@skrr-ai/cli 0.1.56 → 0.1.57

package/dist/base-command.d.ts

@@ -109,6 +109,17 @@ export declare abstract class BaseCommand extends Command {
      * silently matched nothing reaches the search.
      */
     protected resolveSpaceReference(value: string): Promise<string>;
+    /**
+     * A 24-hex value: almost always the internal `_id` copied from `--json`,
+     * which prints it first (OSK-12205). No space route accepts it, so passing it
+     * through produced a not-found or a raw 404 that never said to use `id`.
+     *
+     * One listing tells the cases apart: a space whose `id` really is this value
+     * passes through unchanged; one whose `_id` is this value fails naming the
+     * exact `id` to use. A listing that fails, or finds neither, is not proof of
+     * anything, so it keeps the old pass-through and lets the route answer.
+     */
+    private resolveObjectIdShapedSpace;
     /**
      * Turn a project reference into `{ projectRef, spaceId }`, or fail the
      * command.

package/dist/base-command.js

@@ -20,6 +20,7 @@ const core_1 = require("@oclif/core");
 Object.defineProperty(exports, "Flags", { enumerable: true, get: function () { return core_1.Flags; } });
 const option_hint_1 = require("./lib/option-hint");
 const failed_lookup_1 = require("./lib/failed-lookup");
+const internal_id_1 = require("./lib/internal-id");
 const http_error_1 = require("./lib/http-error");
 // Re-exported from its home in `lib/keychain`, beside the other profile
 // functions. It lived here while `init()` was its only caller; a lib module
@@ -260,6 +261,27 @@ class BaseCommand extends core_1.Command {
         // can't wedge the CLI; on timeout we fall through to legacy
         // plaintext and the resolver still finds the token.
         await (0, auth_core_init_1.prefetchCliAuth)();
+        // On a brokered Dedicated guest a stored cli-auth.json predates broker
+        // mode, and the broker's success path retires it (revoke + delete). That
+        // could never run when the file carried an access token: the resolver
+        // below adopted it first, and the auto-broker only asks when the resolver
+        // found nothing — so a live pre-broker family was used and kept forever
+        // (OSK-12194). Broker FIRST in exactly that case. The file is retired only
+        // after a redeem succeeds; if the broker cannot answer, the resolver still
+        // falls back to the file, so a working login is never lost to an outage.
+        // `maybeAutoBroker` applies the same skip rules as below (bare, env token,
+        // login/logout/pair), and a laptop never has the guest descriptor.
+        let earlyAutoBroker = null;
+        if (!this.bareMode && !parsed.token && (0, daemonBroker_1.shouldBrokerBeforeStoredCredential)()) {
+            earlyAutoBroker = await (0, daemonBroker_1.maybeAutoBroker)({
+                cliConfig: this.cliConfig,
+                bareMode: this.bareMode,
+                commandId: this.id,
+            });
+            if (!earlyAutoBroker.triggered)
+                earlyAutoBroker = null;
+        }
+        const brokeredFirst = earlyAutoBroker?.outcome?.ok === true;
         // Resolve credential via the Phase H.1 precedence chain. The
         // adapter then cherry-picks the token for the Authorization
         // header; we hand it a pre-resolved override so it doesn't
@@ -296,12 +318,14 @@ class BaseCommand extends core_1.Command {
         // repair that reason implies — "Not signed in. Run `skrr login`" was true
         // and pointed at the wrong fix (OSK-12149). Rate limiting and a mismatched
         // baseURL keep their own one-line hints below.
-        if (!this.resolvedCredential.token) {
-            const autoResult = await (0, daemonBroker_1.maybeAutoBroker)({
-                cliConfig: this.cliConfig,
-                bareMode: this.bareMode,
-                commandId: this.id,
-            });
+        if (!this.resolvedCredential.token || brokeredFirst) {
