@skrr-ai/cli 0.1.58 → 0.1.59

package/dist/base-command.d.ts

@@ -20,22 +20,6 @@ type OclifFlagOutput = {
 type OclifArgOutput = {
     [name: string]: unknown;
 };
-/**
- * Base class for every CLI command.
- *
- * Responsibilities:
- * - Run the one-shot auth-out-of-config migration (Phase H).
- * - Parse global flags (`--bare`, `--token`) from argv once and thread
- *   them through the credential resolver and the HTTP adapter.
- * - Resolve the active credential via the CredentialResolver chain —
- *   flag → env → helper → keychain → file (Phase H.1). Returns the
- *   source name for display in `skrr whoami` / `skrr doctor`.
- * - Wire the Node HttpAdapter into @skrr-ai/data-provider so
- *   `dataService.*` calls use our fetch-based transport with bearer
- *   auth that matches what the resolver surfaced.
- * - Provide `requireAuth()` for commands that need a signed-in user,
- *   and `handleApiError()` for uniform error translation.
- */
 export declare abstract class BaseCommand extends Command {
     /** Add the owning agent's web detail link without overwriting resource URLs. */
     protected withAgentContext<T>(agentId: string, value: T): T & {

package/dist/base-command.js

@@ -16,6 +16,7 @@ exports.isDaemonScopedCredential = isDaemonScopedCredential;
 exports.describeDaemonScopedCredential = describeDaemonScopedCredential;
 exports.isTypedServerRefusal = isTypedServerRefusal;
 exports.isRetryableFailure = isRetryableFailure;
+const node_fs_1 = require("node:fs");
 const core_1 = require("@oclif/core");
 Object.defineProperty(exports, "Flags", { enumerable: true, get: function () { return core_1.Flags; } });
 const option_hint_1 = require("./lib/option-hint");
@@ -51,6 +52,7 @@ const update_check_1 = require("./lib/update-check");
 const web_url_1 = require("./lib/web-url");
 const edge_error_page_1 = require("./lib/edge-error-page");
 const delegated_cli_1 = require("./lib/delegated-cli");
+const dedicated_guest_1 = require("./lib/dedicated-guest");
 const tasks_1 = require("./lib/tasks");
 function assigneePayloadNeedsResolution(payload) {
     const fields = [
@@ -82,6 +84,25 @@ function assigneePayloadNeedsResolution(payload) {
  * - Provide `requireAuth()` for commands that need a signed-in user,
  *   and `handleApiError()` for uniform error translation.
  */
+/**
+ * On a Dedicated Runtime guest, the description of a daemon that did not
+ * answer the hand-off at all — revoked and exited, cycling under systemd, or
+ * gone behind a stale descriptor (OSK-12473). Null anywhere else, where "Not
+ * signed in. Run `skrr login` first." is the right sentence.
+ */
+function describeAbsentGuestDaemon(outcome, bin) {
+    const onGuest = outcome.dedicatedGuest === true || (0, dedicated_guest_1.runningOnDedicatedRuntimeGuest)();
+    if (!onGuest)
+        return null;
+    let descriptorPresent = false;
+    try {
+        descriptorPresent = (0, node_fs_1.existsSync)(daemonBroker_1.DEDICATED_RUNTIME_CLI_HANDOFF_DESCRIPTOR);
+    }
+    catch {
+        /* unreadable reads as absent */
+    }
+    return (0, daemonBrokerRefusal_1.describeGuestDaemonUnavailable)(outcome, { bin, onGuest, descriptorPresent });
+}
 class BaseCommand extends core_1.Command {
     /** Add the owning agent's web detail link without overwriting resource URLs. */
     withAgentContext(agentId, value) {
@@ -375,7 +396,9 @@ class BaseCommand extends core_1.Command {
                         }
                         : null;
                 }
-                else if ((this.brokerRefusal = (0, daemonBrokerRefusal_1.describeBrokerRefusal)(autoResult.outcome, this.config.bin))) {
+                else if ((this.brokerRefusal =
+                    (0, daemonBrokerRefusal_1.describeBrokerRefusal)(autoResult.outcome, this.config.bin) ??
+                        describeAbsentGuestDaemon(autoResult.outcome, this.config.bin))) {
                     // Reported by requireAuth(); nothing to print here.
                 }
                 else if (autoResult.outcome.reason === 'rate_limited') {
@@ -1140,19 +1163,45 @@ class BaseCommand extends core_1.Command {
                         bin: this.config.bin,
                         cliId: this.cliConfig ? (0, cli_id_1.resolveCliId)(this.cliConfig) : undefined,
