@skrr-ai/cli 0.1.58 → 0.1.60

package/dist/base-command.d.ts

@@ -20,22 +20,6 @@ type OclifFlagOutput = {
 type OclifArgOutput = {
     [name: string]: unknown;
 };
-/**
- * Base class for every CLI command.
- *
- * Responsibilities:
- * - Run the one-shot auth-out-of-config migration (Phase H).
- * - Parse global flags (`--bare`, `--token`) from argv once and thread
- *   them through the credential resolver and the HTTP adapter.
- * - Resolve the active credential via the CredentialResolver chain —
- *   flag → env → helper → keychain → file (Phase H.1). Returns the
- *   source name for display in `skrr whoami` / `skrr doctor`.
- * - Wire the Node HttpAdapter into @skrr-ai/data-provider so
- *   `dataService.*` calls use our fetch-based transport with bearer
- *   auth that matches what the resolver surfaced.
- * - Provide `requireAuth()` for commands that need a signed-in user,
- *   and `handleApiError()` for uniform error translation.
- */
 export declare abstract class BaseCommand extends Command {
     /** Add the owning agent's web detail link without overwriting resource URLs. */
     protected withAgentContext<T>(agentId: string, value: T): T & {

package/dist/base-command.js

@@ -16,6 +16,7 @@ exports.isDaemonScopedCredential = isDaemonScopedCredential;
 exports.describeDaemonScopedCredential = describeDaemonScopedCredential;
 exports.isTypedServerRefusal = isTypedServerRefusal;
 exports.isRetryableFailure = isRetryableFailure;
+const node_fs_1 = require("node:fs");
 const core_1 = require("@oclif/core");
 Object.defineProperty(exports, "Flags", { enumerable: true, get: function () { return core_1.Flags; } });
 const option_hint_1 = require("./lib/option-hint");
@@ -51,6 +52,7 @@ const update_check_1 = require("./lib/update-check");
 const web_url_1 = require("./lib/web-url");
 const edge_error_page_1 = require("./lib/edge-error-page");
 const delegated_cli_1 = require("./lib/delegated-cli");
+const dedicated_guest_1 = require("./lib/dedicated-guest");
 const tasks_1 = require("./lib/tasks");
 function assigneePayloadNeedsResolution(payload) {
     const fields = [
@@ -82,6 +84,25 @@ function assigneePayloadNeedsResolution(payload) {
  * - Provide `requireAuth()` for commands that need a signed-in user,
  *   and `handleApiError()` for uniform error translation.
  */
+/**
+ * On a Dedicated Runtime guest, the description of a daemon that did not
+ * answer the hand-off at all — revoked and exited, cycling under systemd, or
+ * gone behind a stale descriptor (OSK-12473). Null anywhere else, where "Not
+ * signed in. Run `skrr login` first." is the right sentence.
+ */
+function describeAbsentGuestDaemon(outcome, bin) {
+    const onGuest = outcome.dedicatedGuest === true || (0, dedicated_guest_1.runningOnDedicatedRuntimeGuest)();
+    if (!onGuest)
+        return null;
+    let descriptorPresent = false;
+    try {
+        descriptorPresent = (0, node_fs_1.existsSync)(daemonBroker_1.DEDICATED_RUNTIME_CLI_HANDOFF_DESCRIPTOR);
+    }
+    catch {
+        /* unreadable reads as absent */
+    }
+    return (0, daemonBrokerRefusal_1.describeGuestDaemonUnavailable)(outcome, { bin, onGuest, descriptorPresent });
+}
 class BaseCommand extends core_1.Command {
     /** Add the owning agent's web detail link without overwriting resource URLs. */
     withAgentContext(agentId, value) {
@@ -375,7 +396,9 @@ class BaseCommand extends core_1.Command {
                         }
                         : null;
                 }
-                else if ((this.brokerRefusal = (0, daemonBrokerRefusal_1.describeBrokerRefusal)(autoResult.outcome, this.config.bin))) {
+                else if ((this.brokerRefusal =
+                    (0, daemonBrokerRefusal_1.describeBrokerRefusal)(autoResult.outcome, this.config.bin) ??
+                        describeAbsentGuestDaemon(autoResult.outcome, this.config.bin))) {
                     // Reported by requireAuth(); nothing to print here.
                 }
                 else if (autoResult.outcome.reason === 'rate_limited') {
@@ -1140,19 +1163,45 @@ class BaseCommand extends core_1.Command {
                         bin: this.config.bin,
                         cliId: this.cliConfig ? (0, cli_id_1.resolveCliId)(this.cliConfig) : undefined,