+            // The guest's early broker above already asked; its answer stands.
+            const autoResult = earlyAutoBroker ??
+                (await (0, daemonBroker_1.maybeAutoBroker)({
+                    cliConfig: this.cliConfig,
+                    bareMode: this.bareMode,
+                    commandId: this.id,
+                }));
             if (autoResult.triggered && autoResult.outcome) {
                 if (autoResult.outcome.ok) {
                     // Persist the cliId now so a sibling skrr process spawned
@@ -449,6 +473,8 @@ class BaseCommand extends core_1.Command {
         // Only canonical ids short-circuit. Human-readable refs are accepted by
         // some read endpoints, but space-scoped mutation endpoints require the
         // UUID, so refs go through the same exact-match resolution as titles.
+        if ((0, internal_id_1.looksLikeInternalObjectId)(query))
+            return this.resolveObjectIdShapedSpace(query);
         if (!query || (0, space_resolver_1.looksLikeCanonicalSpaceId)(query))
             return query;
         if ((0, failed_lookup_1.isFailedLookupValue)(query)) {
@@ -493,6 +519,43 @@ class BaseCommand extends core_1.Command {
             },
         });
     }
+    /**
+     * A 24-hex value: almost always the internal `_id` copied from `--json`,
+     * which prints it first (OSK-12205). No space route accepts it, so passing it
+     * through produced a not-found or a raw 404 that never said to use `id`.
+     *
+     * One listing tells the cases apart: a space whose `id` really is this value
+     * passes through unchanged; one whose `_id` is this value fails naming the
+     * exact `id` to use. A listing that fails, or finds neither, is not proof of
+     * anything, so it keeps the old pass-through and lets the route answer.
+     */
+    async resolveObjectIdShapedSpace(query) {
+        let rows = [];
+        try {
+            const response = (await data_provider_1.dataService.listSpaces({ limit: 200, includeArchived: true }));
+            rows = response?.data ?? [];
+        }
+        catch {
+            return query;
+        }
+        if (rows.some((row) => row.id === query))
+            return query;
+        const byInternalId = rows.find((row) => String(row._id ?? '') === query);
+        if (!byInternalId)
+            return query;
+        this.failWithCliError({
+            message: (0, internal_id_1.describeInternalIdMisuse)({
+                value: query,
+                noun: 'space',
+                canonicalId: typeof byInternalId.id === 'string' ? byInternalId.id : null,
+                bin: this.config.bin,
+            }),
+            code: 'SPACE_INTERNAL_ID',
+            exit: 2,
+            retryable: false,
+            details: { context: { query, id: byInternalId.id } },
+        });
+    }
     async resolveProjectReference(value, spaceFlag, opts = {}) {
         const spaceRequired = opts.spaceRequired !== false;
         const { projectRef, spaceRef } = (0, projects_1.splitQualifiedProjectRef)(value, spaceFlag);
@@ -557,6 +620,17 @@ class BaseCommand extends core_1.Command {
         const query = value.trim();
         if (!query)
             return query;
+        // A task's `id` is a UUID, so a 24-hex value is the internal `_id` that
+        // `--json` prints first. The title search it used to reach can only say
+        // "no task matching", which never names the field to use (OSK-12205).
+        if ((0, internal_id_1.looksLikeInternalObjectId)(query)) {
+            this.failWithCliError({
+                message: (0, internal_id_1.describeInternalIdMisuse)({ value: query, noun: 'task', bin: this.config.bin }),
+                code: 'TASK_INTERNAL_ID',
+                exit: 2,
+                retryable: false,
+            });
+        }
         // Before the search, not after it: `null` from a failed `jq -r` must never
         // reach the title tiers, and it should not cost a request to say so.
         if ((0, failed_lookup_1.isFailedLookupValue)(query)) {

