@skrr-ai/cli 0.1.57 → 0.1.59

package/dist/lib/agentic-stream.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AgenticStreamClient = exports.USER_CONNECTION_CAP_CODE = exports.NON_INTERACTIVE_QUESTION_DISMISSAL = void 0;
+exports.AgenticStreamClient = exports.USER_CONNECTION_CAP_CODE = exports.TYPE_AHEAD_DISCARD_MS = exports.NON_INTERACTIVE_QUESTION_DISMISSAL = void 0;
 exports.writeJsonLine = writeJsonLine;
+exports.discardTypeAhead = discardTypeAhead;
 exports.describePermissionTarget = describePermissionTarget;
 exports.envelopesText = envelopesText;
 exports.envelopeKey = envelopeKey;
@@ -54,6 +55,59 @@ exports.NON_INTERACTIVE_QUESTION_DISMISSAL = 'No answer: this turn was started n
 function writeJsonLine(output, value) {
     output.write(`${JSON.stringify(value) ?? 'null'}\n`);
 }
+/**
+ * How long input arriving just before a prompt is shown is thrown away.
+ *
+ * Long enough for bytes already typed into the terminal to be read out of the
+ * kernel once stdin starts flowing (one event-loop turn in practice), short
+ * enough that nobody waits for it.
+ */
+exports.TYPE_AHEAD_DISCARD_MS = 60;
+/**
+ * Throw away whatever was typed BEFORE a prompt is shown (OSK-12468).
+ *
+ * A key pressed while the turn was still streaming sits in the stream's buffer
+ * or the terminal's, and the first `readline.question` read it as the answer:
+ * an owner typed `y` before any `[y/N]` was visible and approved a Bash command
+ * they had never seen. An approval is only consent to what was on the screen,
+ * so every prompt now starts from an empty input: bytes the stream already
+ * holds are read and dropped, then stdin flows into a discarding listener for
+ * `windowMs` so the terminal's own buffer is drained too. Raw mode is switched
+ * on for that window because a half-typed line (`y`, no Enter) is invisible to
+ * a read in canonical mode and would otherwise surface as soon as readline
+ * enters raw mode itself. A Ctrl-C in the discarded input is still honoured.
+ */
+async function discardTypeAhead(input, windowMs = exports.TYPE_AHEAD_DISCARD_MS) {
+    const tty = input;
+    const canSetRaw = Boolean(tty.isTTY) && typeof tty.setRawMode === 'function';
+    const wasRaw = canSetRaw ? Boolean(tty.isRaw) : false;
+    let sawInterrupt = false;
+    const drop = (chunk) => {
+        const text = typeof chunk === 'string' ? chunk : Buffer.isBuffer(chunk) ? chunk.toString() : '';
+        if (text.includes('\u0003'))
+            sawInterrupt = true;
+    };
+    try {
+        if (canSetRaw && !wasRaw)
+            tty.setRawMode(true);
+        const readable = input;
+        if (typeof readable.read === 'function') {
+            for (let chunk = readable.read(); chunk !== null; chunk = readable.read())
+                drop(chunk);
+        }
+        input.on('data', drop);
+        input.resume();
+        await new Promise((resolve) => setTimeout(resolve, Math.max(0, windowMs)));
+    }
+    finally {
+        input.removeListener('data', drop);
+        input.pause();
+        if (canSetRaw && !wasRaw)
+            tty.setRawMode(false);
+    }
+    if (sawInterrupt)
+        process.kill(process.pid, 'SIGINT');
+}
 const PERMISSION_DETAIL_MAX = 400;
 /**
  * What a permission request would DO, in one line a person can judge.
@@ -266,6 +320,13 @@ function describeToolEnd(toolName, status) {
             return `[tool failed] ${name}`;
         case 'cancelled':
             return `[tool cancelled] ${name}`;
+        // OSK-12469 — a call whose approval was refused never ran. It printed
+        // `[tool completed]` just before the line saying it was denied; a call
+        // whose ask expired, or whose turn a deploy paused, did the same.
+        case 'denied':
+            return `[tool denied] ${name} (it did not run)`;
+        case 'not_run':
+            return `[tool not run] ${name}`;
         case 'unreported':
             return `[tool result not reported] ${name} (the harness never said how it ended; closed when the session ended)`;
         default:
@@ -563,6 +624,12 @@ class AgenticStreamClient {
      * (OSK-12197) instead of leaving `[y/N]` open after the run stopped asking.
      */
     openPermissionPrompts = new Map();
+    /**
+     * Question prompts on the terminal still waiting for an answer, by
+     * questionId, so a server `question:cancel` can close the one it names
+     * (OSK-12208) the same way `permission:cancel` closes a permission prompt.
+     */
+    openQuestionPrompts = new Map();
     /** Text already written to the terminal, for suffix-only rendering. */
     renderedText = '';
     idleTimer = null;
@@ -961,6 +1028,11 @@ class AgenticStreamClient {
             if (match(event))
                 void this.handleQuestion(event);
         });
+        socket.on('question:cancel', (event) => {
+            if (!match(event))
+                return;
+            this.handleQuestionCancel(event);
+        });
         socket.on('error:unauthorized', (event) => {
             if (match(event))
                 this.finish('failed', event);
@@ -1063,9 +1135,20 @@ class AgenticStreamClient {
         const interactive = this.options.input !== undefined || Boolean(process.stdin.isTTY);
         const answers = {};
         if (interactive) {
+            const prompt = new AbortController();
+            if (event.questionId)
+                this.openQuestionPrompts.set(event.questionId, prompt);
             for (const question of event.questions ?? []) {
-                answers[question.header ?? question.question] = await this.ask(`${question.header ?? 'Question'}: ${question.question}\n> `);