                     });
-                this.failWithCliError({
-                    message: say(presentedCiToken
-                        ? `Authentication failed: this is an \`osk_ci_*\` token, which only bootstraps a ` +
+                // OSK-12474 — `apiFetch` asked the local daemon for a hand-off after the
+                // refused refresh, and the daemon refused too. Its reason decides the
+                // repair (OSK-12149, OSK-12151), and on a Dedicated guest there is no
+                // login to run, so its remedy replaces the generic "Run login".
+                const brokerRefusal = presentedCiToken || !e.brokerFailure
+                    ? null
+                    : (0, daemonBrokerRefusal_1.describeBrokerRefusal)(e.brokerFailure, this.config.bin);
+                const renewal = refreshRefusal
+                    ? refreshRefusal.message.replace(/\s*Run `[^`]+` to sign in again\.$/, '')
+                    : "This CLI's own sign-in could not be renewed.";
+                const details = {
+                    ...(refreshRefusal && bodyCode ? { accessTokenCode: bodyCode } : {}),
+                    ...(brokerRefusal
+                        ? { broker: brokerRefusal.broker, suggestion: brokerRefusal.remedy }
+                        : {}),
+                };
+                let authMessage;
+                if (presentedCiToken) {
+                    authMessage =
+                        `Authentication failed: this is an \`osk_ci_*\` token, which only bootstraps a ` +
                             `daemon (\`OVERSKY_TOKEN=<token> skrrd start\`). ${this.config.bin} commands do ` +
-                            `not accept it — sign in with \`${this.config.bin} login\` instead.`
-                        : refreshRefusal
-                            ? `Authentication failed. ${refreshRefusal.message}`
-                            : `Authentication failed. Run \`${this.config.bin} login\` to sign in again.`),
+                            `not accept it — sign in with \`${this.config.bin} login\` instead.`;
+                }
+                else if (brokerRefusal) {
+                    authMessage = `Authentication failed. ${renewal} ${brokerRefusal.headline}\n→ ${brokerRefusal.remedy}`;
+                }
+                else if (refreshRefusal) {
+                    authMessage = `Authentication failed. ${refreshRefusal.message}`;
+                }
+                else {
+                    authMessage = `Authentication failed. Run \`${this.config.bin} login\` to sign in again.`;
+                }
+                this.failWithCliError({
+                    message: say(authMessage),
                     code: refreshRefusal?.code || bodyCode || 'AUTHENTICATION_FAILED',
                     status: e.status,
                     exit: exitCode,
                     retryable: true,
-                    ...(refreshRefusal && bodyCode ? { details: { accessTokenCode: bodyCode } } : {}),
+                    ...(Object.keys(details).length > 0 ? { details } : {}),
                 });
             }
             else if ((e.status === 403 || e.status === 504) &&
@@ -1438,9 +1487,14 @@ class BaseCommand extends core_1.Command {
                 bin: this.config.bin,
                 cliId: this.cliConfig ? (0, cli_id_1.resolveCliId)(this.cliConfig) : undefined,
             });
-            const why = refusal
+            const brokerRefusal = e.brokerFailure
+                ? (0, daemonBrokerRefusal_1.describeBrokerRefusal)(e.brokerFailure, this.config.bin)
+                : null;
+            const why = (refusal
                 ? refusal.message.replace(/\s*Run `[^`]+` to sign in again\.$/, '')
-                : 'The server did not accept this sign-in.';
+                : 'The server did not accept this sign-in.') +
+                // OSK-12474 — the daemon was asked for a hand-off and refused; say why.
+                (brokerRefusal ? ` ${brokerRefusal.headline}` : '');
             this.failWithCliError({
                 message: `Authentication failed${statusSuffix}. ${why} Your ${write.summary} was not applied; it ` +
                     `was saved locally as ${queuedId} so it is not lost. Sign in with ` +