package/dist/commands/agents/chat.js

@@ -287,9 +287,11 @@ class AgentsChat extends base_command_1.BaseCommand {
             description: 'Permission mode for THIS turn only, on a local-harness agent. It beats the agent’s and ' +
                 'the harness’s stored defaults for this turn and changes nothing else — pass it again ' +
                 'on each turn that needs it (`agents update --default-permission-mode` changes every ' +
-                'conversation of the agent). A mode the harness cannot honour runs as the one it can, ' +
-                'and run.started says which. --approve-tools is separate: it answers the approval ' +
-                'prompts a mode asks for.',
+                'conversation of the agent). A mode the harness cannot honour runs as the closest ' +
+                'STRICTER mode it can, and run.started says which; when the only mode it can run would ' +
+                'let more run without asking, the turn is refused before it starts (run.failed, ' +
+                'PERMISSION_MODE_UNSUPPORTED_BY_HARNESS). --approve-tools is separate: it answers the ' +
+                'approval prompts a mode asks for.',
             options: ['default', 'acceptEdits', 'bypassPermissions', 'plan'],
         }),
         'local-skill': core_1.Flags.string({

package/dist/commands/agents/create.js

@@ -9,6 +9,7 @@ const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const agent_visual_refs_1 = require("../../lib/agent-visual-refs");
 const runtime_tool_support_1 = require("../../lib/runtime-tool-support");
+const agent_model_check_1 = require("../../lib/agent-model-check");
 const base_command_1 = require("../../base-command");
 const execution_target_1 = require("../../lib/execution-target");
 const prompt_1 = require("../../lib/prompt");
@@ -407,6 +408,12 @@ class AgentsCreate extends base_command_1.BaseCommand {
             this.warn(unappliedPayloadKeysWarning(unapplied));
         }
         await (0, runtime_tool_support_1.warnPluginsNotLoaded)(payload.tools, (message) => this.warn(message));
+        await (0, agent_model_check_1.warnIfModelNotListed)({
+            model: payload.model,
+            agent: created,
+            bin: this.config.bin,
+            warn: (message) => this.warn(message),
+        });
         if (flags.json) {
             this.log(JSON.stringify((0, web_url_1.withAgentUrl)(this.cliConfig.baseURL, created), null, 2));
             return;

package/dist/commands/agents/update.js

@@ -10,6 +10,7 @@ const data_provider_1 = require("@skrr-ai/data-provider");
 const agent_visual_refs_1 = require("../../lib/agent-visual-refs");
 const create_1 = require("./create");
 const runtime_tool_support_1 = require("../../lib/runtime-tool-support");
+const agent_model_check_1 = require("../../lib/agent-model-check");
 const base_command_1 = require("../../base-command");
 const execution_target_1 = require("../../lib/execution-target");
 const prompt_1 = require("../../lib/prompt");
@@ -221,6 +222,12 @@ class AgentsUpdate extends base_command_1.BaseCommand {
         for (const warning of agentUpdateWarnings(payload, updated))
             this.warn(warning);
         await (0, runtime_tool_support_1.warnPluginsNotLoaded)(payload.tools, (message) => this.warn(message));
+        await (0, agent_model_check_1.warnIfModelNotListed)({
+            model: payload.model,
+            agent: updated,
+            bin: this.config.bin,
+            warn: (message) => this.warn(message),
+        });
         if (flags.json) {
             this.log(JSON.stringify((0, web_url_1.withAgentUrl)(this.cliConfig.baseURL, updated), null, 2));
             return;

package/dist/commands/login.js

@@ -234,6 +234,20 @@ class Login extends base_command_1.BaseCommand {
                 if (handoff.status === 'delivered') {
                     this.log(`The local daemon was signed in too — ${handoff.detail}.`);
                 }
+                else if (handoff.reason === 'foreign-root') {
+                    // Not a failure and not a hint to re-login anything: the daemon is
+                    // the default root's, and this is a second root (OSK-12189).
+                    this.log(`The local daemon was left as it was — ${handoff.detail}.`);
+                }
+                else if (handoff.reason === 'mint-refused') {
+                    // The server refused before the daemon was touched, so its own
+                    // credential is exactly what it was. Saying "not signed in" here sent
+                    // people to re-login a healthy daemon (OSK-12189).
+                    this.log(`This login was not handed to the local daemon (${handoff.detail}). ` +
+                        `The daemon keeps whatever sign-in it already had — check it with ` +
+                        `\`${this.config.bin} daemon status\`, and run \`${this.config.bin} daemon login\` ` +
+                        `only if that says it is signed out.`);
+                }
                 else if (handoff.status === 'failed') {
                     this.log(`The local daemon was not signed in (${handoff.detail}). ` +
                         `Run \`${this.config.bin} daemon login\` to finish.`);

