@skrr-ai/cli 0.1.56 → 0.1.58

package/dist/lib/agentic-stream.js

@@ -557,6 +557,18 @@ class AgenticStreamClient {
     toolNamesByCall = new Map();
     /** `permission-ask` requestId → tool name, to name its resolution (OSK-12113). */
     toolNamesByPermission = new Map();
+    /**
+     * Permission prompts on the terminal still waiting for an answer, by
+     * toolUseId, so a server `permission:cancel` can close the one it names
+     * (OSK-12197) instead of leaving `[y/N]` open after the run stopped asking.
+     */
+    openPermissionPrompts = new Map();
+    /**
+     * Question prompts on the terminal still waiting for an answer, by
+     * questionId, so a server `question:cancel` can close the one it names
+     * (OSK-12208) the same way `permission:cancel` closes a permission prompt.
+     */
+    openQuestionPrompts = new Map();
     /** Text already written to the terminal, for suffix-only rendering. */
     renderedText = '';
     idleTimer = null;
@@ -946,10 +958,20 @@ class AgenticStreamClient {
                 return;
             void this.handlePermission(event);
         });
+        socket.on('permission:cancel', (event) => {
+            if (!match(event))
+                return;
+            this.handlePermissionCancel(event);
+        });
         socket.on('question:ask', (event) => {
             if (match(event))
                 void this.handleQuestion(event);
         });
+        socket.on('question:cancel', (event) => {
+            if (!match(event))
+                return;
+            this.handleQuestionCancel(event);
+        });
         socket.on('error:unauthorized', (event) => {
             if (match(event))
                 this.finish('failed', event);
@@ -1008,7 +1030,16 @@ class AgenticStreamClient {
             });
             return;
         }
-        const answer = await this.ask(`Allow ${describePermission(event)}? [y/N] `);
+        const prompt = new AbortController();
+        if (event.toolUseId)
+            this.openPermissionPrompts.set(event.toolUseId, prompt);
+        const answer = await this.ask(`Allow ${describePermission(event)}? [y/N] `, prompt.signal);
+        if (event.toolUseId)
+            this.openPermissionPrompts.delete(event.toolUseId);
+        // Closed by the server (it stopped waiting, or another surface answered):
+        // there is nothing left to answer, and a late "no" would read as a person's.
+        if (prompt.signal.aborted)
+            return;
         const approved = /^y(es)?$/i.test(answer.trim());
         this.socket.emit(approved ? 'permission:approve' : 'permission:deny', {
             sessionId: this.options.sessionId,
@@ -1043,9 +1074,20 @@ class AgenticStreamClient {
         const interactive = this.options.input !== undefined || Boolean(process.stdin.isTTY);
         const answers = {};
         if (interactive) {
+            const prompt = new AbortController();
+            if (event.questionId)
+                this.openQuestionPrompts.set(event.questionId, prompt);
             for (const question of event.questions ?? []) {
-                answers[question.header ?? question.question] = await this.ask(`${question.header ?? 'Question'}: ${question.question}\n> `);
+                if (prompt.signal.aborted)
+                    break;
+                answers[question.header ?? question.question] = await this.ask(`${question.header ?? 'Question'}: ${question.question}\n> `, prompt.signal);
             }
+            if (event.questionId)
+                this.openQuestionPrompts.delete(event.questionId);
+            // Closed by the server (it stopped waiting, or the turn ended): an answer
+            // sent now would be read by nobody, and would look like a person's.
+            if (prompt.signal.aborted)
+                return;
         }
         else {
             answers._dismissed = exports.NON_INTERACTIVE_QUESTION_DISMISSAL;
@@ -1064,10 +1106,55 @@ class AgenticStreamClient {
             ...(interactive ? {} : { nonInteractive: true }),
         });
     }
-    ask(prompt) {
+    /**
+     * The server closed a permission request (OSK-12197): it expired unanswered,
+     * the pre-execution step gave up, or another surface answered it. Say so,
+     * and close the terminal prompt if this client is still showing it.
+     */
+    handlePermissionCancel(event) {
+        const toolUseId = typeof event.toolUseId === 'string' ? event.toolUseId : undefined;