package/dist/commands/followups/checkin.js

@@ -20,7 +20,7 @@ class FollowupsCheckin extends base_command_1.BaseCommand {
         '<%= config.bin %> followups checkin --subject task:OSK-42 --why "weekly touch-base" --frequency "0 9 * * MON" --timezone America/New_York',
     ];
     static flags = {
-        subject: core_1.Flags.string({ description: 'Subject ref: type:externalKey', required: true }),
+        subject: core_1.Flags.string({ description: followups_1.FOLLOWUP_SUBJECT_FLAG_HELP, required: true }),
         why: core_1.Flags.string({ description: 'Why this wake exists, in one line', required: true }),
         in: core_1.Flags.string({
             description: 'Duration from now (90m, 2h) — the once form',
@@ -41,8 +41,21 @@ class FollowupsCheckin extends base_command_1.BaseCommand {
         json: core_1.Flags.boolean({ description: 'Output as JSON' }),
     };
     async run() {
-        this.requireAuth();
         const { flags } = await this.parse(FollowupsCheckin);
+        let subject;
+        try {
+            subject = (0, followups_1.parseSubjectRef)(flags.subject);
+        }
+        catch (err) {
+            this.failWithCliError({
+                message: err instanceof Error ? err.message : String(err),
+                code: 'FOLLOWUP_SUBJECT_INVALID',
+                exit: 2,
+                retryable: false,
+            });
+            return;
+        }
+        this.requireAuth();
         if (!flags.in && !flags.frequency) {
             this.failWithCliError({
                 message: 'Either --in <duration> or --frequency <cron> is required.',
@@ -71,7 +84,7 @@ class FollowupsCheckin extends base_command_1.BaseCommand {
                 kind: 'checkin',
                 producer: agent.boundToSession ? 'agent_in_turn' : 'user_explicit',
                 agentId: agent.id,
-                subject: (0, followups_1.parseSubjectRef)(flags.subject),
+                subject,
                 why: flags.why,
                 ...(flags.in ? { form: 'once', in: flags.in } : {}),
                 ...(flags.frequency