+                if (prompt.signal.aborted)
+                    break;
+                answers[question.header ?? question.question] = await this.ask(`${question.header ?? 'Question'}: ${question.question}\n> `, prompt.signal);
             }
+            if (event.questionId)
+                this.openQuestionPrompts.delete(event.questionId);
+            // Closed by the server (it stopped waiting, or the turn ended): an answer
+            // sent now would be read by nobody, and would look like a person's.
+            if (prompt.signal.aborted)
+                return;
         }
         else {
             answers._dismissed = exports.NON_INTERACTIVE_QUESTION_DISMISSAL;
@@ -1110,26 +1193,73 @@ class AgenticStreamClient {
                 : {}),
         });
     }
+    /**
+     * The server closed a question (OSK-12208): nobody answered it in time, or
+     * the turn ended first. Say so, and close the terminal prompt if this
+     * client is still showing it — the question twin of handlePermissionCancel.
+     */
+    handleQuestionCancel(event) {
+        const questionId = typeof event.questionId === 'string' ? event.questionId : undefined;
+        if (!this.firstTimeSeen('question-cancel', questionId))
+            return;
+        const open = questionId ? this.openQuestionPrompts.get(questionId) : undefined;
+        if (questionId)
+            this.openQuestionPrompts.delete(questionId);
+        open?.abort();
+        this.emit({
+            ...event,
+            type: 'question.cancelled',
+            promptClosed: Boolean(open),
+        });
+    }
+    /** Prompts run one at a time: two readlines on one stdin would both read a line. */
+    askQueue = Promise.resolve();
     ask(prompt, signal) {
+        const next = this.askQueue.then(() => this.askNow(prompt, signal));
+        this.askQueue = next.catch(() => undefined);
+        return next;
+    }
+    /**
+     * One prompt, on a readline that exists only while the prompt is on screen.
+     *
+     * The interface used to be created at the first prompt and kept until the
+     * run closed, and it was created AFTER stdin had been accumulating whatever
+     * the person typed while the turn streamed — so the first question answered
+     * itself from that type-ahead (OSK-12468). Now the input is emptied first
+     * ({@link discardTypeAhead}), only then is the question shown, and the
+     * interface is closed with the answer, so nothing typed between two prompts
+     * can answer the second one either.
+     */
+    async askNow(prompt, signal) {
         // A prompt raised after close has nobody to answer it, and re-creating the
         // interface here would resurrect stdin for a run that is already over.
         if (this.closed || signal?.aborted)
-            return Promise.resolve('');
-        if (!this.readline) {
-            this.readline = (0, node_readline_1.createInterface)({
-                input: this.options.input ?? process.stdin,
-                output: process.stderr,
+            return '';
+        const input = this.options.input ?? process.stdin;
+        await discardTypeAhead(input, this.options.typeAheadDiscardMs ?? exports.TYPE_AHEAD_DISCARD_MS);
+        if (this.closed || signal?.aborted)
+            return '';
+        const rl = (0, node_readline_1.createInterface)({ input, output: process.stderr });
+        this.readline = rl;
+        try {
+            return await new Promise((resolve) => {
+                // Closed under us (the run ended): nobody is left to answer.
+                rl.once('close', () => resolve(''));
+                if (!signal) {
+                    rl.question(prompt, resolve);
+                    return;
+                }
+                // readline does not call back for a question aborted by its signal, so
+                // the abort settles the prompt itself.
+                signal.addEventListener('abort', () => resolve(''), { once: true });
+                rl.question(prompt, { signal }, resolve);
             });
         }
-        if (!signal) {
-            return new Promise((resolve) => this.readline.question(prompt, resolve));
+        finally {
+            if (this.readline === rl)
+                this.readline = null;
+            rl.close();
         }
-        return new Promise((resolve) => {
-            // readline does not call back for a question aborted by its signal, so
-            // the abort settles the prompt itself.
-            signal.addEventListener('abort', () => resolve(''), { once: true });
-            this.readline.question(prompt, { signal }, resolve);
-        });
     }
     /**
      * True the first time this (kind, identity) pair is seen; false afterwards.
@@ -1243,6 +1373,14 @@ class AgenticStreamClient {
             output.write(`\n[${event.type}]\n`);
             this.renderedText = this.accumulated;
         }
+        else if (event.type === 'question.cancelled') {
+            // A question the run stopped waiting for (OSK-12208).
+            const why = typeof event.message === 'string' && event.message
+                ? event.message
+                : `closed (${String(event.reason ?? 'cancelled')})`;
+            output.write(`\n[question] ${why}\n`);
+            this.renderedText = this.accumulated;
+        }
         else if (event.type === 'permission.approved' && event.auto === true) {
             // Said out loud, because nobody was asked: the flag approved it, and a
             // reader of this log should see which tools that covered (OSK-10323).

