanup exists for.
+ * A laptop has no guest descriptor and is untouched: there `cli-auth.json` is
+ * a legitimate login.
+ */
+export declare function shouldBrokerBeforeStoredCredential(descriptorPath?: string): boolean;
 /**
  * Convenience wrapper: run the broker call and, on a durable-mint success,
  * persist the returned bundle through the canonical Sky CLI auth backend

package/dist/lib/daemonBroker.js

@@ -86,6 +86,7 @@ exports.redeemBrokeredHandoffToken = redeemBrokeredHandoffToken;
 exports.__resetBrokeredHandoffForTest = __resetBrokeredHandoffForTest;
 exports.findBrokeredHandoffDescriptor = findBrokeredHandoffDescriptor;
 exports.maybeRetireStoredCliAuthFile = maybeRetireStoredCliAuthFile;
+exports.shouldBrokerBeforeStoredCredential = shouldBrokerBeforeStoredCredential;
 exports.attemptDaemonBrokerLoginAndPersist = attemptDaemonBrokerLoginAndPersist;
 exports.maybeAutoBroker = maybeAutoBroker;
 const fs = __importStar(require("node:fs"));
@@ -463,6 +464,7 @@ async function brokerThrough(bootstrap, opts, sourcePath) {
                 ...((response.serverUrl ?? bootstrap.serverUrl)
                     ? { serverUrl: response.serverUrl ?? bootstrap.serverUrl }
                     : {}),
+                ...(sourcePath ? { descriptorPath: sourcePath } : {}),
             };
         }
         // The descriptor ALSO advertises the durable mint (a laptop island during
@@ -836,32 +838,69 @@ function findBrokeredHandoffDescriptor(profile = 'default') {
 async function maybeRetireStoredCliAuthFile(opts) {
     if (opts.descriptorPath !== exports.DEDICATED_RUNTIME_CLI_HANDOFF_DESCRIPTOR)
         return;
-    let stored;
-    try {
-        stored = (0, auth_storage_1.readFromFile)();
-    }
-    catch {
-        return;
-    }
-    if (!stored?.refreshToken)
-        return;
-    const storedOrigin = stored.serverOrigin ? (0, auth_storage_1.normalizeServerOrigin)(stored.serverOrigin) : null;
-    const descriptorOrigin = opts.descriptorServerUrl
-        ? (0, auth_storage_1.normalizeServerOrigin)(opts.descriptorServerUrl)
-        : null;
-    if (!storedOrigin || !descriptorOrigin || storedOrigin !== descriptorOrigin)
+    const stale = retirableCliAuthFamily(opts.descriptorServerUrl);
+    if (!stale)
         return;
     // The revoke is authenticated by the refresh token itself — presenting it
     // is the proof of ownership. `revokeDaemonRefreshSession` swallows its own
     // network/HTTP failures (best-effort by contract); the delete still runs.
     try {
-        await (0, auth_core_1.revokeDaemonRefreshSession)(descriptorOrigin, stored.refreshToken);
+        await (0, auth_core_1.revokeDaemonRefreshSession)(stale.origin, stale.refreshToken);
     }
     catch {
         /* best-effort — delete proceeds regardless */
     }
     (0, auth_storage_1.deleteFileBackend)();
 }
+/**
+ * Guards 2 and 3 of the retirement above: the stored file's refresh family,
+ * when its origin matches the descriptor's. Read through
+ * `readRefreshFamilyFromFile`, which accepts a file whose access token is
+ * empty — the realistic pre-broker shape once that token lapsed, and the one
+ * `readFromFile` reports as no credential at all (OSK-12194).
+ */
+function retirableCliAuthFamily(descriptorServerUrl) {
+    let stored;
+    try {
+        stored = (0, auth_storage_1.readRefreshFamilyFromFile)();
+    }
+    catch {
+        return null;
+    }
+    if (!stored?.refreshToken)
+        return null;
+    const storedOrigin = stored.serverOrigin ? (0, auth_storage_1.normalizeServerOrigin)(stored.serverOrigin) : null;
+    const descriptorOrigin = descriptorServerUrl ? (0, auth_storage_1.normalizeServerOrigin)(descriptorServerUrl) : null;
+    if (!storedOrigin || !descriptorOrigin || storedOrigin !== descriptorOrigin)
+        return null;
+    return { origin: descriptorOrigin, refreshToken: stored.refreshToken };
+}
+/**
+ * Should this process broker BEFORE it reads the stored credential?
+ * (OSK-12194)
+ *
+ * True only on a brokered Dedicated guest: the guest hand-off descriptor is
+ * live and offers the access-token mode and NOT the durable mint (its secret
+ * can only redeem, so any `cli-auth.json` here predates broker mode), and that
+ * file carries a refresh family for the descriptor's own server — the same
+ * provenance guard the retirement applies.
+ *
+ * Without this, the retirement could never run: it runs after a successful
+ * redeem, the auto-broker runs only when the resolver found no token, and the
+ * resolver adopts a file that carries one — so a LIVE pre-broker family was
+ * used and kept forever, which is exactly the case the cleanup exists for.
+ * A laptop has no guest descriptor and is untouched: there `cli-auth.json` is
+ * a legitimate login.
+ */
+function shouldBrokerBeforeStoredCredential(descriptorPath = exports.DEDICATED_RUNTIME_CLI_HANDOFF_DESCRIPTOR) {
+    const bootstrap = readBootstrap(descriptorPath);
+    if (!bootstrap)
+        return false;
+    const modes = (0, cli_handoff_wire_1.advertisedHandoffModes)(bootstrap);
+    if (!modes.includes('access_token') || modes.includes('refresh_family'))
+        return false;
+    return retirableCliAuthFamily(bootstrap.serverUrl) !== null;
+}
 /** Bound the confirm so a slow server cannot stall a login that already worked. */
 const CONFIRM_TIMEOUT_MS = 10_000;
 /**

