@skrr-ai/cli 0.1.57 → 0.1.58

package/dist/commands/agents/show.js

@@ -54,8 +54,19 @@ function agentPermissionLines(agent, harness) {
         return [`Permission:  ${stored} — enforced by the ${harness} harness`];
     }
     const lines = [];
-    if (typeof effective.mode === 'string' && effective.mode) {
-        const from = PERMISSION_SOURCE_LABELS[effective.source] ?? effective.source;
+    const from = PERMISSION_SOURCE_LABELS[effective.source] ?? effective.source;
+    if (typeof effective.refusedMode === 'string' && effective.refusedMode) {
+        // OSK-12316: a mode the harness could only honour by WIDENING it is refused
+        // at dispatch (OSK-12154); it does not "run as" anything.
+        const required = typeof effective.requiredMode === 'string' && effective.requiredMode
+            ? effective.requiredMode
+            : null;
+        lines.push(`Permission:  ${effective.refusedMode} (from ${from}) — turns are REFUSED: the ${harness} harness cannot run it without allowing more`);
+        if (required) {
+            lines.push(`${pad}Set ${required} to run (skrr agents update <agent> --default-permission-mode ${required}), or pass --permission-mode for a turn.`);
+        }
+    }
+    else if (typeof effective.mode === 'string' && effective.mode) {
         lines.push(`Permission:  ${effective.mode} (from ${from}) — enforced by the ${harness} harness`);
     }
     else {

package/dist/commands/harnesses/ping.d.ts

@@ -8,6 +8,8 @@ import { BaseCommand } from '../../base-command';
  * sends, and testing for them alone is what made the success branch dead code.
  */
 export declare function isPingSuccess(status: string | undefined): boolean;
+/** The server declared a completed probe failure, not a still-pending poll. */
+export declare function describePingFailure(status: string, error?: string | null): string;
 export default class HarnessesPing extends BaseCommand {
     static description: string;
     static examples: string[];

package/dist/commands/harnesses/ping.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isPingSuccess = isPingSuccess;
+exports.describePingFailure = describePingFailure;
 const core_1 = require("@oclif/core");
 const base_command_1 = require("../../base-command");
 const harnesses_1 = require("../../lib/harnesses");
@@ -31,6 +32,14 @@ const POLL_INTERVAL_MS = 300;
 function isPingSuccess(status) {
     return status === 'completed' || status === 'ok' || status === 'success';
 }
+/** The server declared a completed probe failure, not a still-pending poll. */
+function describePingFailure(status, error) {
+    const detail = typeof error === 'string' && error.trim() ? `: ${error.trim()}` : '.';
+    if (status === 'timeout') {
+        return `Ping timed out${detail} The daemon is registered but may be offline or not responding.`;
+    }
+    return `Ping ${status}${detail} The daemon is registered but may be offline or not responding.`;
+}
 class HarnessesPing extends base_command_1.BaseCommand {
     static description = 'Ping a harness and wait for its daemon to answer (local only)';
     static examples = [
@@ -90,7 +99,7 @@ class HarnessesPing extends base_command_1.BaseCommand {
                     await this.logReadiness(args.harness);
                 }
                 else {
-                    this.log(`Ping ${result.status}${result.error ? `: ${result.error}` : ''}.`);
+                    this.error(describePingFailure(result.status, result.error), { exit: 1 });
                 }
                 return;
             }

package/dist/commands/login.js

@@ -234,6 +234,11 @@ class Login extends base_command_1.BaseCommand {
                 if (handoff.status === 'delivered') {
                     this.log(`The local daemon was signed in too — ${handoff.detail}.`);
                 }
+                else if (handoff.reason === 'platform-managed') {
+                    // A Dedicated guest: its daemon is the platform's, so there is
+                    // nothing to install and nothing to hand over (OSK-12296).
+                    this.log("This machine's daemon is managed by the platform; there is nothing to set up here.");
+                }
                 else if (handoff.reason === 'foreign-root') {
                     // Not a failure and not a hint to re-login anything: the daemon is
                     // the default root's, and this is a second root (OSK-12189).
@@ -391,7 +396,7 @@ class Login extends base_command_1.BaseCommand {
             refreshExpiresAt: result.refreshExpiresAt
                 ? new Date(result.refreshExpiresAt).getTime()
                 : undefined,
-        }, { serverOrigin: this.cliConfig.baseURL, clearReauth: true });
+        }, { serverOrigin: this.cliConfig.baseURL, clearReauth: true, provenance: 'user_login' });
         this.log('');
         this.log(`Signed in as ${result.user.email} via recovery code on ` +
             `${(0, config_1.describeDeployment)(this.cliConfig.baseURL)}.`);