                     });
-                this.failWithCliError({
-                    message: say(presentedCiToken
-                        ? `Authentication failed: this is an \`osk_ci_*\` token, which only bootstraps a ` +
+                // OSK-12474 — `apiFetch` asked the local daemon for a hand-off after the
+                // refused refresh, and the daemon refused too. Its reason decides the
+                // repair (OSK-12149, OSK-12151), and on a Dedicated guest there is no
+                // login to run, so its remedy replaces the generic "Run login".
+                const brokerRefusal = presentedCiToken || !e.brokerFailure
+                    ? null
+                    : (0, daemonBrokerRefusal_1.describeBrokerRefusal)(e.brokerFailure, this.config.bin);
+                const renewal = refreshRefusal
+                    ? refreshRefusal.message.replace(/\s*Run `[^`]+` to sign in again\.$/, '')
+                    : "This CLI's own sign-in could not be renewed.";
+                const details = {
+                    ...(refreshRefusal && bodyCode ? { accessTokenCode: bodyCode } : {}),
+                    ...(brokerRefusal
+                        ? { broker: brokerRefusal.broker, suggestion: brokerRefusal.remedy }
+                        : {}),
+                };
+                let authMessage;
+                if (presentedCiToken) {
+                    authMessage =
+                        `Authentication failed: this is an \`osk_ci_*\` token, which only bootstraps a ` +
                             `daemon (\`OVERSKY_TOKEN=<token> skrrd start\`). ${this.config.bin} commands do ` +
-                            `not accept it — sign in with \`${this.config.bin} login\` instead.`
-                        : refreshRefusal
-                            ? `Authentication failed. ${refreshRefusal.message}`
-                            : `Authentication failed. Run \`${this.config.bin} login\` to sign in again.`),
+                            `not accept it — sign in with \`${this.config.bin} login\` instead.`;
+                }
+                else if (brokerRefusal) {
+                    authMessage = `Authentication failed. ${renewal} ${brokerRefusal.headline}\n→ ${brokerRefusal.remedy}`;
+                }
+                else if (refreshRefusal) {
+                    authMessage = `Authentication failed. ${refreshRefusal.message}`;
+                }
+                else {
+                    authMessage = `Authentication failed. Run \`${this.config.bin} login\` to sign in again.`;
+                }
+                this.failWithCliError({
+                    message: say(authMessage),
                     code: refreshRefusal?.code || bodyCode || 'AUTHENTICATION_FAILED',
                     status: e.status,
                     exit: exitCode,
                     retryable: true,
-                    ...(refreshRefusal && bodyCode ? { details: { accessTokenCode: bodyCode } } : {}),
+                    ...(Object.keys(details).length > 0 ? { details } : {}),
                 });
             }
             else if ((e.status === 403 || e.status === 504) &&
@@ -1438,9 +1487,14 @@ class BaseCommand extends core_1.Command {
                 bin: this.config.bin,
                 cliId: this.cliConfig ? (0, cli_id_1.resolveCliId)(this.cliConfig) : undefined,
             });
-            const why = refusal
+            const brokerRefusal = e.brokerFailure
+                ? (0, daemonBrokerRefusal_1.describeBrokerRefusal)(e.brokerFailure, this.config.bin)
+                : null;
+            const why = (refusal
                 ? refusal.message.replace(/\s*Run `[^`]+` to sign in again\.$/, '')
-                : 'The server did not accept this sign-in.';
+                : 'The server did not accept this sign-in.') +
+                // OSK-12474 — the daemon was asked for a hand-off and refused; say why.
+                (brokerRefusal ? ` ${brokerRefusal.headline}` : '');
             this.failWithCliError({
                 message: `Authentication failed${statusSuffix}. ${why} Your ${write.summary} was not applied; it ` +
                     `was saved locally as ${queuedId} so it is not lost. Sign in with ` +