package/dist/commands/tasks/move.js

@@ -3,6 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const api_fetch_1 = require("../../lib/api-fetch");
+const http_error_1 = require("../../lib/http-error");
+const workflow_state_hint_1 = require("../../lib/workflow-state-hint");
 const session_task_endpoints_1 = require("../../lib/session-task-endpoints");
 const base_command_1 = require("../../base-command");
 const task_closure_1 = require("../../lib/task-closure");
@@ -129,6 +131,15 @@ class TasksMove extends base_command_1.BaseCommand {
             }
         }
         catch (err) {
+            const unknownState = (0, workflow_state_hint_1.describeUnknownWorkflowState)((0, http_error_1.httpBodyOf)(err), this.config.bin);
+            if (unknownState) {
+                this.failWithCliError({
+                    message: unknownState,
+                    code: 'WORKFLOW_STATE_UNKNOWN',
+                    exit: 2,
+                    retryable: false,
+                });
+            }
             this.handleApiError(err);
         }
         if (flags.json) {

package/dist/lib/agent-model-check.d.ts

@@ -0,0 +1,19 @@
+interface ModelsReport {
+    provider?: string | null;
+    source?: string;
+    sourceReason?: string;
+    models?: Array<{
+        value?: string;
+    }>;
+}
+/** The harness the saved agent runs on first, as the write response names it. */
+export declare function primaryHarnessId(agent: unknown): string | null;
+export declare function describeUnlistedModel(model: string | undefined, report: ModelsReport | undefined, harnessId: string, bin: string): string | null;
+/** Best effort: a check that cannot run says nothing rather than failing the save. */
+export declare function warnIfModelNotListed(opts: {
+    model: string | undefined;
+    agent: unknown;
+    bin: string;
+    warn: (message: string) => void;
+}): Promise<void>;
+export {};

package/dist/lib/agent-model-check.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.primaryHarnessId = primaryHarnessId;
+exports.describeUnlistedModel = describeUnlistedModel;
+exports.warnIfModelNotListed = warnIfModelNotListed;
+const harnesses_1 = require("./harnesses");
+/**
+ * A model id the agent's harness does not list, said at save time (OSK-12205).
+ *
+ * `agents create/update --model <id>` stored any well-formed id without a
+ * word; the first anyone heard of a typo was a failed turn, whose remedy then
+ * sent a local agent to "publish the agent". The server only validates the
+ * id's SHAPE on write — asking the daemon for its live list on every PATCH
+ * would put a machine round-trip on the write path — so the check lives here,
+ * after the write, and never fails the command.
+ *
+ * Only a list that speaks for the harness can say "not there": `live` (the
+ * installed harness enumerated it) or `managed` (the admission policy). A
+ * `curated` list is our suggestion, so a miss against it is reported as
+ * unverified, with the reason the live list was unavailable.
+ */
+/** Not model names: "no selection", which runs the harness default. */
+const SENTINELS = new Set(['', 'default', 'auto']);
+/** The harness the saved agent runs on first, as the write response names it. */
+function primaryHarnessId(agent) {
+    const record = (agent ?? {});
+    if (typeof record.harnessId === 'string' && record.harnessId)
+        return record.harnessId;
+    const policy = record.executionPolicy;
+    const target = (policy?.targets ?? []).find((t) => t?.kind === 'harness' && t.enabled !== false && typeof t.harnessId === 'string');
+    return target?.harnessId ?? null;
+}
+function describeUnlistedModel(model, report, harnessId, bin) {
+    const id = typeof model === 'string' ? model.trim() : '';
+    if (SENTINELS.has(id.toLowerCase()))
+        return null;
+    const listed = (report?.models ?? []).some((entry) => entry?.value === id);
+    if (listed)
+        return null;
+    const provider = report?.provider || 'this';
+    const remedy = `\`${bin} harnesses models ${harnessId}\` lists what it can run.`;
+    if (report?.source === 'live' || report?.source === 'managed') {
+        return (`Model '${id}' is not in the ${provider} harness's ${report.source} model list ` +
+            `(${harnessId}). It was saved, but a turn fails when the harness refuses it. ${remedy}`);
+    }
+    const why = report?.sourceReason ? ` (${report.sourceReason})` : '';
+    return (`Model '${id}' is not in the suggested list for the ${provider} harness, and the ` +
+        `harness's live list was unavailable${why}, so it could not be checked. It was saved. ` +
+        remedy);
+}
+/** Best effort: a check that cannot run says nothing rather than failing the save. */
+async function warnIfModelNotListed(opts) {
+    const id = typeof opts.model === 'string' ? opts.model.trim() : '';
+    if (SENTINELS.has(id.toLowerCase()))
+        return;
+    const harnessId = primaryHarnessId(opts.agent);
+    if (!harnessId)
+        return;
+    try {
+        const report = (await (0, harnesses_1.getHarnessModels)(harnessId));
+        const message = describeUnlistedModel(id, report, harnessId, opts.bin);
+        if (message)
+            opts.warn(message);
+    }
+    catch {
+        /* the save stands; the harness list is a hint */
+    }
+}