package/dist/commands/logout.js

@@ -257,6 +257,14 @@ class Logout extends base_command_1.BaseCommand {
                 : 'Signed out from all devices.'
             : 'Signed out.';
         this.log(finalMessage);
+        // On a brokered Dedicated guest the sign-in just removed was the person's
+        // OWN (an explicit `skrr login`); the machine's platform-managed access is
+        // untouched and skrr keeps working through it. Say both, so "Signed out."
+        // is not read as "this machine can no longer reach skrr" (OSK-12043).
+        if ((0, daemonBroker_1.findBrokeredHandoffDescriptor)()) {
+            this.log('Removed your own sign-in from this machine. ' +
+                "skrr keeps working here through the platform's managed hand-off.");
+        }
         if (sweptLegacy.length > 0) {
             this.log(`Also removed ${sweptLegacy.length} credential${sweptLegacy.length === 1 ? '' : 's'} left by the previous product identity:`);
             for (const service of sweptLegacy)

package/dist/commands/pair.js

@@ -273,7 +273,7 @@ function persistPairCredentials(plaintext, serverOrigin) {
     (0, auth_storage_1.writeToBackend)({
         token: plaintext.token,
         ...(plaintext.refreshToken ? { refreshToken: plaintext.refreshToken } : {}),
-    }, { serverOrigin, clearReauth: true });
+    }, { serverOrigin, clearReauth: true, provenance: 'user_login' });
     if (plaintext.dataEncryptionKey) {
         // The unified `writeToBackend` API only carries token+refresh
         // today. For now, persist the DEK as a sibling field on the next

package/dist/lib/agentic-stream.d.ts

@@ -371,6 +371,12 @@ export declare class AgenticStreamClient {
      * (OSK-12197) instead of leaving `[y/N]` open after the run stopped asking.
      */
     private readonly openPermissionPrompts;
+    /**
+     * Question prompts on the terminal still waiting for an answer, by
+     * questionId, so a server `question:cancel` can close the one it names
+     * (OSK-12208) the same way `permission:cancel` closes a permission prompt.
+     */
+    private readonly openQuestionPrompts;
     /** Text already written to the terminal, for suffix-only rendering. */
     private renderedText;
     private idleTimer;
@@ -455,6 +461,12 @@ export declare class AgenticStreamClient {
      * and close the terminal prompt if this client is still showing it.
      */
     private handlePermissionCancel;
+    /**
+     * The server closed a question (OSK-12208): nobody answered it in time, or
+     * the turn ended first. Say so, and close the terminal prompt if this
+     * client is still showing it — the question twin of handlePermissionCancel.
+     */
+    private handleQuestionCancel;
     private ask;
     /**
      * True the first time this (kind, identity) pair is seen; false afterwards.