+        const open = toolUseId ? this.openPermissionPrompts.get(toolUseId) : undefined;
+        // Every answer is echoed to the whole session as `answered` — including
+        // this client's own. Only one that closes a prompt still open HERE is news.
+        if (event.reason === 'answered' && !open)
+            return;
+        if (!this.firstTimeSeen('permission-cancel', toolUseId))
+            return;
+        if (toolUseId)
+            this.openPermissionPrompts.delete(toolUseId);
+        open?.abort();
+        this.emit({
+            ...event,
+            type: 'permission.cancelled',
+            promptClosed: Boolean(open),
+            ...(event.reason === 'answered' && !event.message
+                ? { message: 'answered on another surface' }
+                : {}),
+        });
+    }
+    /**
+     * The server closed a question (OSK-12208): nobody answered it in time, or
+     * the turn ended first. Say so, and close the terminal prompt if this
+     * client is still showing it — the question twin of handlePermissionCancel.
+     */
+    handleQuestionCancel(event) {
+        const questionId = typeof event.questionId === 'string' ? event.questionId : undefined;
+        if (!this.firstTimeSeen('question-cancel', questionId))
+            return;
+        const open = questionId ? this.openQuestionPrompts.get(questionId) : undefined;
+        if (questionId)
+            this.openQuestionPrompts.delete(questionId);
+        open?.abort();
+        this.emit({
+            ...event,
+            type: 'question.cancelled',
+            promptClosed: Boolean(open),
+        });
+    }
+    ask(prompt, signal) {
         // A prompt raised after close has nobody to answer it, and re-creating the
         // interface here would resurrect stdin for a run that is already over.
-        if (this.closed)
+        if (this.closed || signal?.aborted)
             return Promise.resolve('');
         if (!this.readline) {
             this.readline = (0, node_readline_1.createInterface)({
@@ -1075,7 +1162,15 @@ class AgenticStreamClient {
                 output: process.stderr,
             });
         }
-        return new Promise((resolve) => this.readline.question(prompt, resolve));
+        if (!signal) {
+            return new Promise((resolve) => this.readline.question(prompt, resolve));
+        }
+        return new Promise((resolve) => {
+            // readline does not call back for a question aborted by its signal, so
+            // the abort settles the prompt itself.
+            signal.addEventListener('abort', () => resolve(''), { once: true });
+            this.readline.question(prompt, { signal }, resolve);
+        });
     }
     /**
      * True the first time this (kind, identity) pair is seen; false afterwards.
@@ -1176,10 +1271,27 @@ class AgenticStreamClient {
             output.write(`\n[${event.type}] ${describePermission(event)}\n`);
             this.renderedText = this.accumulated;
         }
+        else if (event.type === 'permission.cancelled') {
+            // A request the run stopped waiting for (OSK-12197). Without this line
+            // an expired approval looked exactly like one still being asked.
+            const why = typeof event.message === 'string' && event.message
+                ? event.message
+                : `closed (${String(event.reason ?? 'cancelled')})`;
+            output.write(`\n[permission] ${String(event.toolName ?? 'tool')}: ${why}\n`);
+            this.renderedText = this.accumulated;
+        }
         else if (event.type === 'question.requested') {
             output.write(`\n[${event.type}]\n`);
             this.renderedText = this.accumulated;
         }
+        else if (event.type === 'question.cancelled') {
+            // A question the run stopped waiting for (OSK-12208).
+            const why = typeof event.message === 'string' && event.message
+                ? event.message
+                : `closed (${String(event.reason ?? 'cancelled')})`;
+            output.write(`\n[question] ${why}\n`);
+            this.renderedText = this.accumulated;
+        }
         else if (event.type === 'permission.approved' && event.auto === true) {
             // Said out loud, because nobody was asked: the flag approved it, and a
             // reader of this log should see which tools that covered (OSK-10323).