package/dist/lib/agentic-stream.d.ts

@@ -365,6 +365,12 @@ export declare class AgenticStreamClient {
     private readonly toolNamesByCall;
     /** `permission-ask` requestId → tool name, to name its resolution (OSK-12113). */
     private readonly toolNamesByPermission;
+    /**
+     * Permission prompts on the terminal still waiting for an answer, by
+     * toolUseId, so a server `permission:cancel` can close the one it names
+     * (OSK-12197) instead of leaving `[y/N]` open after the run stopped asking.
+     */
+    private readonly openPermissionPrompts;
     /** Text already written to the terminal, for suffix-only rendering. */
     private renderedText;
     private idleTimer;
@@ -443,6 +449,12 @@ export declare class AgenticStreamClient {
     private installHandlers;
     private handlePermission;
     private handleQuestion;
+    /**
+     * The server closed a permission request (OSK-12197): it expired unanswered,
+     * the pre-execution step gave up, or another surface answered it. Say so,
+     * and close the terminal prompt if this client is still showing it.
+     */
+    private handlePermissionCancel;
     private ask;
     /**
      * True the first time this (kind, identity) pair is seen; false afterwards.

package/dist/lib/agentic-stream.js

@@ -557,6 +557,12 @@ class AgenticStreamClient {
     toolNamesByCall = new Map();
     /** `permission-ask` requestId → tool name, to name its resolution (OSK-12113). */
     toolNamesByPermission = new Map();
+    /**
+     * Permission prompts on the terminal still waiting for an answer, by
+     * toolUseId, so a server `permission:cancel` can close the one it names
+     * (OSK-12197) instead of leaving `[y/N]` open after the run stopped asking.
+     */
+    openPermissionPrompts = new Map();
     /** Text already written to the terminal, for suffix-only rendering. */
     renderedText = '';
     idleTimer = null;
@@ -946,6 +952,11 @@ class AgenticStreamClient {
                 return;
             void this.handlePermission(event);
         });
+        socket.on('permission:cancel', (event) => {
+            if (!match(event))
+                return;
+            this.handlePermissionCancel(event);
+        });
         socket.on('question:ask', (event) => {
             if (match(event))
                 void this.handleQuestion(event);
@@ -1008,7 +1019,16 @@ class AgenticStreamClient {
             });
             return;
         }
-        const answer = await this.ask(`Allow ${describePermission(event)}? [y/N] `);
+        const prompt = new AbortController();
+        if (event.toolUseId)
+            this.openPermissionPrompts.set(event.toolUseId, prompt);
+        const answer = await this.ask(`Allow ${describePermission(event)}? [y/N] `, prompt.signal);
+        if (event.toolUseId)
+            this.openPermissionPrompts.delete(event.toolUseId);
+        // Closed by the server (it stopped waiting, or another surface answered):
+        // there is nothing left to answer, and a late "no" would read as a person's.
+        if (prompt.signal.aborted)
+            return;
         const approved = /^y(es)?$/i.test(answer.trim());
         this.socket.emit(approved ? 'permission:approve' : 'permission:deny', {
             sessionId: this.options.sessionId,
@@ -1064,10 +1084,36 @@ class AgenticStreamClient {
             ...(interactive ? {} : { nonInteractive: true }),
         });
     }
-    ask(prompt) {
+    /**
+     * The server closed a permission request (OSK-12197): it expired unanswered,
+     * the pre-execution step gave up, or another surface answered it. Say so,
+     * and close the terminal prompt if this client is still showing it.
+     */
+    handlePermissionCancel(event) {
+        const toolUseId = typeof event.toolUseId === 'string' ? event.toolUseId : undefined;