package/dist/lib/agentic-stream.js

@@ -563,6 +563,12 @@ class AgenticStreamClient {
      * (OSK-12197) instead of leaving `[y/N]` open after the run stopped asking.
      */
     openPermissionPrompts = new Map();
+    /**
+     * Question prompts on the terminal still waiting for an answer, by
+     * questionId, so a server `question:cancel` can close the one it names
+     * (OSK-12208) the same way `permission:cancel` closes a permission prompt.
+     */
+    openQuestionPrompts = new Map();
     /** Text already written to the terminal, for suffix-only rendering. */
     renderedText = '';
     idleTimer = null;
@@ -961,6 +967,11 @@ class AgenticStreamClient {
             if (match(event))
                 void this.handleQuestion(event);
         });
+        socket.on('question:cancel', (event) => {
+            if (!match(event))
+                return;
+            this.handleQuestionCancel(event);
+        });
         socket.on('error:unauthorized', (event) => {
             if (match(event))
                 this.finish('failed', event);
@@ -1063,9 +1074,20 @@ class AgenticStreamClient {
         const interactive = this.options.input !== undefined || Boolean(process.stdin.isTTY);
         const answers = {};
         if (interactive) {
+            const prompt = new AbortController();
+            if (event.questionId)
+                this.openQuestionPrompts.set(event.questionId, prompt);
             for (const question of event.questions ?? []) {
-                answers[question.header ?? question.question] = await this.ask(`${question.header ?? 'Question'}: ${question.question}\n> `);
+                if (prompt.signal.aborted)
+                    break;
+                answers[question.header ?? question.question] = await this.ask(`${question.header ?? 'Question'}: ${question.question}\n> `, prompt.signal);
             }
+            if (event.questionId)
+                this.openQuestionPrompts.delete(event.questionId);
+            // Closed by the server (it stopped waiting, or the turn ended): an answer
+            // sent now would be read by nobody, and would look like a person's.
+            if (prompt.signal.aborted)
+                return;
         }
         else {
             answers._dismissed = exports.NON_INTERACTIVE_QUESTION_DISMISSAL;
@@ -1110,6 +1132,25 @@ class AgenticStreamClient {
                 : {}),
         });
     }
+    /**
+     * The server closed a question (OSK-12208): nobody answered it in time, or
+     * the turn ended first. Say so, and close the terminal prompt if this
+     * client is still showing it — the question twin of handlePermissionCancel.
+     */
+    handleQuestionCancel(event) {
+        const questionId = typeof event.questionId === 'string' ? event.questionId : undefined;
+        if (!this.firstTimeSeen('question-cancel', questionId))
+            return;
+        const open = questionId ? this.openQuestionPrompts.get(questionId) : undefined;
+        if (questionId)
+            this.openQuestionPrompts.delete(questionId);
+        open?.abort();
+        this.emit({
+            ...event,
+            type: 'question.cancelled',
+            promptClosed: Boolean(open),
+        });
+    }
     ask(prompt, signal) {
         // A prompt raised after close has nobody to answer it, and re-creating the
         // interface here would resurrect stdin for a run that is already over.
@@ -1243,6 +1284,14 @@ class AgenticStreamClient {
             output.write(`\n[${event.type}]\n`);
             this.renderedText = this.accumulated;
         }
+        else if (event.type === 'question.cancelled') {
+            // A question the run stopped waiting for (OSK-12208).
+            const why = typeof event.message === 'string' && event.message
+                ? event.message
+                : `closed (${String(event.reason ?? 'cancelled')})`;
+            output.write(`\n[question] ${why}\n`);
+            this.renderedText = this.accumulated;
+        }
         else if (event.type === 'permission.approved' && event.auto === true) {
             // Said out loud, because nobody was asked: the flag approved it, and a
             // reader of this log should see which tools that covered (OSK-10323).

package/dist/lib/auth-storage.d.ts

@@ -11,7 +11,26 @@ export interface AuthBundle {
      * current config; callers never need to set it.
      */
     owner?: CredentialOwner;
+    /**
+     * Who created the refresh family this bundle carries (OSK-12293). Recorded
+     * in the file in plaintext, like `owner`, so it can be read without the key.
+     * Absent on everything an older CLI wrote.
+     */
+    provenance?: CredentialProvenance;
 }
+/**
+ * How a stored refresh family came to exist.
+ *
+ * - `user_login`: a person signed in on purpose (`skrr login` in any of its
+ *   flows, `skrr pair`). On a Dedicated guest this is the one stored family
+ *   the broker-mode retirement must never touch: the person asked for it.
+ * - `daemon_broker`: the local daemon minted it through its hand-off.
+ *
+ * An absent value means an older CLI wrote the file and the family's origin
+ * is unknown, which on a brokered guest is the pre-broker leftover the
+ * retirement exists for (OSK-12194).
+ */
+export type CredentialProvenance = 'user_login' | 'daemon_broker';
 /** Which skrr config a credential belongs to. */
 export interface CredentialOwner {
     /** Resolved config root (`~/.skrr`, or the `SKRR_CONFIG_DIR` override). */
@@ -39,6 +58,13 @@ export interface WriteOptions {
     serverOrigin?: string;
     /** Clear a stale needs-reauth latch after a server has issued fresh credentials. */
     clearReauth?: boolean;
+    /**
+     * Who created the family being written. A write that names none is a
+     * ROTATION of the stored family (a refresh), and keeps the provenance the
+     * stored file records for the same server — so a refresh never erases the
+     * marker a login wrote, and never invents one an older CLI did not.
+     */
+    provenance?: CredentialProvenance;
 }
 /**
  * File-backend-only read. Exported for the brokered-hand-off migration
@@ -62,6 +88,7 @@ export declare function readFromFile(): AuthBundle | null;
 export declare function readRefreshFamilyFromFile(): {
     refreshToken: string;
     serverOrigin?: string;
+    provenance?: CredentialProvenance;
 } | null;
 /**
  * Delete `~/.skrr/cli-auth.json` only (the keychain is untouched). Exported