package/dist/lib/api-fetch.d.ts

@@ -1,4 +1,5 @@
 import { type ResolvedCredential } from './credential-resolver';
+import { type DaemonBrokerFailure } from './daemonBroker';
 export interface ApiFetchOptions {
     method?: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
     body?: unknown;
@@ -36,6 +37,14 @@ export declare class ApiFetchError extends Error {
      * attributed by guesswork — see `node-adapter.ts`.
      */
     readonly requestId?: string;
+    /**
+     * Set on a 401 when this CLI's own refresh was refused AND the local
+     * daemon, asked for a hand-off, refused too (OSK-12474). The daemon's reason
+     * decides the repair, so the 401 message carries it rather than a bare
+     * "Run `skrr login`" (OSK-12149, OSK-12151); `describeBrokerRefusal` turns
+     * it into words. Absent when the daemon was never asked.
+     */
+    brokerFailure?: DaemonBrokerFailure;
     constructor(message: string, status: number, body?: string, code?: string, method?: string, requestId?: string);
 }
 /**
@@ -44,6 +53,8 @@ export declare class ApiFetchError extends Error {
  * `err.status` / `err.code`.
  */
 export declare function apiFetch<T>(pathOrUrl: string, opts?: ApiFetchOptions): Promise<T>;
+/** @internal test seam — forget this process's daemon hand-off attempt. */
+export declare function __resetDaemonHandoffFallbackForTest(): void;
 /**
  * True when the current process has a persisted refresh-capable session
  * (`skrr login` has been run and survived). Used by CI-token commands