+        const open = toolUseId ? this.openPermissionPrompts.get(toolUseId) : undefined;
+        // Every answer is echoed to the whole session as `answered` — including
+        // this client's own. Only one that closes a prompt still open HERE is news.
+        if (event.reason === 'answered' && !open)
+            return;
+        if (!this.firstTimeSeen('permission-cancel', toolUseId))
+            return;
+        if (toolUseId)
+            this.openPermissionPrompts.delete(toolUseId);
+        open?.abort();
+        this.emit({
+            ...event,
+            type: 'permission.cancelled',
+            promptClosed: Boolean(open),
+            ...(event.reason === 'answered' && !event.message
+                ? { message: 'answered on another surface' }
+                : {}),
+        });
+    }
+    ask(prompt, signal) {
         // A prompt raised after close has nobody to answer it, and re-creating the
         // interface here would resurrect stdin for a run that is already over.
-        if (this.closed)
+        if (this.closed || signal?.aborted)
             return Promise.resolve('');
         if (!this.readline) {
             this.readline = (0, node_readline_1.createInterface)({
@@ -1075,7 +1121,15 @@ class AgenticStreamClient {
                 output: process.stderr,
             });
         }
-        return new Promise((resolve) => this.readline.question(prompt, resolve));
+        if (!signal) {
+            return new Promise((resolve) => this.readline.question(prompt, resolve));
+        }
+        return new Promise((resolve) => {
+            // readline does not call back for a question aborted by its signal, so
+            // the abort settles the prompt itself.
+            signal.addEventListener('abort', () => resolve(''), { once: true });
+            this.readline.question(prompt, { signal }, resolve);
+        });
     }
     /**
      * True the first time this (kind, identity) pair is seen; false afterwards.
@@ -1176,6 +1230,15 @@ class AgenticStreamClient {
             output.write(`\n[${event.type}] ${describePermission(event)}\n`);
             this.renderedText = this.accumulated;
         }
+        else if (event.type === 'permission.cancelled') {
+            // A request the run stopped waiting for (OSK-12197). Without this line
+            // an expired approval looked exactly like one still being asked.
+            const why = typeof event.message === 'string' && event.message
+                ? event.message
+                : `closed (${String(event.reason ?? 'cancelled')})`;
+            output.write(`\n[permission] ${String(event.toolName ?? 'tool')}: ${why}\n`);
+            this.renderedText = this.accumulated;
+        }
         else if (event.type === 'question.requested') {
             output.write(`\n[${event.type}]\n`);
             this.renderedText = this.accumulated;

package/dist/lib/auth-core-init.d.ts

@@ -36,15 +36,6 @@ export declare function plainCredentialEnvelopeWarning(args: readonly unknown[])
  * own when a local daemon can hand a credential over.
  */
 export declare const CREDENTIAL_KEY_CHANGED_NOTICE: string;
-/**
- * What the CLI prints for one auth-core warning: a replacement line, nothing
- * (`''`), or null for "print it as auth-core wrote it".
- *
- * Stateful by design — the process that detected a key change has already
- * told the person why every old credential is unreadable, so the per-value
- * decrypt failures that follow add nothing. A fresh process starts clean, and
- * a later genuinely unreadable credential still gets its own OSK-12180 line.
- */
 export declare function createCredentialEnvelopeWarningPresenter(): (args: readonly unknown[]) => string | null;
 type DedicatedGenerationPreparationOptions = {
     machineUuid?: string;