package/dist/lib/auth-core-init.d.ts

@@ -36,15 +36,6 @@ export declare function plainCredentialEnvelopeWarning(args: readonly unknown[])
  * own when a local daemon can hand a credential over.
  */
 export declare const CREDENTIAL_KEY_CHANGED_NOTICE: string;
-/**
- * What the CLI prints for one auth-core warning: a replacement line, nothing
- * (`''`), or null for "print it as auth-core wrote it".
- *
- * Stateful by design — the process that detected a key change has already
- * told the person why every old credential is unreadable, so the per-value
- * decrypt failures that follow add nothing. A fresh process starts clean, and
- * a later genuinely unreadable credential still gets its own OSK-12180 line.
- */
 export declare function createCredentialEnvelopeWarningPresenter(): (args: readonly unknown[]) => string | null;
 type DedicatedGenerationPreparationOptions = {
     machineUuid?: string;

package/dist/lib/auth-core-init.js

@@ -106,6 +106,8 @@ exports.CREDENTIAL_KEY_CHANGED_NOTICE = "note: this machine's credential key cha
  * decrypt failures that follow add nothing. A fresh process starts clean, and
  * a later genuinely unreadable credential still gets its own OSK-12180 line.
  */
+/** auth-core's device-identity warning for a private key it could not open. */
+const DEVICE_KEY_DECRYPT_FAILED = '[deviceIdentity] private_key_decrypt_failed';
 function createCredentialEnvelopeWarningPresenter() {
     let keyChanged = false;
     return (args) => {
@@ -130,6 +132,13 @@ function createCredentialEnvelopeWarningPresenter() {
         // already said why. A MALFORMED envelope is a different fact and still prints.
         if (keyChanged && event === 'cred_envelope.read.decrypt_failed')
             return '';
+        // The device private key is one of those values: auth-core's device
+        // identity loads it next, cannot open it, and mints a new keypair. It
+        // logs that through its own `[deviceIdentity]` prefix, which reached the
+        // terminal as a raw `[auth-core warn]` line right under the notice. The
+        // notice covers it; without a key change it is a real fault and prints.
+        if (keyChanged && message === DEVICE_KEY_DECRYPT_FAILED)
+            return '';
         return plainCredentialEnvelopeWarning(args);
     };
 }

package/dist/lib/auth-storage.d.ts

@@ -11,7 +11,26 @@ export interface AuthBundle {
      * current config; callers never need to set it.
      */
     owner?: CredentialOwner;
+    /**
+     * Who created the refresh family this bundle carries (OSK-12293). Recorded
+     * in the file in plaintext, like `owner`, so it can be read without the key.
+     * Absent on everything an older CLI wrote.
+     */
+    provenance?: CredentialProvenance;
 }
+/**
+ * How a stored refresh family came to exist.
+ *
+ * - `user_login`: a person signed in on purpose (`skrr login` in any of its
+ *   flows, `skrr pair`). On a Dedicated guest this is the one stored family
+ *   the broker-mode retirement must never touch: the person asked for it.
+ * - `daemon_broker`: the local daemon minted it through its hand-off.
+ *
+ * An absent value means an older CLI wrote the file and the family's origin
+ * is unknown, which on a brokered guest is the pre-broker leftover the
+ * retirement exists for (OSK-12194).
+ */
+export type CredentialProvenance = 'user_login' | 'daemon_broker';
 /** Which skrr config a credential belongs to. */
 export interface CredentialOwner {
     /** Resolved config root (`~/.skrr`, or the `SKRR_CONFIG_DIR` override). */
@@ -39,6 +58,13 @@ export interface WriteOptions {
     serverOrigin?: string;
     /** Clear a stale needs-reauth latch after a server has issued fresh credentials. */
     clearReauth?: boolean;
+    /**
+     * Who created the family being written. A write that names none is a
+     * ROTATION of the stored family (a refresh), and keeps the provenance the
+     * stored file records for the same server — so a refresh never erases the
+     * marker a login wrote, and never invents one an older CLI did not.
+     */
+    provenance?: CredentialProvenance;
 }
 /**
  * File-backend-only read. Exported for the brokered-hand-off migration
@@ -48,6 +74,22 @@ export interface WriteOptions {
  * retiring it. Everything else should keep using `readFromBackend()`.
  */
 export declare function readFromFile(): AuthBundle | null;
+/**
+ * The refresh family a stored `cli-auth.json` carries, whether or not it also
+ * carries an access token — for the Dedicated guest's retirement of a
+ * pre-broker file only (OSK-12194).
+ *
+ * `readFromFile()` treats a file with an empty `token` as no credential, which
+ * is right for signing in and wrong here: the realistic pre-broker shape is
+ * `{"token":"", "refreshToken":…, "serverOrigin":…}` once its access token
+ * lapsed, and a reader that returns nothing for it retires nothing. Same
+ * ownership rules as `readFromFile()`; never rewrites the file.
+ */
+export declare function readRefreshFamilyFromFile(): {
+    refreshToken: string;
+    serverOrigin?: string;
+    provenance?: CredentialProvenance;
+} | null;
 /**
  * Delete `~/.skrr/cli-auth.json` only (the keychain is untouched). Exported
  * for the brokered-hand-off migration cleanup; `skrr logout` continues to