package/dist/commands/logout.d.ts

@@ -5,52 +5,6 @@ export declare function shouldSkipLocalLogout(input: {
     hasUnreadableEncryptedToken: boolean;
     allDevices: boolean;
 }): boolean;
-/**
- * `skrr logout` / `skrr logout --all-devices`
- *
- * Default mode (no flags): revokes the current CLI refresh session on the
- * server (best-effort) and clears every local backend (Keychain on macOS,
- * cli-auth.json fallback, and any legacy token fields in cli-config.json).
- * `baseURL` and `cliId` are preserved so the next `skrr login` defaults to
- * the same host and reuses the per-machine identity (which becomes a new
- * refresh family — server-side revocation invalidated the prior family).
- *
- * `--all-devices` (L7 fleet-grade logout): in addition to the local
- * cleanup, iterate the user's registered daemons and revoke each one
- * server-side. This is the threat-model-correct response for a stolen-
- * laptop scenario where the user wants every persistent daemon credential
- * gone immediately, regardless of which machine they're calling from.
- *
- * Architectural note: the L7 server-side has a bulk endpoint
- * (`POST /api/auth/sessions/revoke-all`) but it requires a user-scope JWT.
- * CLI sessions are minted with `scope: 'cli'` (interactive single-machine
- * use), so they cannot directly hit the bulk endpoint — that's by design,
- * preventing a leaked CLI credential from kicking the user out of every
- * other device. We instead iterate `DELETE /api/daemon-resources/:id`
- * which CLI scope CAN hit (per-resource ownership check, not scope check).
- * N round trips for N daemons; for typical fleet sizes (< 20) this is
- * sub-second. Each per-daemon DELETE produces its own audit row keyed by
- * `'user_initiated_per_device'`, which preserves forensic granularity.
- *
- * The CLI's own refresh session is NOT a Daemon resource (it's a
- * `scope='cli'` refresh-session row with no Daemon FK), so it's invisible
- * to `/api/daemon-resources`. We revoke it separately via
- * `revokeCurrentRefreshToken()`.
- *
- * Ordering rationale for `--all-devices`:
- *   1. `runAllDevices` is attempted first (remote sweep).
- *   2. If it throws (network error, API unreachable), the error is captured
- *      and a warning is emitted — but execution CONTINUES to step 3.
- *      Rationale: a user who runs `logout --all-devices` after a security
- *      incident must not be left with live tokens on disk just because the
- *      API was momentarily unreachable. Local cleanup is always the safer
- *      default; re-running --all-devices later from a connected machine is
- *      idempotent and cleans up whatever the first attempt missed.
- *   3. If the user explicitly declines the confirmation prompt inside
- *      `runAllDevices`, that path calls `this.exit(1)` which invokes
- *      `process.exit` — the try/catch is never reached, so local cleanup
- *      is correctly skipped (user said "abort").
- */
 export default class Logout extends BaseCommand {
     static description: string;
     static flags: {