package/dist/commands/logout.d.ts

@@ -5,52 +5,6 @@ export declare function shouldSkipLocalLogout(input: {
     hasUnreadableEncryptedToken: boolean;
     allDevices: boolean;
 }): boolean;
-/**
- * `skrr logout` / `skrr logout --all-devices`
- *
- * Default mode (no flags): revokes the current CLI refresh session on the
- * server (best-effort) and clears every local backend (Keychain on macOS,
- * cli-auth.json fallback, and any legacy token fields in cli-config.json).
- * `baseURL` and `cliId` are preserved so the next `skrr login` defaults to
- * the same host and reuses the per-machine identity (which becomes a new
- * refresh family — server-side revocation invalidated the prior family).
- *
- * `--all-devices` (L7 fleet-grade logout): in addition to the local
- * cleanup, iterate the user's registered daemons and revoke each one
- * server-side. This is the threat-model-correct response for a stolen-
- * laptop scenario where the user wants every persistent daemon credential
- * gone immediately, regardless of which machine they're calling from.
- *
- * Architectural note: the L7 server-side has a bulk endpoint
- * (`POST /api/auth/sessions/revoke-all`) but it requires a user-scope JWT.
- * CLI sessions are minted with `scope: 'cli'` (interactive single-machine
- * use), so they cannot directly hit the bulk endpoint — that's by design,
- * preventing a leaked CLI credential from kicking the user out of every
- * other device. We instead iterate `DELETE /api/daemon-resources/:id`
- * which CLI scope CAN hit (per-resource ownership check, not scope check).
- * N round trips for N daemons; for typical fleet sizes (< 20) this is
- * sub-second. Each per-daemon DELETE produces its own audit row keyed by
- * `'user_initiated_per_device'`, which preserves forensic granularity.
- *
- * The CLI's own refresh session is NOT a Daemon resource (it's a
- * `scope='cli'` refresh-session row with no Daemon FK), so it's invisible
- * to `/api/daemon-resources`. We revoke it separately via
- * `revokeCurrentRefreshToken()`.
- *
- * Ordering rationale for `--all-devices`:
- *   1. `runAllDevices` is attempted first (remote sweep).
- *   2. If it throws (network error, API unreachable), the error is captured
- *      and a warning is emitted — but execution CONTINUES to step 3.
- *      Rationale: a user who runs `logout --all-devices` after a security
- *      incident must not be left with live tokens on disk just because the
- *      API was momentarily unreachable. Local cleanup is always the safer
- *      default; re-running --all-devices later from a connected machine is
- *      idempotent and cleans up whatever the first attempt missed.
- *   3. If the user explicitly declines the confirmation prompt inside
- *      `runAllDevices`, that path calls `this.exit(1)` which invokes
- *      `process.exit` — the try/catch is never reached, so local cleanup
- *      is correctly skipped (user said "abort").
- */
 export default class Logout extends BaseCommand {
     static description: string;
     static flags: {

package/dist/commands/logout.js

@@ -40,6 +40,7 @@ const config_1 = require("../lib/config");
 const first_party_harness_managed_1 = require("../lib/first-party-harness-managed");
 const auth_storage_1 = require("../lib/auth-storage");
 const daemonBroker_1 = require("../lib/daemonBroker");
+const dedicated_service_1 = require("../lib/dedicated-service");
 const refresh_1 = require("../lib/refresh");
 const api_fetch_1 = require("../lib/api-fetch");
 const cred_envelope_1 = require("../lib/cred-envelope");
@@ -97,6 +98,18 @@ function shouldSkipLocalLogout(input) {
  *      `process.exit` — the try/catch is never reached, so local cleanup
  *      is correctly skipped (user said "abort").
  */
+/**
+ * True only on a Dedicated Runtime guest whose platform hand-off can still
+ * serve this CLI. A laptop daemon's island file ALSO advertises
+ * `access_token`, so the descriptor alone is not evidence of a platform-managed
+ * machine: on a laptop, gating on it alone told a person who had just signed
+ * out that "skrr keeps working here through the platform's managed hand-off"
+ * (OSK-12467). The guest markers are what make that sentence true.
+ */
+function platformManagedHandoff() {
+    return (0, dedicated_service_1.runningOnDedicatedRuntimeGuest)() && Boolean((0, daemonBroker_1.findBrokeredHandoffDescriptor)());
+}
+const SIGN_IN_AGAIN = 'To sign in again, run `skrr login`.';
 class Logout extends base_command_1.BaseCommand {
     static description = 'Sign out and clear locally-stored tokens. ' +
         '--all-devices also revokes every registered daemon for this account.';
@@ -134,12 +147,12 @@ class Logout extends base_command_1.BaseCommand {
             // `access_token`) there IS no local credential to clear — the CLI holds
             // a per-process token redeemed over loopback and nothing is persisted.
             // Say that honestly rather than reporting a logout that did not happen.
-            if ((0, daemonBroker_1.findBrokeredHandoffDescriptor)()) {
+            if (platformManagedHandoff()) {
                 this.log("This machine is signed in through the platform's managed hand-off; " +
                     'there is no local credential to clear.');
             }
             else {
-                this.log('Not signed in. Nothing to do.');
+                this.log(`Not signed in. Nothing to do. ${SIGN_IN_AGAIN}`);
             }
             return;
         }
@@ -261,10 +274,15 @@ class Logout extends base_command_1.BaseCommand {
         // OWN (an explicit `skrr login`); the machine's platform-managed access is
         // untouched and skrr keeps working through it. Say both, so "Signed out."
         // is not read as "this machine can no longer reach skrr" (OSK-12043).
-        if ((0, daemonBroker_1.findBrokeredHandoffDescriptor)()) {
+        // Anywhere else there is no such hand-off, so say how to sign back in
+        // instead (OSK-12467).
+        if (platformManagedHandoff()) {
             this.log('Removed your own sign-in from this machine. ' +
                 "skrr keeps working here through the platform's managed hand-off.");
         }
+        else {
+            this.log(SIGN_IN_AGAIN);
+        }
         if (sweptLegacy.length > 0) {
             this.log(`Also removed ${sweptLegacy.length} credential${sweptLegacy.length === 1 ? '' : 's'} left by the previous product identity:`);
             for (const service of sweptLegacy)