package/dist/lib/auth-storage.js

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.backends = void 0;
 exports.readFromFile = readFromFile;
+exports.readRefreshFamilyFromFile = readRefreshFamilyFromFile;
 exports.deleteFileBackend = deleteFileBackend;
 exports.readFromBackend = readFromBackend;
 exports.describeForeignCredential = describeForeignCredential;
@@ -105,6 +106,12 @@ const cli_id_1 = require("./cli-id");
  *  `auth.json`, deliberately distinct so the two binaries never clobber
  *  each other's tokens (CLI holds scope=cli, daemon holds scope=daemon). */
 const AUTH_FILENAME = 'cli-auth.json';
+const CREDENTIAL_PROVENANCES = ['user_login', 'daemon_broker'];
+function parseProvenance(raw) {
+    return CREDENTIAL_PROVENANCES.includes(raw)
+        ? raw
+        : undefined;
+}
 /**
  * The config root — the same one `cli-config.json` (and so `cliId`) lives in.
  *
@@ -234,13 +241,54 @@ function judgeOwnership(bundle, me, ownSlot) {
 function readFromFile() {
     return readFileAssessed().bundle;
 }
+/**
+ * The refresh family a stored `cli-auth.json` carries, whether or not it also
+ * carries an access token — for the Dedicated guest's retirement of a
+ * pre-broker file only (OSK-12194).
+ *
+ * `readFromFile()` treats a file with an empty `token` as no credential, which
+ * is right for signing in and wrong here: the realistic pre-broker shape is
+ * `{"token":"", "refreshToken":…, "serverOrigin":…}` once its access token
+ * lapsed, and a reader that returns nothing for it retires nothing. Same
+ * ownership rules as `readFromFile()`; never rewrites the file.
+ */
+function readRefreshFamilyFromFile() {
+    const bundle = readFileAssessed({ requireAccessToken: false }).bundle;
+    if (!bundle?.refreshToken)
+        return null;
+    return {
+        refreshToken: bundle.refreshToken,
+        ...(bundle.serverOrigin ? { serverOrigin: bundle.serverOrigin } : {}),
+        ...(bundle.provenance ? { provenance: bundle.provenance } : {}),
+    };
+}
+/**
+ * The provenance this root's `cli-auth.json` records for `serverOrigin`, read
+ * from the plaintext field alone — no decrypt, no ownership rewrite. Used by a
+ * rotation to carry the marker forward.
+ */
+function storedFileProvenance(serverOrigin) {
+    let parsed;
+    try {
+        parsed = JSON.parse(fs.readFileSync(authFilePath(), 'utf-8'));
+    }
+    catch {
+        return undefined;
+    }
+    const provenance = parseProvenance(parsed?.provenance);
+    if (!provenance)
+        return undefined;
+    const stored = typeof parsed.serverOrigin === 'string' ? normalizeServerOrigin(parsed.serverOrigin) : null;
+    const next = serverOrigin ? normalizeServerOrigin(serverOrigin) : null;
+    return stored && next && stored === next ? provenance : undefined;
+}
 /**
  * This root's file, refused when it belongs to another config; else, under a
  * root override, the pre-override `$HOME/.skrr` file when it is positively ours.
  */
-function readFileAssessed() {
+function readFileAssessed(opts = {}) {
     const me = currentOwner();
-    const own = readFileAt(authFilePath(), true);
+    const own = readFileAt(authFilePath(), true, opts);
     if (own) {
         const judged = judgeOwnership(own, me, true);
         return judged.ours ? { bundle: own } : { bundle: null, foreign: judged.stored };
@@ -248,7 +296,7 @@ function readFileAssessed() {
     const legacy = legacyAuthFilePath();
     if (path.resolve(legacy) === path.resolve(authFilePath()))
         return { bundle: null };
-    const adopted = readFileAt(legacy, false);
+    const adopted = readFileAt(legacy, false, opts);
     if (adopted && judgeOwnership(adopted, me, false).ours)
         return { bundle: adopted };
     return { bundle: null };
@@ -265,7 +313,7 @@ function legacyFileIsOurs() {
  * Parse one credential file. `upgradeInPlace` lets the envelope migration