package/dist/lib/api-fetch.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ApiFetchError = void 0;
 exports.apiFetch = apiFetch;
+exports.__resetDaemonHandoffFallbackForTest = __resetDaemonHandoffFallbackForTest;
 exports.hasHumanSession = hasHumanSession;
 /**
  * api-fetch.ts — authenticated fetch helper for endpoints not yet in
@@ -61,6 +62,14 @@ class ApiFetchError extends Error {
      * attributed by guesswork — see `node-adapter.ts`.
      */
     requestId;
+    /**
+     * Set on a 401 when this CLI's own refresh was refused AND the local
+     * daemon, asked for a hand-off, refused too (OSK-12474). The daemon's reason
+     * decides the repair, so the 401 message carries it rather than a bare
+     * "Run `skrr login`" (OSK-12149, OSK-12151); `describeBrokerRefusal` turns
+     * it into words. Absent when the daemon was never asked.
+     */
+    brokerFailure;
     constructor(message, status, body, code, method, requestId) {
         super(message);
         this.name = 'ApiFetchError';
@@ -181,6 +190,7 @@ async function apiFetch(pathOrUrl, opts = {}) {
         });
     };
     let res = await fetchWithCredential(cred);
+    let brokerFailure = null;
     if (res.status === 401 && delegatedCli) {
         // Deliberately terminal on broker failure: an Agent whose daemon cannot
         // rotate its family must surface the 401, never fall through to
@@ -217,6 +227,25 @@ async function apiFetch(pathOrUrl, opts = {}) {
             (0, node_adapter_1.setAdapterCredentialOverride)(cred);
             res = await fetchWithCredential(cred);
         }
+        else if (fresh.skippedReason === 'refresh_failed' ||
+            fresh.skippedReason === 'no_refresh_token') {
+            // OSK-12474 — this CLI's STORED sign-in could not be renewed (e.g.
+            // DEVICE_KEY_MISMATCH after a key split). The node-adapter asks the local
+            // daemon for a hand-off at this point; this transport did not, so a
+            // healthy daemon was ignored and every apiFetch command demanded
+            // `skrr login`. Gated on the stored-credential skip reasons only: a
+            // `--token`, OVERSKY_TOKEN, CI token or bare-mode credential is the
+            // operator's, and must never be swapped for the daemon's principal.
+            const brokered = await daemonHandoffAfterRefusedRefresh();
+            if (brokered.credential) {
+                cred = brokered.credential;
+                (0, node_adapter_1.setAdapterCredentialOverride)(cred);
+                res = await fetchWithCredential(cred);
+            }
+            else {
+                brokerFailure = brokered.failure;
+            }
+        }
     }
     if (!res.ok) {
         let text = '';
@@ -235,7 +264,10 @@ async function apiFetch(pathOrUrl, opts = {}) {
         catch {
             /* ignore body read failures */
         }
-        throw new ApiFetchError(`HTTP ${res.status} ${res.statusText} — ${method} ${pathOrUrl}`, res.status, text, code, method, res.headers.get('x-request-id') || undefined);
+        const error = new ApiFetchError(`HTTP ${res.status} ${res.statusText} — ${method} ${pathOrUrl}`, res.status, text, code, method, res.headers.get('x-request-id') || undefined);
+        if (brokerFailure)
+            error.brokerFailure = brokerFailure;
+        throw error;
     }
     // 204/205 carry no body by definition; an empty body has no content-type
     // worth judging. Neither is an error.
@@ -255,6 +287,71 @@ async function apiFetch(pathOrUrl, opts = {}) {
     }
     return (await res.json());
 }
+/**
+ * One daemon hand-off attempt per process (OSK-12474). Memoized, including a
+ * failure: a command that makes many requests must not ask the daemon again
+ * on every 401, and a hand-off token that is itself refused is renewed by the
+ * brokered re-redeem branch above, never by coming back here — so this cannot
+ * loop.
+ */
+let daemonHandoffFallback = null;
+function daemonHandoffAfterRefusedRefresh() {
+    daemonHandoffFallback ??= attemptDaemonHandoffFallback();
+    return daemonHandoffFallback;
+}
+async function attemptDaemonHandoffFallback() {
+    const cliConfig = (0, config_1.loadConfig)();
+    let result;
+    try {
+        // `maybeAutoBroker` applies the same opt-outs as the node-adapter's
+        // recovery: OVERSKY_TOKEN/OVERSKY_REFRESH_TOKEN and
+        // OVERSKY_SKIP_DAEMON_BROKER=1 leave it untriggered.
+        result = await (0, daemonBroker_1.maybeAutoBroker)({ cliConfig, bareMode: false });
+    }
+    catch {
+        return { credential: null, failure: null };
+    }
+    const outcome = result.outcome;
+    if (!result.triggered || !outcome)
+        return { credential: null, failure: null };
+    if (!outcome.ok)
+        return { credential: null, failure: outcome };
+    if (result.updatedConfig) {
+        try {
+            (0, config_1.saveConfig)(result.updatedConfig);
+        }
+        catch {
+            /* non-fatal: the next process mints a new cliId (see BaseCommand.init) */
+        }
+    }
+    const accessToken = outcome.accessToken;
+    // Where a durable mint was written; a brokered hand-off is never stored.
+    const storedSource = !outcome.brokered && outcome.storedIn === 'keychain' ? 'keychain' : 'file';
+    // Say where the credential now comes from, once. The adapter slot records a
+    // brokered token as `env-token` (for refresh semantics), which a reader would
+    // take for OVERSKY_TOKEN; the label must name the descriptor (OSK-12185).
+    const label = outcome.brokered
+        ? (0, credential_resolver_1.describeCredentialSource)('env-token', {
+            kind: 'daemon-handoff',
+            ...(outcome.descriptorPath ? { descriptorPath: outcome.descriptorPath } : {}),
+        })
+        : `a new sign-in brokered by the local daemon, saved to ${(0, credential_resolver_1.describeCredentialSource)(storedSource)}`;
+    process.stderr.write(`[skrr] This CLI's own sign-in could not be renewed; using ${label} instead.\n`);
+    return {
+        credential: {
+            token: accessToken,
+            // A brokered hand-off is held in memory for this process only; the
+            // durable mint was written to the backend the broker reported.
+            source: outcome.brokered ? 'env-token' : storedSource,
+            kind: (0, credential_resolver_1.kindOf)(accessToken),
+        },
+        failure: null,
+    };
+}
+/** @internal test seam — forget this process's daemon hand-off attempt. */
+function __resetDaemonHandoffFallbackForTest() {
+    daemonHandoffFallback = null;
+}
 function trustedAutonomousBaseUrl() {
     // Only the daemon-owned alias is accepted. OVERSKY_BASE_URL is a normal
     // user/CLI override and may originate in request-carried provider env.