package/dist/lib/agentic-stream.d.ts

@@ -93,7 +93,35 @@ export type AgenticStreamOptions = {
     idleTerminalProbeMs?: number;
     /** How long to keep trying to attach before reporting a detach. Default 30s. */
     attachTimeoutMs?: number;
+    /**
+     * How long a prompt listens to (and throws away) input before it is shown.
+     * Default {@link TYPE_AHEAD_DISCARD_MS}. See {@link discardTypeAhead}.
+     */
+    typeAheadDiscardMs?: number;
 };
+/**
+ * How long input arriving just before a prompt is shown is thrown away.
+ *
+ * Long enough for bytes already typed into the terminal to be read out of the
+ * kernel once stdin starts flowing (one event-loop turn in practice), short
+ * enough that nobody waits for it.
+ */
+export declare const TYPE_AHEAD_DISCARD_MS = 60;
+/**
+ * Throw away whatever was typed BEFORE a prompt is shown (OSK-12468).
+ *
+ * A key pressed while the turn was still streaming sits in the stream's buffer
+ * or the terminal's, and the first `readline.question` read it as the answer:
+ * an owner typed `y` before any `[y/N]` was visible and approved a Bash command
+ * they had never seen. An approval is only consent to what was on the screen,
+ * so every prompt now starts from an empty input: bytes the stream already
+ * holds are read and dropped, then stdin flows into a discarding listener for
+ * `windowMs` so the terminal's own buffer is drained too. Raw mode is switched
+ * on for that window because a half-typed line (`y`, no Enter) is invisible to
+ * a read in canonical mode and would otherwise surface as soon as readline
+ * enters raw mode itself. A Ctrl-C in the discarded input is still honoured.
+ */
+export declare function discardTypeAhead(input: NodeJS.ReadableStream, windowMs?: number): Promise<void>;
 /**
  * What a permission request would DO, in one line a person can judge.
  *
@@ -173,6 +201,13 @@ export type ProjectedToolEvent = {
  * of the run. The pairing is unambiguous within a turn.
  */
 export declare function projectDaemonToolEvents(envelopes: unknown[], namesByCall: Map<string, string>): ProjectedToolEvent[];
+/**
+ * The exact output the daemon's Codex backend writes on a tool item that an
+ * approval declined (`codexToolItemEndOutput` in daemon/src/backends/codex.ts).
+ * Pinned against that source by agentic-stream.spec.ts, so a rewording there
+ * fails here instead of silently reverting these calls to `[tool failed]`.
+ */
+export declare const CODEX_DECLINED_TOOL_OUTPUTS: readonly string[];
 /**
  * The line printed when a tool call ends, in the words its status earns.
  *
@@ -467,7 +502,21 @@ export declare class AgenticStreamClient {
      * client is still showing it — the question twin of handlePermissionCancel.
      */
     private handleQuestionCancel;
+    /** Prompts run one at a time: two readlines on one stdin would both read a line. */
+    private askQueue;
     private ask;
+    /**
+     * One prompt, on a readline that exists only while the prompt is on screen.
+     *
+     * The interface used to be created at the first prompt and kept until the
+     * run closed, and it was created AFTER stdin had been accumulating whatever
+     * the person typed while the turn streamed — so the first question answered
+     * itself from that type-ahead (OSK-12468). Now the input is emptied first
+     * ({@link discardTypeAhead}), only then is the question shown, and the
+     * interface is closed with the answer, so nothing typed between two prompts
+     * can answer the second one either.
+     */
+    private askNow;
     /**
      * True the first time this (kind, identity) pair is seen; false afterwards.
      * The identity is the event's OWN — a tool-use id, a message id — never a