  * rewrite it — true only for this root's own file, never a migration source.
  */
-function readFileAt(p, upgradeInPlace) {
+function readFileAt(p, upgradeInPlace, opts = {}) {
     if (!fs.existsSync(p))
         return null;
     let raw;
@@ -282,7 +330,9 @@ function readFileAt(p, upgradeInPlace) {
     catch {
         return null;
     }
-    if (typeof parsed.token !== 'string' || parsed.token.length === 0) {
+    const requireAccessToken = opts.requireAccessToken !== false;
+    const hasAccessToken = typeof parsed.token === 'string' && parsed.token.length > 0;
+    if (!hasAccessToken && requireAccessToken) {
         return null;
     }
     // L12 — route the secret string fields through the envelope. Mixed
@@ -293,13 +343,16 @@ function readFileAt(p, upgradeInPlace) {
     const owner = parseOwner(parsed.owner);
     const ownerRoot = owner?.configRoot ? path.resolve(owner.configRoot) : undefined;
     const decryptOptions = ownerRoot && ownerRoot !== path.resolve((0, config_1.configRoot)()) ? { foreignOwnerRoot: ownerRoot } : {};
-    const tokenResult = (0, cred_envelope_1.maybeDecryptOnRead)(parsed.token, decryptOptions);
+    const tokenResult = hasAccessToken
+        ? (0, cred_envelope_1.maybeDecryptOnRead)(parsed.token, decryptOptions)
+        : { plaintext: '', needsMigration: false };
     if (tokenResult.plaintext === null) {
         // Envelope on disk but no DEK to unwrap → treat as missing so the
         // caller falls through to a clean `skrr login`.
         return null;
     }
-    let needsMigration = tokenResult.needsMigration;
+    // A token-less read is never written back: there is no access token to seal.
+    let needsMigration = hasAccessToken && tokenResult.needsMigration;
     const bundle = { token: tokenResult.plaintext };
     if (typeof parsed.expiresAt === 'number' && Number.isFinite(parsed.expiresAt)) {
         bundle.expiresAt = parsed.expiresAt;
@@ -323,6 +376,9 @@ function readFileAt(p, upgradeInPlace) {
     }
     if (owner)
         bundle.owner = owner;
+    const provenance = parseProvenance(parsed.provenance);
+    if (provenance)
+        bundle.provenance = provenance;
     // Best-effort upgrade: re-write the bundle so legacy plaintext fields
     // become wrapped on the next read. A failure here doesn't break the
     // read path — the caller already has the plaintext bundle.
@@ -387,6 +443,8 @@ function writeToFile(bundle) {
     // Rewrites of an existing bundle (the envelope upgrade) keep its recorded
     // owner; everything else is stamped with this config.
     wireBundle.owner = bundle.owner ?? ownerFor(bundle);
+    if (bundle.provenance)
+        wireBundle.provenance = bundle.provenance;
     // tmp + rename so no racing reader ever sees a partial file; chmod 0600
     // on the final file so the same-UID blast-radius is as narrow as the
     // file backend can offer.
@@ -746,6 +804,16 @@ function writeToBackend(bundle, options = {}) {
     // Always stamp THIS config as the owner — a bundle read back and re-written
     // (e.g. `pair`) must not carry a record forward from wherever it came from.
     persistedBundle = { ...persistedBundle, owner: ownerFor(persistedBundle) };
+    // Provenance: an explicit one wins (a login or a broker mint creates a new
+    // family); otherwise this is a rotation of the stored family and keeps what
+    // the file recorded for the same server (OSK-12293).
+    const provenance = options.provenance ??
+        persistedBundle.provenance ??
+        storedFileProvenance(persistedBundle.serverOrigin);
+    if (provenance)
+        persistedBundle = { ...persistedBundle, provenance };
+    else
+        delete persistedBundle.provenance;
     let backend;
     if (keychain.isAvailable()) {
         if (writeToKeychain(persistedBundle)) {