package/dist/commands/logout.js

@@ -40,6 +40,7 @@ const config_1 = require("../lib/config");
 const first_party_harness_managed_1 = require("../lib/first-party-harness-managed");
 const auth_storage_1 = require("../lib/auth-storage");
 const daemonBroker_1 = require("../lib/daemonBroker");
+const dedicated_service_1 = require("../lib/dedicated-service");
 const refresh_1 = require("../lib/refresh");
 const api_fetch_1 = require("../lib/api-fetch");
 const cred_envelope_1 = require("../lib/cred-envelope");
@@ -97,6 +98,18 @@ function shouldSkipLocalLogout(input) {
  *      `process.exit` — the try/catch is never reached, so local cleanup
  *      is correctly skipped (user said "abort").
  */
+/**
+ * True only on a Dedicated Runtime guest whose platform hand-off can still
+ * serve this CLI. A laptop daemon's island file ALSO advertises
+ * `access_token`, so the descriptor alone is not evidence of a platform-managed
+ * machine: on a laptop, gating on it alone told a person who had just signed
+ * out that "skrr keeps working here through the platform's managed hand-off"
+ * (OSK-12467). The guest markers are what make that sentence true.
+ */
+function platformManagedHandoff() {
+    return (0, dedicated_service_1.runningOnDedicatedRuntimeGuest)() && Boolean((0, daemonBroker_1.findBrokeredHandoffDescriptor)());
+}
+const SIGN_IN_AGAIN = 'To sign in again, run `skrr login`.';
 class Logout extends base_command_1.BaseCommand {
     static description = 'Sign out and clear locally-stored tokens. ' +
         '--all-devices also revokes every registered daemon for this account.';
@@ -134,12 +147,12 @@ class Logout extends base_command_1.BaseCommand {
             // `access_token`) there IS no local credential to clear — the CLI holds
             // a per-process token redeemed over loopback and nothing is persisted.
             // Say that honestly rather than reporting a logout that did not happen.
-            if ((0, daemonBroker_1.findBrokeredHandoffDescriptor)()) {
+            if (platformManagedHandoff()) {
                 this.log("This machine is signed in through the platform's managed hand-off; " +
                     'there is no local credential to clear.');
             }
             else {
-                this.log('Not signed in. Nothing to do.');
+                this.log(`Not signed in. Nothing to do. ${SIGN_IN_AGAIN}`);
             }
             return;
         }
@@ -261,10 +274,15 @@ class Logout extends base_command_1.BaseCommand {
         // OWN (an explicit `skrr login`); the machine's platform-managed access is
         // untouched and skrr keeps working through it. Say both, so "Signed out."
         // is not read as "this machine can no longer reach skrr" (OSK-12043).
-        if ((0, daemonBroker_1.findBrokeredHandoffDescriptor)()) {
+        // Anywhere else there is no such hand-off, so say how to sign back in
+        // instead (OSK-12467).
+        if (platformManagedHandoff()) {
             this.log('Removed your own sign-in from this machine. ' +
                 "skrr keeps working here through the platform's managed hand-off.");
         }
+        else {
+            this.log(SIGN_IN_AGAIN);
+        }
         if (sweptLegacy.length > 0) {
             this.log(`Also removed ${sweptLegacy.length} credential${sweptLegacy.length === 1 ? '' : 's'} left by the previous product identity:`);
             for (const service of sweptLegacy)

package/dist/lib/agentic-stream.d.ts

@@ -93,7 +93,35 @@ export type AgenticStreamOptions = {
     idleTerminalProbeMs?: number;
     /** How long to keep trying to attach before reporting a detach. Default 30s. */
     attachTimeoutMs?: number;
+    /**
+     * How long a prompt listens to (and throws away) input before it is shown.
+     * Default {@link TYPE_AHEAD_DISCARD_MS}. See {@link discardTypeAhead}.
+     */
+    typeAheadDiscardMs?: number;
 };
+/**
+ * How long input arriving just before a prompt is shown is thrown away.
+ *
+ * Long enough for bytes already typed into the terminal to be read out of the
+ * kernel once stdin starts flowing (one event-loop turn in practice), short
+ * enough that nobody waits for it.
+ */
+export declare const TYPE_AHEAD_DISCARD_MS = 60;
+/**
+ * Throw away whatever was typed BEFORE a prompt is shown (OSK-12468).
+ *
+ * A key pressed while the turn was still streaming sits in the stream's buffer
+ * or the terminal's, and the first `readline.question` read it as the answer:
+ * an owner typed `y` before any `[y/N]` was visible and approved a Bash command
+ * they had never seen. An approval is only consent to what was on the screen,
+ * so every prompt now starts from an empty input: bytes the stream already
+ * holds are read and dropped, then stdin flows into a discarding listener for
+ * `windowMs` so the terminal's own buffer is drained too. Raw mode is switched
+ * on for that window because a half-typed line (`y`, no Enter) is invisible to
+ * a read in canonical mode and would otherwise surface as soon as readline
+ * enters raw mode itself. A Ctrl-C in the discarded input is still honoured.
+ */
+export declare function discardTypeAhead(input: NodeJS.ReadableStream, windowMs?: number): Promise<void>;
 /**
  * What a permission request would DO, in one line a person can judge.
  *
@@ -467,7 +495,21 @@ export declare class AgenticStreamClient {
      * client is still showing it — the question twin of handlePermissionCancel.
      */
     private handleQuestionCancel;
+    /** Prompts run one at a time: two readlines on one stdin would both read a line. */
+    private askQueue;
     private ask;
+    /**
+     * One prompt, on a readline that exists only while the prompt is on screen.
+     *
+     * The interface used to be created at the first prompt and kept until the
+     * run closed, and it was created AFTER stdin had been accumulating whatever
+     * the person typed while the turn streamed — so the first question answered
+     * itself from that type-ahead (OSK-12468). Now the input is emptied first
+     * ({@link discardTypeAhead}), only then is the question shown, and the
+     * interface is closed with the answer, so nothing typed between two prompts
+     * can answer the second one either.
+     */
+    private askNow;
     /**
      * True the first time this (kind, identity) pair is seen; false afterwards.
      * The identity is the event's OWN — a tool-use id, a message id — never a