package/dist/lib/auth-storage.js

@@ -106,6 +106,12 @@ const cli_id_1 = require("./cli-id");
  *  `auth.json`, deliberately distinct so the two binaries never clobber
  *  each other's tokens (CLI holds scope=cli, daemon holds scope=daemon). */
 const AUTH_FILENAME = 'cli-auth.json';
+const CREDENTIAL_PROVENANCES = ['user_login', 'daemon_broker'];
+function parseProvenance(raw) {
+    return CREDENTIAL_PROVENANCES.includes(raw)
+        ? raw
+        : undefined;
+}
 /**
  * The config root — the same one `cli-config.json` (and so `cliId`) lives in.
  *
@@ -253,8 +259,29 @@ function readRefreshFamilyFromFile() {
     return {
         refreshToken: bundle.refreshToken,
         ...(bundle.serverOrigin ? { serverOrigin: bundle.serverOrigin } : {}),
+        ...(bundle.provenance ? { provenance: bundle.provenance } : {}),
     };
 }
+/**
+ * The provenance this root's `cli-auth.json` records for `serverOrigin`, read
+ * from the plaintext field alone — no decrypt, no ownership rewrite. Used by a
+ * rotation to carry the marker forward.
+ */
+function storedFileProvenance(serverOrigin) {
+    let parsed;
+    try {
+        parsed = JSON.parse(fs.readFileSync(authFilePath(), 'utf-8'));
+    }
+    catch {
+        return undefined;
+    }
+    const provenance = parseProvenance(parsed?.provenance);
+    if (!provenance)
+        return undefined;
+    const stored = typeof parsed.serverOrigin === 'string' ? normalizeServerOrigin(parsed.serverOrigin) : null;
+    const next = serverOrigin ? normalizeServerOrigin(serverOrigin) : null;
+    return stored && next && stored === next ? provenance : undefined;
+}
 /**
  * This root's file, refused when it belongs to another config; else, under a
  * root override, the pre-override `$HOME/.skrr` file when it is positively ours.
@@ -349,6 +376,9 @@ function readFileAt(p, upgradeInPlace, opts = {}) {
     }
     if (owner)
         bundle.owner = owner;
+    const provenance = parseProvenance(parsed.provenance);
+    if (provenance)
+        bundle.provenance = provenance;
     // Best-effort upgrade: re-write the bundle so legacy plaintext fields
     // become wrapped on the next read. A failure here doesn't break the
     // read path — the caller already has the plaintext bundle.
@@ -413,6 +443,8 @@ function writeToFile(bundle) {
     // Rewrites of an existing bundle (the envelope upgrade) keep its recorded
     // owner; everything else is stamped with this config.
     wireBundle.owner = bundle.owner ?? ownerFor(bundle);
+    if (bundle.provenance)
+        wireBundle.provenance = bundle.provenance;
     // tmp + rename so no racing reader ever sees a partial file; chmod 0600
     // on the final file so the same-UID blast-radius is as narrow as the
     // file backend can offer.
@@ -772,6 +804,16 @@ function writeToBackend(bundle, options = {}) {
     // Always stamp THIS config as the owner — a bundle read back and re-written
     // (e.g. `pair`) must not carry a record forward from wherever it came from.
     persistedBundle = { ...persistedBundle, owner: ownerFor(persistedBundle) };
+    // Provenance: an explicit one wins (a login or a broker mint creates a new
+    // family); otherwise this is a rotation of the stored family and keeps what
+    // the file recorded for the same server (OSK-12293).
+    const provenance = options.provenance ??
+        persistedBundle.provenance ??
+        storedFileProvenance(persistedBundle.serverOrigin);
+    if (provenance)
+        persistedBundle = { ...persistedBundle, provenance };
+    else
+        delete persistedBundle.provenance;
     let backend;
     if (keychain.isAvailable()) {
         if (writeToKeychain(persistedBundle)) {