package/dist/lib/auth-storage.d.ts

@@ -11,7 +11,26 @@ export interface AuthBundle {
      * current config; callers never need to set it.
      */
     owner?: CredentialOwner;
+    /**
+     * Who created the refresh family this bundle carries (OSK-12293). Recorded
+     * in the file in plaintext, like `owner`, so it can be read without the key.
+     * Absent on everything an older CLI wrote.
+     */
+    provenance?: CredentialProvenance;
 }
+/**
+ * How a stored refresh family came to exist.
+ *
+ * - `user_login`: a person signed in on purpose (`skrr login` in any of its
+ *   flows, `skrr pair`). On a Dedicated guest this is the one stored family
+ *   the broker-mode retirement must never touch: the person asked for it.
+ * - `daemon_broker`: the local daemon minted it through its hand-off.
+ *
+ * An absent value means an older CLI wrote the file and the family's origin
+ * is unknown, which on a brokered guest is the pre-broker leftover the
+ * retirement exists for (OSK-12194).
+ */
+export type CredentialProvenance = 'user_login' | 'daemon_broker';
 /** Which skrr config a credential belongs to. */
 export interface CredentialOwner {
     /** Resolved config root (`~/.skrr`, or the `SKRR_CONFIG_DIR` override). */
@@ -39,6 +58,13 @@ export interface WriteOptions {
     serverOrigin?: string;
     /** Clear a stale needs-reauth latch after a server has issued fresh credentials. */
     clearReauth?: boolean;
+    /**
+     * Who created the family being written. A write that names none is a
+     * ROTATION of the stored family (a refresh), and keeps the provenance the
+     * stored file records for the same server — so a refresh never erases the
+     * marker a login wrote, and never invents one an older CLI did not.
+     */
+    provenance?: CredentialProvenance;
 }
 /**
  * File-backend-only read. Exported for the brokered-hand-off migration
@@ -62,6 +88,7 @@ export declare function readFromFile(): AuthBundle | null;
 export declare function readRefreshFamilyFromFile(): {
     refreshToken: string;
     serverOrigin?: string;
+    provenance?: CredentialProvenance;
 } | null;
 /**
  * Delete `~/.skrr/cli-auth.json` only (the keychain is untouched). Exported