package/dist/lib/agentic-stream.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AgenticStreamClient = exports.USER_CONNECTION_CAP_CODE = exports.NON_INTERACTIVE_QUESTION_DISMISSAL = void 0;
+exports.AgenticStreamClient = exports.USER_CONNECTION_CAP_CODE = exports.CODEX_DECLINED_TOOL_OUTPUTS = exports.TYPE_AHEAD_DISCARD_MS = exports.NON_INTERACTIVE_QUESTION_DISMISSAL = void 0;
 exports.writeJsonLine = writeJsonLine;
+exports.discardTypeAhead = discardTypeAhead;
 exports.describePermissionTarget = describePermissionTarget;
 exports.envelopesText = envelopesText;
 exports.envelopeKey = envelopeKey;
@@ -54,6 +55,59 @@ exports.NON_INTERACTIVE_QUESTION_DISMISSAL = 'No answer: this turn was started n
 function writeJsonLine(output, value) {
     output.write(`${JSON.stringify(value) ?? 'null'}\n`);
 }
+/**
+ * How long input arriving just before a prompt is shown is thrown away.
+ *
+ * Long enough for bytes already typed into the terminal to be read out of the
+ * kernel once stdin starts flowing (one event-loop turn in practice), short
+ * enough that nobody waits for it.
+ */
+exports.TYPE_AHEAD_DISCARD_MS = 60;
+/**
+ * Throw away whatever was typed BEFORE a prompt is shown (OSK-12468).
+ *
+ * A key pressed while the turn was still streaming sits in the stream's buffer
+ * or the terminal's, and the first `readline.question` read it as the answer:
+ * an owner typed `y` before any `[y/N]` was visible and approved a Bash command
+ * they had never seen. An approval is only consent to what was on the screen,
+ * so every prompt now starts from an empty input: bytes the stream already
+ * holds are read and dropped, then stdin flows into a discarding listener for
+ * `windowMs` so the terminal's own buffer is drained too. Raw mode is switched
+ * on for that window because a half-typed line (`y`, no Enter) is invisible to
+ * a read in canonical mode and would otherwise surface as soon as readline
+ * enters raw mode itself. A Ctrl-C in the discarded input is still honoured.
+ */
+async function discardTypeAhead(input, windowMs = exports.TYPE_AHEAD_DISCARD_MS) {
+    const tty = input;
+    const canSetRaw = Boolean(tty.isTTY) && typeof tty.setRawMode === 'function';
+    const wasRaw = canSetRaw ? Boolean(tty.isRaw) : false;
+    let sawInterrupt = false;
+    const drop = (chunk) => {
+        const text = typeof chunk === 'string' ? chunk : Buffer.isBuffer(chunk) ? chunk.toString() : '';
+        if (text.includes('\u0003'))
+            sawInterrupt = true;
+    };
+    try {
+        if (canSetRaw && !wasRaw)
+            tty.setRawMode(true);
+        const readable = input;
+        if (typeof readable.read === 'function') {
+            for (let chunk = readable.read(); chunk !== null; chunk = readable.read())
+                drop(chunk);
+        }
+        input.on('data', drop);
+        input.resume();
+        await new Promise((resolve) => setTimeout(resolve, Math.max(0, windowMs)));
+    }
+    finally {
+        input.removeListener('data', drop);
+        input.pause();
+        if (canSetRaw && !wasRaw)
+            tty.setRawMode(false);
+    }
+    if (sawInterrupt)
+        process.kill(process.pid, 'SIGINT');
+}
 const PERMISSION_DETAIL_MAX = 400;
 /**
  * What a permission request would DO, in one line a person can judge.
@@ -244,12 +298,48 @@ function projectDaemonToolEvents(envelopes, namesByCall) {
                 ...(call ? { toolUseId: call } : {}),
                 ...(name ? { toolName: name } : {}),
                 ...(ev.output !== undefined ? { toolResponse: ev.output } : {}),
-                ...(typeof ev.status === 'string' ? { status: ev.status } : {}),
+                ...(typeof ev.status === 'string' ? { status: daemonToolEndStatus(ev) } : {}),
             });
         }
     }
     return out;
 }
+/**
+ * The exact output the daemon's Codex backend writes on a tool item that an
+ * approval declined (`codexToolItemEndOutput` in daemon/src/backends/codex.ts).
+ * Pinned against that source by agentic-stream.spec.ts, so a rewording there
+ * fails here instead of silently reverting these calls to `[tool failed]`.
+ */
+exports.CODEX_DECLINED_TOOL_OUTPUTS = [
+    'Declined: the approval was refused, so the command did not run.',
+    'Declined: the approval was refused, so the edit was not applied.',
+];
+/**
+ * A daemon `tool-call-end` status, with a Codex decline read as `denied`.
+ *
+ * OSK-12480 — a Codex `exec_command` a person or a policy refused ends as an
+ * app-server item with status `declined`, which the daemon writes on the wire
+ * as `failed`: the envelope's status vocabulary (`ToolCallEndStatusSchema`,
+ * enforced at the server's persistence boundary) has no `denied`, so the
+ * daemon cannot say it there without breaking every server that predates it.