package/dist/lib/commitments.js

@@ -660,6 +660,7 @@ const STALLED_DIAGNOSES = {
     observation_unreadable: 'the latest check could not read every configured source',
     execution_budget_exhausted: 'recent planned work was skipped — the execution budget is exhausted',
     no_advancement: 'no server-recorded advancement exists inside the declared window',
+    owner_action_blocked: 'a completed work run is blocked pending owner action',
     contract_version_mismatch: 'the running contract is older than the authored one; its triggers have not resynced',
 };
 /**
@@ -1334,6 +1335,9 @@ function formatCommitmentExplanation(explanation) {
         : explanation.verdict === 'quiet'
             ? `Chose to stay quiet at: ${explanation.stoppedAt}`
             : `Stopped at: ${explanation.stoppedAt}`);
+    // What the next Run may do without asking — an Ask-mode Agent can ask
+    // nobody on an unattended Run (OSK-12201). Same lines as show/preflight.
+    lines.push(...permissionLines(explanation.permissions));
     return lines;
 }
 /**

package/dist/lib/config.d.ts

@@ -190,6 +190,10 @@ export declare function isEnvAuthOverride(): boolean;
  * resolver and every existing install read it.
  */
 export declare function configRoot(env?: NodeJS.ProcessEnv): string;
+/** The root this machine uses when nothing relocates it (`~/.skrr`). */
+export declare function defaultConfigRoot(): string;
+/** Is this process on the primary root, however it was reached? */
+export declare function isDefaultConfigRoot(env?: NodeJS.ProcessEnv): boolean;
 /**
  * The machine cliId THIS config root mints when it has none stored
  * (OSK-12179). The primary root keeps the historical (host, user) id; any other

package/dist/lib/config.js

@@ -39,6 +39,8 @@ exports.describeDeployment = describeDeployment;
 exports.canonicalizeKnownBaseURL = canonicalizeKnownBaseURL;
 exports.isEnvAuthOverride = isEnvAuthOverride;
 exports.configRoot = configRoot;
+exports.defaultConfigRoot = defaultConfigRoot;
+exports.isDefaultConfigRoot = isDefaultConfigRoot;
 exports.machineCliId = machineCliId;
 exports.priorConfigDir = priorConfigDir;
 exports.loadConfig = loadConfig;
@@ -276,8 +278,8 @@ function defaultConfigRoot() {
     return (0, auth_core_1.resolveConfigRoot)({});
 }
 /** Is this process on the primary root, however it was reached? */
-function isDefaultConfigRoot() {
-    return path.resolve(configRoot()) === path.resolve(defaultConfigRoot());
+function isDefaultConfigRoot(env = process.env) {
+    return path.resolve(configRoot(env)) === path.resolve(defaultConfigRoot());
 }
 /**
  * The machine cliId THIS config root mints when it has none stored

package/dist/lib/daemonBroker.d.ts

@@ -329,7 +329,11 @@ export declare function findBrokeredHandoffDescriptor(profile?: string): LocalBo
  *   1. the descriptor that just redeemed IS the Dedicated Runtime guest
  *      hand-off file (`/run/skrr-dedicated-runtime/...`),
  *   2. `~/.skrr/cli-auth.json` reads cleanly and carries a refresh token,
- *   3. its stored `serverOrigin` matches the descriptor's `serverUrl`.
+ *   3. its stored `serverOrigin` matches the descriptor's `serverUrl`,
+ *   4. it is not marked `provenance: 'user_login'`. Since OSK-12293 every
+ *      explicit sign-in (`skrr login`, `skrr pair`) records that marker in
+ *      the file, so a login the person made seconds ago is kept and used;
+ *      an unmarked file was written by a CLI that predates the marker.
  *
  * When provenance can't be proven the file is KEPT: an explicit `skrr login`
  * on a guest is rare but real, and a stale extra family is bounded by the
@@ -342,6 +346,24 @@ export declare function maybeRetireStoredCliAuthFile(opts: {
     descriptorPath?: string;
     descriptorServerUrl?: string;
 }): Promise<void>;
+/**
+ * Should this process broker BEFORE it reads the stored credential?
+ * (OSK-12194)
+ *
+ * True only on a brokered Dedicated guest: the guest hand-off descriptor is
+ * live and offers the access-token mode and NOT the durable mint (its secret
+ * can only redeem, so any `cli-auth.json` here predates broker mode), and that
+ * file carries a refresh family for the descriptor's own server — the same
+ * provenance guard the retirement applies.
+ *
+ * Without this, the retirement could never run: it runs after a successful
+ * redeem, the auto-broker runs only when the resolver found no token, and the
+ * resolver adopts a file that carries one — so a LIVE pre-broker family was
+ * used and kept forever, which is exactly the case the cleanup exists for.
+ * A laptop has no guest descriptor and is untouched: there `cli-auth.json` is
+ * a legitimate login.
+ */
+export declare function shouldBrokerBeforeStoredCredential(descriptorPath?: string): boolean;
 /**
  * Convenience wrapper: run the broker call and, on a durable-mint success,
  * persist the returned bundle through the canonical Sky CLI auth backend