package/dist/lib/auth-storage.js

@@ -106,6 +106,12 @@ const cli_id_1 = require("./cli-id");
  *  `auth.json`, deliberately distinct so the two binaries never clobber
  *  each other's tokens (CLI holds scope=cli, daemon holds scope=daemon). */
 const AUTH_FILENAME = 'cli-auth.json';
+const CREDENTIAL_PROVENANCES = ['user_login', 'daemon_broker'];
+function parseProvenance(raw) {
+    return CREDENTIAL_PROVENANCES.includes(raw)
+        ? raw
+        : undefined;
+}
 /**
  * The config root — the same one `cli-config.json` (and so `cliId`) lives in.
  *
@@ -253,8 +259,29 @@ function readRefreshFamilyFromFile() {
     return {
         refreshToken: bundle.refreshToken,
         ...(bundle.serverOrigin ? { serverOrigin: bundle.serverOrigin } : {}),
+        ...(bundle.provenance ? { provenance: bundle.provenance } : {}),
     };
 }
+/**
+ * The provenance this root's `cli-auth.json` records for `serverOrigin`, read
+ * from the plaintext field alone — no decrypt, no ownership rewrite. Used by a
+ * rotation to carry the marker forward.
+ */
+function storedFileProvenance(serverOrigin) {
+    let parsed;
+    try {
+        parsed = JSON.parse(fs.readFileSync(authFilePath(), 'utf-8'));
+    }
+    catch {
+        return undefined;
+    }
+    const provenance = parseProvenance(parsed?.provenance);
+    if (!provenance)
+        return undefined;
+    const stored = typeof parsed.serverOrigin === 'string' ? normalizeServerOrigin(parsed.serverOrigin) : null;
+    const next = serverOrigin ? normalizeServerOrigin(serverOrigin) : null;
+    return stored && next && stored === next ? provenance : undefined;
+}
 /**
  * This root's file, refused when it belongs to another config; else, under a
  * root override, the pre-override `$HOME/.skrr` file when it is positively ours.
@@ -349,6 +376,9 @@ function readFileAt(p, upgradeInPlace, opts = {}) {
     }
     if (owner)
         bundle.owner = owner;
+    const provenance = parseProvenance(parsed.provenance);
+    if (provenance)
+        bundle.provenance = provenance;
     // Best-effort upgrade: re-write the bundle so legacy plaintext fields
     // become wrapped on the next read. A failure here doesn't break the
     // read path — the caller already has the plaintext bundle.
@@ -413,6 +443,8 @@ function writeToFile(bundle) {
     // Rewrites of an existing bundle (the envelope upgrade) keep its recorded
     // owner; everything else is stamped with this config.
     wireBundle.owner = bundle.owner ?? ownerFor(bundle);
+    if (bundle.provenance)
+        wireBundle.provenance = bundle.provenance;
     // tmp + rename so no racing reader ever sees a partial file; chmod 0600
     // on the final file so the same-UID blast-radius is as narrow as the
     // file backend can offer.
@@ -772,6 +804,16 @@ function writeToBackend(bundle, options = {}) {
     // Always stamp THIS config as the owner — a bundle read back and re-written
     // (e.g. `pair`) must not carry a record forward from wherever it came from.
     persistedBundle = { ...persistedBundle, owner: ownerFor(persistedBundle) };
+    // Provenance: an explicit one wins (a login or a broker mint creates a new
+    // family); otherwise this is a rotation of the stored family and keeps what
+    // the file recorded for the same server (OSK-12293).
+    const provenance = options.provenance ??
+        persistedBundle.provenance ??
+        storedFileProvenance(persistedBundle.serverOrigin);
+    if (provenance)
+        persistedBundle = { ...persistedBundle, provenance };
+    else
+        delete persistedBundle.provenance;
     let backend;
     if (keychain.isAvailable()) {
         if (writeToKeychain(persistedBundle)) {

package/dist/lib/commitments.js

@@ -660,6 +660,7 @@ const STALLED_DIAGNOSES = {
     observation_unreadable: 'the latest check could not read every configured source',
     execution_budget_exhausted: 'recent planned work was skipped — the execution budget is exhausted',
     no_advancement: 'no server-recorded advancement exists inside the declared window',
+    owner_action_blocked: 'a completed work run is blocked pending owner action',
     contract_version_mismatch: 'the running contract is older than the authored one; its triggers have not resynced',
 };
 /**

package/dist/lib/daemonBroker.d.ts

@@ -329,7 +329,11 @@ export declare function findBrokeredHandoffDescriptor(profile?: string): LocalBo
  *   1. the descriptor that just redeemed IS the Dedicated Runtime guest
  *      hand-off file (`/run/skrr-dedicated-runtime/...`),
  *   2. `~/.skrr/cli-auth.json` reads cleanly and carries a refresh token,
- *   3. its stored `serverOrigin` matches the descriptor's `serverUrl`.
+ *   3. its stored `serverOrigin` matches the descriptor's `serverUrl`,
+ *   4. it is not marked `provenance: 'user_login'`. Since OSK-12293 every
+ *      explicit sign-in (`skrr login`, `skrr pair`) records that marker in
+ *      the file, so a login the person made seconds ago is kept and used;
+ *      an unmarked file was written by a CLI that predates the marker.
  *
  * When provenance can't be proven the file is KEPT: an explicit `skrr login`
  * on a guest is rare but real, and a stale extra family is bounded by the