+ * What it does say is the output — a sentence it authors for exactly that
+ * case, and never for a call that ran. So the stream printed `[tool failed]`
+ * for a command that never started, where the daemon's Claude-style path
+ * (OSK-12469) prints `[tool denied] … (it did not run)`.
+ *
+ * Only that exact output upgrades a `failed`: a genuine failure keeps its
+ * status, and so does a decline Codex gave its own output (the status quo,
+ * never a misclassification).
+ */
+function daemonToolEndStatus(ev) {
+    const status = ev.status;
+    if (status === 'failed' &&
+        typeof ev.output === 'string' &&
+        exports.CODEX_DECLINED_TOOL_OUTPUTS.includes(ev.output)) {
+        return 'denied';
+    }
+    return status;
+}
 /**
  * The line printed when a tool call ends, in the words its status earns.
  *
@@ -266,6 +356,13 @@ function describeToolEnd(toolName, status) {
             return `[tool failed] ${name}`;
         case 'cancelled':
             return `[tool cancelled] ${name}`;
+        // OSK-12469 — a call whose approval was refused never ran. It printed
+        // `[tool completed]` just before the line saying it was denied; a call
+        // whose ask expired, or whose turn a deploy paused, did the same.
+        case 'denied':
+            return `[tool denied] ${name} (it did not run)`;
+        case 'not_run':
+            return `[tool not run] ${name}`;
         case 'unreported':
             return `[tool result not reported] ${name} (the harness never said how it ended; closed when the session ended)`;
         default:
@@ -1151,26 +1248,54 @@ class AgenticStreamClient {
             promptClosed: Boolean(open),
         });
     }
+    /** Prompts run one at a time: two readlines on one stdin would both read a line. */
+    askQueue = Promise.resolve();
     ask(prompt, signal) {
+        const next = this.askQueue.then(() => this.askNow(prompt, signal));
+        this.askQueue = next.catch(() => undefined);
+        return next;
+    }
+    /**
+     * One prompt, on a readline that exists only while the prompt is on screen.
+     *
+     * The interface used to be created at the first prompt and kept until the
+     * run closed, and it was created AFTER stdin had been accumulating whatever
+     * the person typed while the turn streamed — so the first question answered
+     * itself from that type-ahead (OSK-12468). Now the input is emptied first
+     * ({@link discardTypeAhead}), only then is the question shown, and the
+     * interface is closed with the answer, so nothing typed between two prompts
+     * can answer the second one either.
+     */
+    async askNow(prompt, signal) {
         // A prompt raised after close has nobody to answer it, and re-creating the
         // interface here would resurrect stdin for a run that is already over.
         if (this.closed || signal?.aborted)
-            return Promise.resolve('');
-        if (!this.readline) {
-            this.readline = (0, node_readline_1.createInterface)({
-                input: this.options.input ?? process.stdin,
-                output: process.stderr,
+            return '';
+        const input = this.options.input ?? process.stdin;
+        await discardTypeAhead(input, this.options.typeAheadDiscardMs ?? exports.TYPE_AHEAD_DISCARD_MS);
+        if (this.closed || signal?.aborted)
+            return '';
+        const rl = (0, node_readline_1.createInterface)({ input, output: process.stderr });
+        this.readline = rl;
+        try {
+            return await new Promise((resolve) => {
+                // Closed under us (the run ended): nobody is left to answer.
+                rl.once('close', () => resolve(''));
+                if (!signal) {
+                    rl.question(prompt, resolve);
+                    return;
+                }
+                // readline does not call back for a question aborted by its signal, so
+                // the abort settles the prompt itself.
+                signal.addEventListener('abort', () => resolve(''), { once: true });
+                rl.question(prompt, { signal }, resolve);
             });
         }
-        if (!signal) {
-            return new Promise((resolve) => this.readline.question(prompt, resolve));
+        finally {
+            if (this.readline === rl)
+                this.readline = null;
+            rl.close();
         }
-        return new Promise((resolve) => {
-            // readline does not call back for a question aborted by its signal, so
-            // the abort settles the prompt itself.
-            signal.addEventListener('abort', () => resolve(''), { once: true });
-            this.readline.question(prompt, { signal }, resolve);
-        });
     }
     /**
      * True the first time this (kind, identity) pair is seen; false afterwards.