package/dist/lib/commitments.js

@@ -660,6 +660,7 @@ const STALLED_DIAGNOSES = {
     observation_unreadable: 'the latest check could not read every configured source',
     execution_budget_exhausted: 'recent planned work was skipped — the execution budget is exhausted',
     no_advancement: 'no server-recorded advancement exists inside the declared window',
+    owner_action_blocked: 'a completed work run is blocked pending owner action',
     contract_version_mismatch: 'the running contract is older than the authored one; its triggers have not resynced',
 };
 /**

package/dist/lib/daemonBroker.d.ts

@@ -329,7 +329,11 @@ export declare function findBrokeredHandoffDescriptor(profile?: string): LocalBo
  *   1. the descriptor that just redeemed IS the Dedicated Runtime guest
  *      hand-off file (`/run/skrr-dedicated-runtime/...`),
  *   2. `~/.skrr/cli-auth.json` reads cleanly and carries a refresh token,
- *   3. its stored `serverOrigin` matches the descriptor's `serverUrl`.
+ *   3. its stored `serverOrigin` matches the descriptor's `serverUrl`,
+ *   4. it is not marked `provenance: 'user_login'`. Since OSK-12293 every
+ *      explicit sign-in (`skrr login`, `skrr pair`) records that marker in
+ *      the file, so a login the person made seconds ago is kept and used;
+ *      an unmarked file was written by a CLI that predates the marker.
  *
  * When provenance can't be proven the file is KEPT: an explicit `skrr login`
  * on a guest is rare but real, and a stale extra family is bounded by the

package/dist/lib/daemonBroker.js

@@ -826,7 +826,11 @@ function findBrokeredHandoffDescriptor(profile = 'default') {
  *   1. the descriptor that just redeemed IS the Dedicated Runtime guest
  *      hand-off file (`/run/skrr-dedicated-runtime/...`),
  *   2. `~/.skrr/cli-auth.json` reads cleanly and carries a refresh token,
- *   3. its stored `serverOrigin` matches the descriptor's `serverUrl`.
+ *   3. its stored `serverOrigin` matches the descriptor's `serverUrl`,
+ *   4. it is not marked `provenance: 'user_login'`. Since OSK-12293 every
+ *      explicit sign-in (`skrr login`, `skrr pair`) records that marker in
+ *      the file, so a login the person made seconds ago is kept and used;
+ *      an unmarked file was written by a CLI that predates the marker.
  *
  * When provenance can't be proven the file is KEPT: an explicit `skrr login`
  * on a guest is rare but real, and a stale extra family is bounded by the
@@ -869,6 +873,13 @@ function retirableCliAuthFamily(descriptorServerUrl) {
     }
     if (!stored?.refreshToken)
         return null;
+    // A family a person signed in for on purpose is never a pre-broker
+    // leftover: `skrr login` / `skrr pair` stamp it, and a refresh carries the
+    // stamp forward. Retiring it undid an explicit guest login on the very next
+    // command (OSK-12293). Only an UNMARKED file — written by a CLI that
+    // predates the marker — or a daemon-minted one is retired.
+    if (stored.provenance === 'user_login')
+        return null;
     const storedOrigin = stored.serverOrigin ? (0, auth_storage_1.normalizeServerOrigin)(stored.serverOrigin) : null;
     const descriptorOrigin = descriptorServerUrl ? (0, auth_storage_1.normalizeServerOrigin)(descriptorServerUrl) : null;
     if (!storedOrigin || !descriptorOrigin || storedOrigin !== descriptorOrigin)
@@ -987,7 +998,7 @@ async function attemptDaemonBrokerLoginAndPersist(opts) {
         ...(expiryToEpochMs(outcome.refreshExpiresAt) !== undefined
             ? { refreshExpiresAt: expiryToEpochMs(outcome.refreshExpiresAt) }
             : {}),
-    }, { serverOrigin, clearReauth: true });
+    }, { serverOrigin, clearReauth: true, provenance: 'daemon_broker' });
     // Only now: the credential is on disk, so "the predecessor dies iff the
     // replacement is in place" holds. A server that predates the split ships no
     // `familyId` and has already revoked eagerly — nothing to do there.