package/dist/lib/daemonBroker.js

@@ -826,7 +826,11 @@ function findBrokeredHandoffDescriptor(profile = 'default') {
  *   1. the descriptor that just redeemed IS the Dedicated Runtime guest
  *      hand-off file (`/run/skrr-dedicated-runtime/...`),
  *   2. `~/.skrr/cli-auth.json` reads cleanly and carries a refresh token,
- *   3. its stored `serverOrigin` matches the descriptor's `serverUrl`.
+ *   3. its stored `serverOrigin` matches the descriptor's `serverUrl`,
+ *   4. it is not marked `provenance: 'user_login'`. Since OSK-12293 every
+ *      explicit sign-in (`skrr login`, `skrr pair`) records that marker in
+ *      the file, so a login the person made seconds ago is kept and used;
+ *      an unmarked file was written by a CLI that predates the marker.
  *
  * When provenance can't be proven the file is KEPT: an explicit `skrr login`
  * on a guest is rare but real, and a stale extra family is bounded by the
@@ -869,6 +873,13 @@ function retirableCliAuthFamily(descriptorServerUrl) {
     }
     if (!stored?.refreshToken)
         return null;
+    // A family a person signed in for on purpose is never a pre-broker
+    // leftover: `skrr login` / `skrr pair` stamp it, and a refresh carries the
+    // stamp forward. Retiring it undid an explicit guest login on the very next
+    // command (OSK-12293). Only an UNMARKED file — written by a CLI that
+    // predates the marker — or a daemon-minted one is retired.
+    if (stored.provenance === 'user_login')
+        return null;
     const storedOrigin = stored.serverOrigin ? (0, auth_storage_1.normalizeServerOrigin)(stored.serverOrigin) : null;
     const descriptorOrigin = descriptorServerUrl ? (0, auth_storage_1.normalizeServerOrigin)(descriptorServerUrl) : null;
     if (!storedOrigin || !descriptorOrigin || storedOrigin !== descriptorOrigin)
@@ -987,7 +998,7 @@ async function attemptDaemonBrokerLoginAndPersist(opts) {
         ...(expiryToEpochMs(outcome.refreshExpiresAt) !== undefined
             ? { refreshExpiresAt: expiryToEpochMs(outcome.refreshExpiresAt) }
             : {}),
-    }, { serverOrigin, clearReauth: true });
+    }, { serverOrigin, clearReauth: true, provenance: 'daemon_broker' });
     // Only now: the credential is on disk, so "the predecessor dies iff the
     // replacement is in place" holds. A server that predates the split ships no
     // `familyId` and has already revoked eagerly — nothing to do there.

package/dist/lib/daemonBrokerRefusal.d.ts

@@ -49,3 +49,24 @@ export interface BrokerRefusalDescription {
  * (`base_url_mismatch`, `rate_limited`).
  */
 export declare function describeBrokerRefusal(failure: DaemonBrokerFailure, bin?: string): BrokerRefusalDescription | null;
+/**
+ * What to tell a person on a Dedicated Runtime guest when NO daemon answered
+ * the hand-off at all (OSK-12473).
+ *
+ * `describeBrokerRefusal` speaks only for a daemon that answered. On a guest
+ * the realistic broken state is a daemon that is absent: its credential was
+ * revoked and it exited by design, or systemd is cycling it, or it crashed and
+ * left its descriptor behind. The CLI then saw `no_bootstrap` / `network`, and
+ * fell to "Not signed in. Run `skrr login` first." — a login nobody performs
+ * on a guest, and which would only put a personal credential on a machine the
+ * daemon is meant to hold the account for. Say the machine's service is not
+ * running and name the owner's repair instead.
+ *
+ * Returns null off a guest, or for a daemon that answered (that is
+ * `describeBrokerRefusal`'s case).
+ */
+export declare function describeGuestDaemonUnavailable(failure: DaemonBrokerFailure | null, opts: {
+    bin?: string;
+    onGuest: boolean;
+    descriptorPresent?: boolean;
+}): BrokerRefusalDescription | null;