package/dist/lib/daemonHandoff.d.ts

@@ -40,7 +40,7 @@ export interface DaemonHandoffOutcome {
      * The two absent cases are separated because they need different work — one
      * needs a binary fetched, the other only needs the service registered.
      */
-    reason?: 'opted-out' | 'brokered' | 'no-binary' | 'legacy-binary' | 'unsupported-daemon' | 'no-service';
+    reason?: 'opted-out' | 'brokered' | 'no-binary' | 'legacy-binary' | 'unsupported-daemon' | 'no-service' | 'foreign-root' | 'mint-refused';
 }
 export declare function handOffToLocalDaemon(env?: NodeJS.ProcessEnv, opts?: {
     loginFlow?: string;

package/dist/lib/daemonHandoff.js

@@ -196,6 +196,24 @@ async function handOffToLocalDaemon(env = process.env, opts = {}) {
             detail: 'the local daemon brokered this login, so it already has a working credential',
         };
     }
+    // A relocated config root (`SKRR_CONFIG_DIR`) is a second sign-in on this
+    // machine, not the machine's sign-in. The installed daemon service carries no
+    // config-root override, so it reads the DEFAULT root — its credential, its
+    // deployment, its account belong there. Offering this root's login to it would
+    // re-point the machine at whatever this root signed in as, and when the server
+    // refused the offer the CLI used to report a healthy, signed-in daemon as
+    // "not signed in" and send the user to re-login it (OSK-12189).
+    //
+    // Decided on the root alone, before anything is spawned or minted: nothing
+    // about this machine's daemon should change because a second root signed in.
+    if (!(0, config_1.isDefaultConfigRoot)(env)) {
+        return {
+            status: 'skipped',
+            reason: 'foreign-root',
+            detail: `this login is in the config root ${(0, config_1.configRoot)(env)}; the local daemon ` +
+                `belongs to ${(0, config_1.defaultConfigRoot)()} and keeps its own sign-in`,
+        };
+    }
     const binary = (0, exec_runtime_binary_1.findRuntimeBinary)();
     if (!binary) {
         return { status: 'skipped', reason: 'no-binary', detail: 'no local daemon installed' };
@@ -264,7 +282,9 @@ async function handOffToLocalDaemon(env = process.env, opts = {}) {
         }));
     }
     catch (err) {
-        return { status: 'failed', detail: err.message };
+        // Refused BEFORE the daemon was touched: it still holds exactly the
+        // credential it had, so this is "not handed this login", never "signed out".
+        return { status: 'failed', reason: 'mint-refused', detail: err.message };
     }
     const payload = JSON.stringify({
         refreshToken: bundle.refreshToken,

package/dist/lib/internal-id.d.ts

@@ -0,0 +1,28 @@
+/**
+ * The internal Mongo `_id` handed back where a command wants the `id`.
+ *
+ * `--json` prints every row's `_id` FIRST, so it is the value a person or a
+ * script copies. Spaces and Tasks are addressed by `id` (a UUID) everywhere in
+ * the API, and no resolver accepts both forms, so `spaces show <_id>`,
+ * `tasks show <_id>` and `tasks create --space <_id>` answered with not-found
+ * or a raw HTTP 404 — true, and no help: nothing said which field to use
+ * (OSK-12205).
+ *
+ * Only the refusal lives here. Finding the `id` that goes with an `_id` needs
+ * a listing, so the caller does that (it holds the API) and passes the answer
+ * in when it has one.
+ */
+/** A 24-hex Mongo ObjectId, the shape of `_id`. */
+export declare function looksLikeInternalObjectId(value: string): boolean;
+/**
+ * The sentence for an `_id` passed where the `id` belongs.
+ *
+ * `canonicalId` is the row's `id` when the caller could find it — then the
+ * remedy is the exact value to use. Without it the remedy names the field.
+ */
+export declare function describeInternalIdMisuse(opts: {
+    value: string;
+    noun: 'space' | 'task';
+    canonicalId?: string | null;
+    bin: string;
+}): string;