package/dist/lib/agentic-stream.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AgenticStreamClient = exports.USER_CONNECTION_CAP_CODE = exports.NON_INTERACTIVE_QUESTION_DISMISSAL = void 0;
+exports.AgenticStreamClient = exports.USER_CONNECTION_CAP_CODE = exports.TYPE_AHEAD_DISCARD_MS = exports.NON_INTERACTIVE_QUESTION_DISMISSAL = void 0;
 exports.writeJsonLine = writeJsonLine;
+exports.discardTypeAhead = discardTypeAhead;
 exports.describePermissionTarget = describePermissionTarget;
 exports.envelopesText = envelopesText;
 exports.envelopeKey = envelopeKey;
@@ -54,6 +55,59 @@ exports.NON_INTERACTIVE_QUESTION_DISMISSAL = 'No answer: this turn was started n
 function writeJsonLine(output, value) {
     output.write(`${JSON.stringify(value) ?? 'null'}\n`);
 }
+/**
+ * How long input arriving just before a prompt is shown is thrown away.
+ *
+ * Long enough for bytes already typed into the terminal to be read out of the
+ * kernel once stdin starts flowing (one event-loop turn in practice), short
+ * enough that nobody waits for it.
+ */
+exports.TYPE_AHEAD_DISCARD_MS = 60;
+/**
+ * Throw away whatever was typed BEFORE a prompt is shown (OSK-12468).
+ *
+ * A key pressed while the turn was still streaming sits in the stream's buffer
+ * or the terminal's, and the first `readline.question` read it as the answer:
+ * an owner typed `y` before any `[y/N]` was visible and approved a Bash command
+ * they had never seen. An approval is only consent to what was on the screen,
+ * so every prompt now starts from an empty input: bytes the stream already
+ * holds are read and dropped, then stdin flows into a discarding listener for
+ * `windowMs` so the terminal's own buffer is drained too. Raw mode is switched
+ * on for that window because a half-typed line (`y`, no Enter) is invisible to
+ * a read in canonical mode and would otherwise surface as soon as readline
+ * enters raw mode itself. A Ctrl-C in the discarded input is still honoured.
+ */
+async function discardTypeAhead(input, windowMs = exports.TYPE_AHEAD_DISCARD_MS) {
+    const tty = input;
+    const canSetRaw = Boolean(tty.isTTY) && typeof tty.setRawMode === 'function';
+    const wasRaw = canSetRaw ? Boolean(tty.isRaw) : false;
+    let sawInterrupt = false;
+    const drop = (chunk) => {
+        const text = typeof chunk === 'string' ? chunk : Buffer.isBuffer(chunk) ? chunk.toString() : '';
+        if (text.includes('\u0003'))
+            sawInterrupt = true;
+    };
+    try {
+        if (canSetRaw && !wasRaw)
+            tty.setRawMode(true);
+        const readable = input;
+        if (typeof readable.read === 'function') {
+            for (let chunk = readable.read(); chunk !== null; chunk = readable.read())
+                drop(chunk);
+        }
+        input.on('data', drop);
+        input.resume();
+        await new Promise((resolve) => setTimeout(resolve, Math.max(0, windowMs)));
+    }
+    finally {
+        input.removeListener('data', drop);
+        input.pause();
+        if (canSetRaw && !wasRaw)
+            tty.setRawMode(false);
+    }
+    if (sawInterrupt)
+        process.kill(process.pid, 'SIGINT');
+}
 const PERMISSION_DETAIL_MAX = 400;
 /**
  * What a permission request would DO, in one line a person can judge.
@@ -266,6 +320,13 @@ function describeToolEnd(toolName, status) {
             return `[tool failed] ${name}`;
         case 'cancelled':
             return `[tool cancelled] ${name}`;
+        // OSK-12469 — a call whose approval was refused never ran. It printed
+        // `[tool completed]` just before the line saying it was denied; a call
+        // whose ask expired, or whose turn a deploy paused, did the same.
+        case 'denied':
+            return `[tool denied] ${name} (it did not run)`;
+        case 'not_run':
+            return `[tool not run] ${name}`;
         case 'unreported':
             return `[tool result not reported] ${name} (the harness never said how it ended; closed when the session ended)`;
         default:
@@ -1151,26 +1212,54 @@ class AgenticStreamClient {
             promptClosed: Boolean(open),
         });
     }
+    /** Prompts run one at a time: two readlines on one stdin would both read a line. */
+    askQueue = Promise.resolve();
     ask(prompt, signal) {
+        const next = this.askQueue.then(() => this.askNow(prompt, signal));
+        this.askQueue = next.catch(() => undefined);
+        return next;
+    }
+    /**
+     * One prompt, on a readline that exists only while the prompt is on screen.
+     *
+     * The interface used to be created at the first prompt and kept until the
+     * run closed, and it was created AFTER stdin had been accumulating whatever
+     * the person typed while the turn streamed — so the first question answered
+     * itself from that type-ahead (OSK-12468). Now the input is emptied first
+     * ({@link discardTypeAhead}), only then is the question shown, and the
+     * interface is closed with the answer, so nothing typed between two prompts
+     * can answer the second one either.
+     */
+    async askNow(prompt, signal) {
         // A prompt raised after close has nobody to answer it, and re-creating the
         // interface here would resurrect stdin for a run that is already over.
         if (this.closed || signal?.aborted)
-            return Promise.resolve('');
-        if (!this.readline) {
-            this.readline = (0, node_readline_1.createInterface)({
-                input: this.options.input ?? process.stdin,
-                output: process.stderr,
+            return '';
+        const input = this.options.input ?? process.stdin;
+        await discardTypeAhead(input, this.options.typeAheadDiscardMs ?? exports.TYPE_AHEAD_DISCARD_MS);
+        if (this.closed || signal?.aborted)
+            return '';
+        const rl = (0, node_readline_1.createInterface)({ input, output: process.stderr });
+        this.readline = rl;
+        try {
+            return await new Promise((resolve) => {
+                // Closed under us (the run ended): nobody is left to answer.
+                rl.once('close', () => resolve(''));
+                if (!signal) {
+                    rl.question(prompt, resolve);
+                    return;
+                }
+                // readline does not call back for a question aborted by its signal, so
+                // the abort settles the prompt itself.
+                signal.addEventListener('abort', () => resolve(''), { once: true });
+                rl.question(prompt, { signal }, resolve);
             });
         }
-        if (!signal) {
-            return new Promise((resolve) => this.readline.question(prompt, resolve));
+        finally {
+            if (this.readline === rl)
+                this.readline = null;
+            rl.close();
         }
-        return new Promise((resolve) => {
-            // readline does not call back for a question aborted by its signal, so
-            // the abort settles the prompt itself.
-            signal.addEventListener('abort', () => resolve(''), { once: true });
-            this.readline.question(prompt, { signal }, resolve);
-        });
     }
     /**
      * True the first time this (kind, identity) pair is seen; false afterwards.