package/dist/lib/api-fetch.d.ts

@@ -1,4 +1,5 @@
 import { type ResolvedCredential } from './credential-resolver';
+import { type DaemonBrokerFailure } from './daemonBroker';
 export interface ApiFetchOptions {
     method?: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
     body?: unknown;
@@ -36,6 +37,14 @@ export declare class ApiFetchError extends Error {
      * attributed by guesswork — see `node-adapter.ts`.
      */
     readonly requestId?: string;
+    /**
+     * Set on a 401 when this CLI's own refresh was refused AND the local
+     * daemon, asked for a hand-off, refused too (OSK-12474). The daemon's reason
+     * decides the repair, so the 401 message carries it rather than a bare
+     * "Run `skrr login`" (OSK-12149, OSK-12151); `describeBrokerRefusal` turns
+     * it into words. Absent when the daemon was never asked.
+     */
+    brokerFailure?: DaemonBrokerFailure;
     constructor(message: string, status: number, body?: string, code?: string, method?: string, requestId?: string);
 }
 /**
@@ -44,6 +53,8 @@ export declare class ApiFetchError extends Error {
  * `err.status` / `err.code`.
  */
 export declare function apiFetch<T>(pathOrUrl: string, opts?: ApiFetchOptions): Promise<T>;
+/** @internal test seam — forget this process's daemon hand-off attempt. */
+export declare function __resetDaemonHandoffFallbackForTest(): void;
 /**
  * True when the current process has a persisted refresh-capable session
  * (`skrr login` has been run and survived). Used by CI-token commands