package/dist/lib/internal-id.js

@@ -0,0 +1,41 @@
+"use strict";
+/**
+ * The internal Mongo `_id` handed back where a command wants the `id`.
+ *
+ * `--json` prints every row's `_id` FIRST, so it is the value a person or a
+ * script copies. Spaces and Tasks are addressed by `id` (a UUID) everywhere in
+ * the API, and no resolver accepts both forms, so `spaces show <_id>`,
+ * `tasks show <_id>` and `tasks create --space <_id>` answered with not-found
+ * or a raw HTTP 404 — true, and no help: nothing said which field to use
+ * (OSK-12205).
+ *
+ * Only the refusal lives here. Finding the `id` that goes with an `_id` needs
+ * a listing, so the caller does that (it holds the API) and passes the answer
+ * in when it has one.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.looksLikeInternalObjectId = looksLikeInternalObjectId;
+exports.describeInternalIdMisuse = describeInternalIdMisuse;
+const OBJECT_ID_RE = /^[0-9a-fA-F]{24}$/;
+/** A 24-hex Mongo ObjectId, the shape of `_id`. */
+function looksLikeInternalObjectId(value) {
+    return OBJECT_ID_RE.test(value.trim());
+}
+/**
+ * The sentence for an `_id` passed where the `id` belongs.
+ *
+ * `canonicalId` is the row's `id` when the caller could find it — then the
+ * remedy is the exact value to use. Without it the remedy names the field.
+ */
+function describeInternalIdMisuse(opts) {
+    const { value, noun, canonicalId, bin } = opts;
+    const head = `"${value.trim()}" is the internal _id of a ${noun}; commands take its \`id\``;
+    if (canonicalId) {
+        return `${head}. Use \`id\` ${canonicalId}.`;
+    }
+    const alternatives = noun === 'task'
+        ? 'the `id` field (a UUID) or the `identifier` (OSK-123) from the same --json output'
+        : 'the `id` field (a UUID) or the `identifier` (OSK-S-12) from the same --json output';
+    return (`${head}.\n` +
+        `  → use ${alternatives}; \`${bin} ${noun === 'task' ? 'tasks' : 'spaces'} list --json\` prints both.`);
+}

package/dist/lib/workflow-state-hint.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The remedy for `tasks move --status <unknown>` (OSK-12205).
+ *
+ * Workflow states are Space-local, so the CLI cannot declare them as flag
+ * options and cannot list them ahead of the refusal. The server now names the
+ * accepted states in its message (and in `details.validStates`); this adds the
+ * command that lists them with their types, and quotes the states itself when
+ * a server sent them only in `details`.
+ */
+export declare function describeUnknownWorkflowState(body: Record<string, unknown> | undefined, bin: string): string | null;

package/dist/lib/workflow-state-hint.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.describeUnknownWorkflowState = describeUnknownWorkflowState;
+/**
+ * The remedy for `tasks move --status <unknown>` (OSK-12205).
+ *
+ * Workflow states are Space-local, so the CLI cannot declare them as flag
+ * options and cannot list them ahead of the refusal. The server now names the
+ * accepted states in its message (and in `details.validStates`); this adds the
+ * command that lists them with their types, and quotes the states itself when
+ * a server sent them only in `details`.
+ */
+function describeUnknownWorkflowState(body, bin) {
+    if (!body || body.code !== 'WORKFLOW_STATE_UNKNOWN')
+        return null;
+    const details = (body.details ?? {});
+    const valid = Array.isArray(details.validStates)
+        ? details.validStates.filter((v) => typeof v === 'string')
+        : [];
+    let message = typeof body.error === 'string' && body.error ? body.error : 'Unknown workflow state';
+    if (valid.length > 0 && !message.includes(valid[0])) {
+        message += `. This Space accepts: ${valid.join(', ')}.`;
+    }
+    return (`${message}\n` +
+        `  → \`${bin} spaces states list <space-id>\` lists this Space's states with their types; ` +
+        '`--status` takes a state id or its display name.');
+}