package/dist/lib/auth-core-init.js

@@ -106,6 +106,8 @@ exports.CREDENTIAL_KEY_CHANGED_NOTICE = "note: this machine's credential key cha
  * decrypt failures that follow add nothing. A fresh process starts clean, and
  * a later genuinely unreadable credential still gets its own OSK-12180 line.
  */
+/** auth-core's device-identity warning for a private key it could not open. */
+const DEVICE_KEY_DECRYPT_FAILED = '[deviceIdentity] private_key_decrypt_failed';
 function createCredentialEnvelopeWarningPresenter() {
     let keyChanged = false;
     return (args) => {
@@ -130,6 +132,13 @@ function createCredentialEnvelopeWarningPresenter() {
         // already said why. A MALFORMED envelope is a different fact and still prints.
         if (keyChanged && event === 'cred_envelope.read.decrypt_failed')
             return '';
+        // The device private key is one of those values: auth-core's device
+        // identity loads it next, cannot open it, and mints a new keypair. It
+        // logs that through its own `[deviceIdentity]` prefix, which reached the
+        // terminal as a raw `[auth-core warn]` line right under the notice. The
+        // notice covers it; without a key change it is a real fault and prints.
+        if (keyChanged && message === DEVICE_KEY_DECRYPT_FAILED)
+            return '';
         return plainCredentialEnvelopeWarning(args);
     };
 }

package/dist/lib/auth-storage.d.ts

@@ -48,6 +48,21 @@ export interface WriteOptions {
  * retiring it. Everything else should keep using `readFromBackend()`.
  */
 export declare function readFromFile(): AuthBundle | null;
+/**
+ * The refresh family a stored `cli-auth.json` carries, whether or not it also
+ * carries an access token — for the Dedicated guest's retirement of a
+ * pre-broker file only (OSK-12194).
+ *
+ * `readFromFile()` treats a file with an empty `token` as no credential, which
+ * is right for signing in and wrong here: the realistic pre-broker shape is
+ * `{"token":"", "refreshToken":…, "serverOrigin":…}` once its access token
+ * lapsed, and a reader that returns nothing for it retires nothing. Same
+ * ownership rules as `readFromFile()`; never rewrites the file.
+ */
+export declare function readRefreshFamilyFromFile(): {
+    refreshToken: string;
+    serverOrigin?: string;
+} | null;
 /**
  * Delete `~/.skrr/cli-auth.json` only (the keychain is untouched). Exported
  * for the brokered-hand-off migration cleanup; `skrr logout` continues to