package/dist/lib/daemonBroker.js

@@ -86,6 +86,7 @@ exports.redeemBrokeredHandoffToken = redeemBrokeredHandoffToken;
 exports.__resetBrokeredHandoffForTest = __resetBrokeredHandoffForTest;
 exports.findBrokeredHandoffDescriptor = findBrokeredHandoffDescriptor;
 exports.maybeRetireStoredCliAuthFile = maybeRetireStoredCliAuthFile;
+exports.shouldBrokerBeforeStoredCredential = shouldBrokerBeforeStoredCredential;
 exports.attemptDaemonBrokerLoginAndPersist = attemptDaemonBrokerLoginAndPersist;
 exports.maybeAutoBroker = maybeAutoBroker;
 const fs = __importStar(require("node:fs"));
@@ -825,7 +826,11 @@ function findBrokeredHandoffDescriptor(profile = 'default') {
  *   1. the descriptor that just redeemed IS the Dedicated Runtime guest
  *      hand-off file (`/run/skrr-dedicated-runtime/...`),
  *   2. `~/.skrr/cli-auth.json` reads cleanly and carries a refresh token,
- *   3. its stored `serverOrigin` matches the descriptor's `serverUrl`.
+ *   3. its stored `serverOrigin` matches the descriptor's `serverUrl`,
+ *   4. it is not marked `provenance: 'user_login'`. Since OSK-12293 every
+ *      explicit sign-in (`skrr login`, `skrr pair`) records that marker in
+ *      the file, so a login the person made seconds ago is kept and used;
+ *      an unmarked file was written by a CLI that predates the marker.
  *
  * When provenance can't be proven the file is KEPT: an explicit `skrr login`
  * on a guest is rare but real, and a stale extra family is bounded by the
@@ -837,32 +842,76 @@ function findBrokeredHandoffDescriptor(profile = 'default') {
 async function maybeRetireStoredCliAuthFile(opts) {
     if (opts.descriptorPath !== exports.DEDICATED_RUNTIME_CLI_HANDOFF_DESCRIPTOR)
         return;
-    let stored;
-    try {
-        stored = (0, auth_storage_1.readFromFile)();
-    }
-    catch {
-        return;
-    }
-    if (!stored?.refreshToken)
-        return;
-    const storedOrigin = stored.serverOrigin ? (0, auth_storage_1.normalizeServerOrigin)(stored.serverOrigin) : null;
-    const descriptorOrigin = opts.descriptorServerUrl
-        ? (0, auth_storage_1.normalizeServerOrigin)(opts.descriptorServerUrl)
-        : null;
-    if (!storedOrigin || !descriptorOrigin || storedOrigin !== descriptorOrigin)
+    const stale = retirableCliAuthFamily(opts.descriptorServerUrl);
+    if (!stale)
         return;
     // The revoke is authenticated by the refresh token itself — presenting it
     // is the proof of ownership. `revokeDaemonRefreshSession` swallows its own
     // network/HTTP failures (best-effort by contract); the delete still runs.
     try {
-        await (0, auth_core_1.revokeDaemonRefreshSession)(descriptorOrigin, stored.refreshToken);
+        await (0, auth_core_1.revokeDaemonRefreshSession)(stale.origin, stale.refreshToken);
     }
     catch {
         /* best-effort — delete proceeds regardless */
     }
     (0, auth_storage_1.deleteFileBackend)();
 }
+/**
+ * Guards 2 and 3 of the retirement above: the stored file's refresh family,
+ * when its origin matches the descriptor's. Read through
+ * `readRefreshFamilyFromFile`, which accepts a file whose access token is
+ * empty — the realistic pre-broker shape once that token lapsed, and the one
+ * `readFromFile` reports as no credential at all (OSK-12194).
+ */
+function retirableCliAuthFamily(descriptorServerUrl) {
+    let stored;
+    try {
+        stored = (0, auth_storage_1.readRefreshFamilyFromFile)();
+    }
+    catch {
+        return null;
+    }
+    if (!stored?.refreshToken)
+        return null;