package/dist/lib/api-fetch.d.ts

@@ -1,4 +1,5 @@
 import { type ResolvedCredential } from './credential-resolver';
+import { type DaemonBrokerFailure } from './daemonBroker';
 export interface ApiFetchOptions {
     method?: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
     body?: unknown;
@@ -36,6 +37,14 @@ export declare class ApiFetchError extends Error {
      * attributed by guesswork — see `node-adapter.ts`.
      */
     readonly requestId?: string;
+    /**
+     * Set on a 401 when this CLI's own refresh was refused AND the local
+     * daemon, asked for a hand-off, refused too (OSK-12474). The daemon's reason
+     * decides the repair, so the 401 message carries it rather than a bare
+     * "Run `skrr login`" (OSK-12149, OSK-12151); `describeBrokerRefusal` turns
+     * it into words. Absent when the daemon was never asked.
+     */
+    brokerFailure?: DaemonBrokerFailure;
     constructor(message: string, status: number, body?: string, code?: string, method?: string, requestId?: string);
 }
 /**
@@ -44,6 +53,8 @@ export declare class ApiFetchError extends Error {
  * `err.status` / `err.code`.
  */
 export declare function apiFetch<T>(pathOrUrl: string, opts?: ApiFetchOptions): Promise<T>;
+/** @internal test seam — forget this process's daemon hand-off attempt. */
+export declare function __resetDaemonHandoffFallbackForTest(): void;
 /**
  * True when the current process has a persisted refresh-capable session
  * (`skrr login` has been run and survived). Used by CI-token commands