package/dist/lib/daemonHandoff.d.ts

@@ -40,7 +40,7 @@ export interface DaemonHandoffOutcome {
      * The two absent cases are separated because they need different work — one
      * needs a binary fetched, the other only needs the service registered.
      */
-    reason?: 'opted-out' | 'brokered' | 'no-binary' | 'legacy-binary' | 'unsupported-daemon' | 'no-service' | 'foreign-root' | 'mint-refused';
+    reason?: 'opted-out' | 'brokered' | 'no-binary' | 'legacy-binary' | 'unsupported-daemon' | 'no-service' | 'foreign-root' | 'mint-refused' | 'platform-managed';
 }
 export declare function handOffToLocalDaemon(env?: NodeJS.ProcessEnv, opts?: {
     loginFlow?: string;

package/dist/lib/daemonHandoff.js

@@ -5,6 +5,7 @@ const node_child_process_1 = require("node:child_process");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const config_1 = require("./config");
 const daemon_handoff_opt_out_1 = require("./daemon-handoff-opt-out");
+const dedicated_service_1 = require("./dedicated-service");
 const exec_runtime_binary_1 = require("./exec-runtime-binary");
 const keychain_1 = require("./keychain");
 /**
@@ -196,6 +197,23 @@ async function handOffToLocalDaemon(env = process.env, opts = {}) {
             detail: 'the local daemon brokered this login, so it already has a working credential',
         };
     }
+    // A Dedicated Runtime guest's daemon belongs to the platform: the image
+    // installs it, the platform signs it in, and it runs as a uid the workload
+    // cannot touch. A person's login is theirs alone and is never handed to it,
+    // and there is nothing for them to install. Without this the workload found
+    // no daemon it could use and login ended by telling them to run
+    // `skrr daemon install` on a machine where that is wrong (OSK-12296).
+    //
+    // Detected the way the rest of the CLI detects a guest — the workload uid
+    // stamp, or the guest markers the image and daemon own, among them the
+    // hand-off descriptor directory under /run/skrr-dedicated-runtime.
+    if ((0, dedicated_service_1.runningOnDedicatedRuntimeGuest)(env)) {
+        return {
+            status: 'skipped',
+            reason: 'platform-managed',
+            detail: "this machine's daemon is managed by the platform",
+        };
+    }
     // A relocated config root (`SKRR_CONFIG_DIR`) is a second sign-in on this
     // machine, not the machine's sign-in. The installed daemon service carries no
     // config-root override, so it reads the DEFAULT root — its credential, its

package/dist/lib/login.js

@@ -332,7 +332,7 @@ async function cliLoginWithRefreshToken(opts) {
         ...(pair.accessExpiresAt !== undefined ? { expiresAt: pair.accessExpiresAt } : {}),
         refreshToken: pair.refreshToken,
         ...(pair.refreshExpiresAt !== undefined ? { refreshExpiresAt: pair.refreshExpiresAt } : {}),
-    }, { serverOrigin: serverUrl, clearReauth: true });
+    }, { serverOrigin: serverUrl, clearReauth: true, provenance: 'user_login' });
     return {
         token: accessToken,
         refreshToken: pair.refreshToken,
@@ -490,7 +490,7 @@ async function runDeviceCode(serverUrl, cliId, reason, ssh, errorMessage) {
                     : {}),
             }
             : {}),
-    }, { serverOrigin: serverUrl, clearReauth: true });
+    }, { serverOrigin: serverUrl, clearReauth: true, provenance: 'user_login' });
     console.log('  ✓ Authorized.');
     return {
         token: approved.token,

package/dist/lib/oauthLogin.js

@@ -366,7 +366,9 @@ async function runOAuthLogin(opts) {
                     // server URL — daemonBroker.ts:543, login.ts:322, refresh.ts:282 —
                     // so this was the lone outlier, and it only bites a deployment
                     // whose web and API origins differ.
-                    { serverOrigin: requestedServerUrl, clearReauth: true });
+                    // A person signed in on purpose: a brokered Dedicated guest must
+                    // keep this family rather than retire it as pre-broker (OSK-12293).
+                    { serverOrigin: requestedServerUrl, clearReauth: true, provenance: 'user_login' });
                     console.log('  ✓ Login successful! Token saved.');
                     finish({
                         ok: true,