package/dist/lib/auth-storage.js

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.backends = void 0;
 exports.readFromFile = readFromFile;
+exports.readRefreshFamilyFromFile = readRefreshFamilyFromFile;
 exports.deleteFileBackend = deleteFileBackend;
 exports.readFromBackend = readFromBackend;
 exports.describeForeignCredential = describeForeignCredential;
@@ -234,13 +235,33 @@ function judgeOwnership(bundle, me, ownSlot) {
 function readFromFile() {
     return readFileAssessed().bundle;
 }
+/**
+ * The refresh family a stored `cli-auth.json` carries, whether or not it also
+ * carries an access token — for the Dedicated guest's retirement of a
+ * pre-broker file only (OSK-12194).
+ *
+ * `readFromFile()` treats a file with an empty `token` as no credential, which
+ * is right for signing in and wrong here: the realistic pre-broker shape is
+ * `{"token":"", "refreshToken":…, "serverOrigin":…}` once its access token
+ * lapsed, and a reader that returns nothing for it retires nothing. Same
+ * ownership rules as `readFromFile()`; never rewrites the file.
+ */
+function readRefreshFamilyFromFile() {
+    const bundle = readFileAssessed({ requireAccessToken: false }).bundle;
+    if (!bundle?.refreshToken)
+        return null;
+    return {
+        refreshToken: bundle.refreshToken,
+        ...(bundle.serverOrigin ? { serverOrigin: bundle.serverOrigin } : {}),
+    };
+}
 /**
  * This root's file, refused when it belongs to another config; else, under a
  * root override, the pre-override `$HOME/.skrr` file when it is positively ours.
  */
-function readFileAssessed() {
+function readFileAssessed(opts = {}) {
     const me = currentOwner();
-    const own = readFileAt(authFilePath(), true);
+    const own = readFileAt(authFilePath(), true, opts);
     if (own) {
         const judged = judgeOwnership(own, me, true);
         return judged.ours ? { bundle: own } : { bundle: null, foreign: judged.stored };
@@ -248,7 +269,7 @@ function readFileAssessed() {
     const legacy = legacyAuthFilePath();
     if (path.resolve(legacy) === path.resolve(authFilePath()))
         return { bundle: null };
-    const adopted = readFileAt(legacy, false);
+    const adopted = readFileAt(legacy, false, opts);
     if (adopted && judgeOwnership(adopted, me, false).ours)
         return { bundle: adopted };
     return { bundle: null };
@@ -265,7 +286,7 @@ function legacyFileIsOurs() {
  * Parse one credential file. `upgradeInPlace` lets the envelope migration
  * rewrite it — true only for this root's own file, never a migration source.
  */
-function readFileAt(p, upgradeInPlace) {
+function readFileAt(p, upgradeInPlace, opts = {}) {
     if (!fs.existsSync(p))
         return null;
     let raw;
@@ -282,7 +303,9 @@ function readFileAt(p, upgradeInPlace) {
     catch {
         return null;
     }
-    if (typeof parsed.token !== 'string' || parsed.token.length === 0) {
+    const requireAccessToken = opts.requireAccessToken !== false;
+    const hasAccessToken = typeof parsed.token === 'string' && parsed.token.length > 0;
+    if (!hasAccessToken && requireAccessToken) {
         return null;
     }
     // L12 — route the secret string fields through the envelope. Mixed
@@ -293,13 +316,16 @@ function readFileAt(p, upgradeInPlace) {
     const owner = parseOwner(parsed.owner);
     const ownerRoot = owner?.configRoot ? path.resolve(owner.configRoot) : undefined;
     const decryptOptions = ownerRoot && ownerRoot !== path.resolve((0, config_1.configRoot)()) ? { foreignOwnerRoot: ownerRoot } : {};
-    const tokenResult = (0, cred_envelope_1.maybeDecryptOnRead)(parsed.token, decryptOptions);
+    const tokenResult = hasAccessToken
+        ? (0, cred_envelope_1.maybeDecryptOnRead)(parsed.token, decryptOptions)
+        : { plaintext: '', needsMigration: false };
     if (tokenResult.plaintext === null) {
         // Envelope on disk but no DEK to unwrap → treat as missing so the
         // caller falls through to a clean `skrr login`.
         return null;
     }
-    let needsMigration = tokenResult.needsMigration;
+    // A token-less read is never written back: there is no access token to seal.
+    let needsMigration = hasAccessToken && tokenResult.needsMigration;
     const bundle = { token: tokenResult.plaintext };
     if (typeof parsed.expiresAt === 'number' && Number.isFinite(parsed.expiresAt)) {
         bundle.expiresAt = parsed.expiresAt;

package/dist/lib/commitments.js

@@ -1334,6 +1334,9 @@ function formatCommitmentExplanation(explanation) {
         : explanation.verdict === 'quiet'
             ? `Chose to stay quiet at: ${explanation.stoppedAt}`
             : `Stopped at: ${explanation.stoppedAt}`);
+    // What the next Run may do without asking — an Ask-mode Agent can ask
+    // nobody on an unattended Run (OSK-12201). Same lines as show/preflight.
+    lines.push(...permissionLines(explanation.permissions));
     return lines;
 }
 /**