package/dist/lib/api-fetch.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ApiFetchError = void 0;
 exports.apiFetch = apiFetch;
+exports.__resetDaemonHandoffFallbackForTest = __resetDaemonHandoffFallbackForTest;
 exports.hasHumanSession = hasHumanSession;
 /**
  * api-fetch.ts — authenticated fetch helper for endpoints not yet in
@@ -61,6 +62,14 @@ class ApiFetchError extends Error {
      * attributed by guesswork — see `node-adapter.ts`.
      */
     requestId;
+    /**
+     * Set on a 401 when this CLI's own refresh was refused AND the local
+     * daemon, asked for a hand-off, refused too (OSK-12474). The daemon's reason
+     * decides the repair, so the 401 message carries it rather than a bare
+     * "Run `skrr login`" (OSK-12149, OSK-12151); `describeBrokerRefusal` turns
+     * it into words. Absent when the daemon was never asked.
+     */
+    brokerFailure;
     constructor(message, status, body, code, method, requestId) {
         super(message);
         this.name = 'ApiFetchError';
@@ -181,6 +190,7 @@ async function apiFetch(pathOrUrl, opts = {}) {
         });
     };
     let res = await fetchWithCredential(cred);
+    let brokerFailure = null;
     if (res.status === 401 && delegatedCli) {
         // Deliberately terminal on broker failure: an Agent whose daemon cannot
         // rotate its family must surface the 401, never fall through to
@@ -217,6 +227,25 @@ async function apiFetch(pathOrUrl, opts = {}) {
             (0, node_adapter_1.setAdapterCredentialOverride)(cred);
             res = await fetchWithCredential(cred);
         }
+        else if (fresh.skippedReason === 'refresh_failed' ||
+            fresh.skippedReason === 'no_refresh_token') {
+            // OSK-12474 — this CLI's STORED sign-in could not be renewed (e.g.
+            // DEVICE_KEY_MISMATCH after a key split). The node-adapter asks the local
+            // daemon for a hand-off at this point; this transport did not, so a
+            // healthy daemon was ignored and every apiFetch command demanded
+            // `skrr login`. Gated on the stored-credential skip reasons only: a
+            // `--token`, OVERSKY_TOKEN, CI token or bare-mode credential is the
+            // operator's, and must never be swapped for the daemon's principal.
+            const brokered = await daemonHandoffAfterRefusedRefresh();
+            if (brokered.credential) {
+                cred = brokered.credential;
+                (0, node_adapter_1.setAdapterCredentialOverride)(cred);
+                res = await fetchWithCredential(cred);
+            }
+            else {
+                brokerFailure = brokered.failure;
+            }
+        }
     }
     if (!res.ok) {
         let text = '';
@@ -235,7 +264,10 @@ async function apiFetch(pathOrUrl, opts = {}) {
         catch {
             /* ignore body read failures */
         }
-        throw new ApiFetchError(`HTTP ${res.status} ${res.statusText} — ${method} ${pathOrUrl}`, res.status, text, code, method, res.headers.get('x-request-id') || undefined);
+        const error = new ApiFetchError(`HTTP ${res.status} ${res.statusText} — ${method} ${pathOrUrl}`, res.status, text, code, method, res.headers.get('x-request-id') || undefined);
+        if (brokerFailure)
+            error.brokerFailure = brokerFailure;
+        throw error;
     }
     // 204/205 carry no body by definition; an empty body has no content-type
     // worth judging. Neither is an error.
@@ -255,6 +287,71 @@ async function apiFetch(pathOrUrl, opts = {}) {
     }
     return (await res.json());
 }
+/**
+ * One daemon hand-off attempt per process (OSK-12474). Memoized, including a
+ * failure: a command that makes many requests must not ask the daemon again
+ * on every 401, and a hand-off token that is itself refused is renewed by the
+ * brokered re-redeem branch above, never by coming back here — so this cannot
+ * loop.
+ */
+let daemonHandoffFallback = null;
+function daemonHandoffAfterRefusedRefresh() {
+    daemonHandoffFallback ??= attemptDaemonHandoffFallback();
+    return daemonHandoffFallback;
+}
+async function attemptDaemonHandoffFallback() {
+    const cliConfig = (0, config_1.loadConfig)();
+    let result;
+    try {
+        // `maybeAutoBroker` applies the same opt-outs as the node-adapter's
+        // recovery: OVERSKY_TOKEN/OVERSKY_REFRESH_TOKEN and
+        // OVERSKY_SKIP_DAEMON_BROKER=1 leave it untriggered.
+        result = await (0, daemonBroker_1.maybeAutoBroker)({ cliConfig, bareMode: false });
+    }
+    catch {
+        return { credential: null, failure: null };
+    }
+    const outcome = result.outcome;
+    if (!result.triggered || !outcome)
+        return { credential: null, failure: null };
+    if (!outcome.ok)
+        return { credential: null, failure: outcome };
+    if (result.updatedConfig) {
+        try {
+            (0, config_1.saveConfig)(result.updatedConfig);
+        }
+        catch {
+            /* non-fatal: the next process mints a new cliId (see BaseCommand.init) */
+        }
+    }
+    const accessToken = outcome.accessToken;
+    // Where a durable mint was written; a brokered hand-off is never stored.
+    const storedSource = !outcome.brokered && outcome.storedIn === 'keychain' ? 'keychain' : 'file';
+    // Say where the credential now comes from, once. The adapter slot records a
+    // brokered token as `env-token` (for refresh semantics), which a reader would
+    // take for OVERSKY_TOKEN; the label must name the descriptor (OSK-12185).
+    const label = outcome.brokered
+        ? (0, credential_resolver_1.describeCredentialSource)('env-token', {
+            kind: 'daemon-handoff',
+            ...(outcome.descriptorPath ? { descriptorPath: outcome.descriptorPath } : {}),
+        })
+        : `a new sign-in brokered by the local daemon, saved to ${(0, credential_resolver_1.describeCredentialSource)(storedSource)}`;
+    process.stderr.write(`[skrr] This CLI's own sign-in could not be renewed; using ${label} instead.\n`);
+    return {
+        credential: {
+            token: accessToken,
+            // A brokered hand-off is held in memory for this process only; the
+            // durable mint was written to the backend the broker reported.
+            source: outcome.brokered ? 'env-token' : storedSource,
+            kind: (0, credential_resolver_1.kindOf)(accessToken),
+        },
+        failure: null,
+    };
+}
+/** @internal test seam — forget this process's daemon hand-off attempt. */
+function __resetDaemonHandoffFallbackForTest() {
+    daemonHandoffFallback = null;
+}
 function trustedAutonomousBaseUrl() {
     // Only the daemon-owned alias is accepted. OVERSKY_BASE_URL is a normal
     // user/CLI override and may originate in request-carried provider env.