+    // A family a person signed in for on purpose is never a pre-broker
+    // leftover: `skrr login` / `skrr pair` stamp it, and a refresh carries the
+    // stamp forward. Retiring it undid an explicit guest login on the very next
+    // command (OSK-12293). Only an UNMARKED file — written by a CLI that
+    // predates the marker — or a daemon-minted one is retired.
+    if (stored.provenance === 'user_login')
+        return null;
+    const storedOrigin = stored.serverOrigin ? (0, auth_storage_1.normalizeServerOrigin)(stored.serverOrigin) : null;
+    const descriptorOrigin = descriptorServerUrl ? (0, auth_storage_1.normalizeServerOrigin)(descriptorServerUrl) : null;
+    if (!storedOrigin || !descriptorOrigin || storedOrigin !== descriptorOrigin)
+        return null;
+    return { origin: descriptorOrigin, refreshToken: stored.refreshToken };
+}
+/**
+ * Should this process broker BEFORE it reads the stored credential?
+ * (OSK-12194)
+ *
+ * True only on a brokered Dedicated guest: the guest hand-off descriptor is
+ * live and offers the access-token mode and NOT the durable mint (its secret
+ * can only redeem, so any `cli-auth.json` here predates broker mode), and that
+ * file carries a refresh family for the descriptor's own server — the same
+ * provenance guard the retirement applies.
+ *
+ * Without this, the retirement could never run: it runs after a successful
+ * redeem, the auto-broker runs only when the resolver found no token, and the
+ * resolver adopts a file that carries one — so a LIVE pre-broker family was
+ * used and kept forever, which is exactly the case the cleanup exists for.
+ * A laptop has no guest descriptor and is untouched: there `cli-auth.json` is
+ * a legitimate login.
+ */
+function shouldBrokerBeforeStoredCredential(descriptorPath = exports.DEDICATED_RUNTIME_CLI_HANDOFF_DESCRIPTOR) {
+    const bootstrap = readBootstrap(descriptorPath);
+    if (!bootstrap)
+        return false;
+    const modes = (0, cli_handoff_wire_1.advertisedHandoffModes)(bootstrap);
+    if (!modes.includes('access_token') || modes.includes('refresh_family'))
+        return false;
+    return retirableCliAuthFamily(bootstrap.serverUrl) !== null;
+}
 /** Bound the confirm so a slow server cannot stall a login that already worked. */
 const CONFIRM_TIMEOUT_MS = 10_000;
 /**
@@ -949,7 +998,7 @@ async function attemptDaemonBrokerLoginAndPersist(opts) {
         ...(expiryToEpochMs(outcome.refreshExpiresAt) !== undefined
             ? { refreshExpiresAt: expiryToEpochMs(outcome.refreshExpiresAt) }
             : {}),
-    }, { serverOrigin, clearReauth: true });
+    }, { serverOrigin, clearReauth: true, provenance: 'daemon_broker' });
     // Only now: the credential is on disk, so "the predecessor dies iff the
     // replacement is in place" holds. A server that predates the split ships no
     // `familyId` and has already revoked eagerly — nothing to do there.

package/dist/lib/daemonHandoff.d.ts

@@ -40,7 +40,7 @@ export interface DaemonHandoffOutcome {
      * The two absent cases are separated because they need different work — one
      * needs a binary fetched, the other only needs the service registered.
      */
-    reason?: 'opted-out' | 'brokered' | 'no-binary' | 'legacy-binary' | 'unsupported-daemon' | 'no-service';
+    reason?: 'opted-out' | 'brokered' | 'no-binary' | 'legacy-binary' | 'unsupported-daemon' | 'no-service' | 'foreign-root' | 'mint-refused' | 'platform-managed';
 }
 export declare function handOffToLocalDaemon(env?: NodeJS.ProcessEnv, opts?: {
     loginFlow?: string;