package/dist/lib/daemonBrokerRefusal.d.ts

@@ -49,3 +49,24 @@ export interface BrokerRefusalDescription {
  * (`base_url_mismatch`, `rate_limited`).
  */
 export declare function describeBrokerRefusal(failure: DaemonBrokerFailure, bin?: string): BrokerRefusalDescription | null;
+/**
+ * What to tell a person on a Dedicated Runtime guest when NO daemon answered
+ * the hand-off at all (OSK-12473).
+ *
+ * `describeBrokerRefusal` speaks only for a daemon that answered. On a guest
+ * the realistic broken state is a daemon that is absent: its credential was
+ * revoked and it exited by design, or systemd is cycling it, or it crashed and
+ * left its descriptor behind. The CLI then saw `no_bootstrap` / `network`, and
+ * fell to "Not signed in. Run `skrr login` first." — a login nobody performs
+ * on a guest, and which would only put a personal credential on a machine the
+ * daemon is meant to hold the account for. Say the machine's service is not
+ * running and name the owner's repair instead.
+ *
+ * Returns null off a guest, or for a daemon that answered (that is
+ * `describeBrokerRefusal`'s case).
+ */
+export declare function describeGuestDaemonUnavailable(failure: DaemonBrokerFailure | null, opts: {
+    bin?: string;
+    onGuest: boolean;
+    descriptorPresent?: boolean;
+}): BrokerRefusalDescription | null;